Re: [Users] Planned feature set of Virtuozzo 7

2015-09-25 Thread Dietmar Maurer
> some of you asked about feature set of Virtuzzo 7 and difference between free
> and commercial versions.  We have prepared table with feature comparison for
> OpenVZ -stable, Virtuozzo 7 and other virtualization solutions -
> https://openvz.org/Comparison
> 
> Pay attention it is not a final feature set, some features can be added in
> future till final release.

I found some errors regarding Proxmox VE. Please can you correct them?

* Unified management tool for CTs and VMs: Yes

We provide a single API Server, and you can even manage a whole
cluster using that single API. CLI tools also use that unified API.
Also we provide a single GUI to manage both VMs and CTs.

Supported Storage: We also support DAS and iSCSI, an ZFS (local and remote)!

Thin Disk Provisioning: yes (depends on underlying storage driver).

Virtual Disk Format: please add 'raw' and 'vmdk'

Virtual SAN: Please add 'sheepdog' there

Storage QoS: Fully implemented for VMs (not for containers).

Completely isolated disk subsystem for CTs: yes - using LVM, ZFS, or loop
devices

Power Panel: Yes - we have a world class GUI using ExtJS

Best Regards,

Dietmar

___
Users mailing list
Users@openvz.org
https://lists.openvz.org/mailman/listinfo/users


Re: [Users] Big comparison Ploop and ext4 vs simfs vs ZFS

2015-07-24 Thread Dietmar Maurer
 The point is that in your use case ZFS works very well and saves you 1TB of
 disk space.  Great for you.  For my use case the overhead of learning and
 deploying ZFS greatly outweighs the handful of GBs I might potentially save in
 disk space.

Don't get me wrong, but zfs is totally simply to use and deploy - much simpler
than anything else (considering all the great feature it provides).

___
Users mailing list
Users@openvz.org
https://lists.openvz.org/mailman/listinfo/users


Re: [Users] SIMFS users

2015-07-21 Thread Dietmar Maurer
 we want find people who still use simfs for OpenVZ containers.
 Do we have such users?

All proxmox VE users (as we do not have ploop support).

___
Users mailing list
Users@openvz.org
https://lists.openvz.org/mailman/listinfo/users


Re: [Users] OpenVZ and ZFS excellent experience

2015-01-12 Thread Dietmar Maurer
 Unless I misunderstood, they also say there that ZFS code can be merged into
 the Linux source tree... but that distributing a binary built from it would be
 a no-no.  

They claim distributing as binary module is no problem! They have split the code
into spl (Solaris porting Layer), and a separate zfs module which use the SPL
interface. That make it really hard to claim that zfs is derived work from
Linux.

They can say a lot of things but what really matters is how the distros behave.
 So far almost no distros include ZFS kernel modules and related support
packages... and (I believe) the reason is that they want to mitigate risk.
 Quite a few ship the fuse-based ZFS stuff.  I believe the small handful of
distros that do include ZFS support via kernel modules are located outside of
the US. 

see:
http://warpmech.com/?news=myth-busting-series-zfs-on-linux-has-license-problems

That article claims that Lawrence Livermore National Lab already ships binary
zfs modules to customers.

 With regards to OpenVZ it mostly matters what Red Hat does and clones.
 
 I know Proxmox is a huge Debian fan... does Debian offer ZFS kernel modules
 and if not, why not?  How about Proxmox VE?

Proxmox is working on that.

  You can link to libzfs. As example, see grub code. Grub is GPL and they link
  with libzfs. Do I miss something?
 
 Again, are distros shipping grub2 with or without ZFS support?  

Proxmox VE will ship grub with zfs support. But I think further distros will
follow soon.

___
Users mailing list
Users@openvz.org
https://lists.openvz.org/mailman/listinfo/users


Re: [Users] OpenVZ and ZFS excellent experience

2015-01-12 Thread Dietmar Maurer
 I know Proxmox is a huge Debian fan... does Debian offer ZFS kernel modules
 and if not, why not?  How about Proxmox VE?

Besides, I would like to improve support for more storage types on OpenVZ.
I think direct support for zfs, rbd, dm-thin would be great (snaphshot, clone).

But for me the current OpenVZ status is a bit unclear, because of the announced
move to virtuozzo-core.
I guess that means the OpenVZ vzctl code will be completely replaced?

And when can we expect a first release?

___
Users mailing list
Users@openvz.org
https://lists.openvz.org/mailman/listinfo/users


Re: [Users] veth and bridge mac address

2014-03-31 Thread Dietmar Maurer
 Apparently Proxmox guys patched the kernel. Could you please
 1 ask them to provide the patch
 2 file a bug to bugzilla.openvz.org

Hi Kir,

this patch is here:

https://git.proxmox.com/?p=pve-kernel-2.6.32.git;a=blob;f=bridge-patch.diff;h=6780d621ec1411352fe11f0e573fb53da57c3812;hb=HEAD

I just want to note that I posted this patch on all channels years ago, but 
nobody was interested.

Also, none of the bridge developers was able to tell me why the bridge needs to 
have that weird behavior.

Besides, we are using that for several years now, and it works without problems.




___
Users mailing list
Users@openvz.org
https://lists.openvz.org/mailman/listinfo/users


[Users] Missing changelogs in kernel.spec

2012-04-03 Thread Dietmar Maurer
Just downloaded the new stable kernel:

http://wiki.openvz.org/Download/kernel/rhel6/042stab053.5

But the last changelog entry is:

%changelog
* Thu Jan 19 2012 Frantisek Hrbata fhrb...@redhat.com [2.6.32-220.4.1.el6]

I thought this should be 2.6.32-220.7.1.el6? So what version is that kernel 
exactly?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Proc statistic interface for venet

2011-10-06 Thread Dietmar Maurer
Well, I want statistics for each container. /proc/net/dev only shows overall 
traffic?

- Dietmar

 -Original Message-
 From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
 Behalf Of Gary Wallis
 Sent: Donnerstag, 06. Oktober 2011 17:30
 To: users@openvz.org
 Subject: Re: [Users] Proc statistic interface for venet
 
 This is how I get traffic data...
 
 [root@xc7 ubc]# grep venet0 /proc/net/dev
 venet0:205043590448 1030583416000 0  0 0
 199946969183 10428423760 14520 0   0  0
 [root@xc7 ubc]#
 
 Dietmar Maurer wrote:
  Is there some interface to get statistics for venet device? I found and old
 patch:
 
  http://forum.openvz.org/index.php?t=msgth=459goto=2581#msg_2581
 
  but seems that this is not included in current 2.6.32 kernel?
 
  - Dietmar
 ___
 Users mailing list
 Users@openvz.org
 https://openvz.org/mailman/listinfo/users



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Proc statistic interface for venet

2011-10-06 Thread Dietmar Maurer
 Each container has one also...for example for VEID=17801

Oh,  so I do not need to call 'vzctl exec' to get  that data?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Proc statistic interface for venet

2011-10-06 Thread Dietmar Maurer
 Why? Save time and effort just get it directly from the hardware node as my
 example shows using /vz/root/VEID/proc/net/dev. 

Well, that file is simply not there on my system (latest openvz 2.6.32 kernel). 
I can only see it inside the VM.

So what kernel do you use exactly?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Checkpoint and restore on 64 bit Debian host.

2011-10-04 Thread Dietmar Maurer
 I'm experimenting with this now. I converted vzkernel-2.6.32-
 042stab037.1.x86_64.rpm into a deb and used it to boot but AWS did not want
 to run it. Complaining about XEN options. I see that the older kernel 
 versions had
 specific XEN builds. I'm going to try and recompile the  2.6.32-042stab037 
 kernel
 from src. Are there any particular flags that I should set?

You could also use the pve kernel from:

ftp://download.proxmox.com/debian/dists/squeeze/pve/binary-amd64/pve-kernel-2.6.32-6-pve_2.6.32-46_amd64.deb

That is the latest openvz kernel compiled for debian squeeze.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Starting CentOS 5.x container... never fully init's

2010-11-18 Thread Dietmar Maurer
 virtbox1:~# vzctl enter 103
 entered into CT 103
 [r...@pxebox /]# ps aux
 USER   PID %CPU %MEMVSZ   RSS TTY  STAT START   TIME COMMAND
 root 1  0.0  0.0   2068   612 ?Ss   20:42   0:00 init [3]
 root21  0.0  0.010016 ?S20:42   0:00 [init-logger]

You run init logger - so what is the content of /var/log/init.log  - any hint 
there?

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Re: kvm support in openvz kernel

2010-09-15 Thread Dietmar Maurer
  Newer openVZ kernels does not work well with KVM.
  http://bugzilla.openvz.org/show_bug.cgi?id=1610
 
  Br, martin
 
 Not really true, I'm currently running
 2.6.18-194.8.1.el5.028stab070.2 + kvm-83 from opennode with several
 winxp amd win2003 servers for 2 weeks now without any issues.

You tried to reproduce above bug? Or you simply do not use VNC?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] RE: slow fsync rate

2010-08-25 Thread Dietmar Maurer
 I believe, 2.6.32 is just more honest on fsync and really forces drive
 to save data. 

We use reasonable RAID controllers with BBU here. Such controller can handle  
1000 fsync/sec. So IMHO above argument does not count at all.

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] slow fsync rate

2010-08-24 Thread Dietmar Maurer
Hi all,

we observe very slow fsync rates on newer 2.6.32 kernel with OpenVZ:

It is possible to reproduce the problem with sysbench:

# sysbench --test=fileio --file-num=1 --file-total-size=50G --file-fsync-all=on 
--file-test-mode=seqrewr --max-time=100 --file-block-size=4096 --max-requests=0 
run

Requests/sec executed is considerable slower on OpenVZ kernel (factor 20 on 
Intel Modular Server).

Can someone reproduce that problem?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] slow fsync rate

2010-08-24 Thread Dietmar Maurer
NO, I talk about performance at the host.


From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On Behalf Of 
Roberto Mello
Sent: Dienstag, 24. August 2010 14:48
To: users@openvz.org
Subject: Re: [Users] slow fsync rate

On Tue, Aug 24, 2010 at 4:36 AM, Dietmar Maurer 
diet...@proxmox.commailto:diet...@proxmox.com wrote:
Hi all,

we observe very slow fsync rates on newer 2.6.32 kernel with OpenVZ:

It is possible to reproduce the problem with sysbench:

# sysbench --test=fileio --file-num=1 --file-total-size=50G --file-fsync-all=on 
--file-test-mode=seqrewr --max-time=100 --file-block-size=4096 --max-requests=0 
run

Requests/sec executed is considerable slower on OpenVZ kernel (factor 20 on 
Intel Modular Server).

Are you running the tests in a VE? I'd be curious to see your vz.conf file, and 
the output of /proc/user_beancounters for the VE you are running the tests on. 
Do you have quotas turned on?

Roberto
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] HN with multiple CT with public IP addresses

2010-08-10 Thread Dietmar Maurer
 $ wget http://whatismyip.org
 
 on CTs on one server, it outputs the public IP address of the CT,
 which is fine, while on the other machine it outputs the IP address of
 the HN.
 
 Any idea what is wrong?

wget downloads files - so I am not sure what you mean? 

You connect to the wrong IP? 

If so, check your DNS settings (or /etc/hosts).

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] kvm module for centos ovzkernel?

2010-04-08 Thread Dietmar Maurer
 So far as duplicating your observations with this VNC bug, I haven't
 found the time to give an Ubuntu KVM VM with SDL(X11) a try. Sorry.  I
 say report it as a bug to the Red Hat folks and see what they say.

Well, the bug is clearly OpenVZ related, and only occur with newer
version of OpenVZ. But it seem nobody here is really interesting in
fixing those issues.

 Just out of curiosity, have you tried out any of the SPICE stuff yet?
 What barriers remain to it becoming widely deployed?  I have been too
 busy at work to get very far with it yet.

Sorry, I also had no time to test that SPICE stuff.

- Dietmar 

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] kvm module for centos ovzkernel?

2010-04-07 Thread Dietmar Maurer
 Those delays are not there with previous OpenVZ kernels (seem to be
 related to recent scheduler changes).
 
 Can you reproduce it using the WindowsServer2008R2 install?

I don't have any media/licenses for Windows 2008 Server R2.  Is that the only 
OS affected?

As I posted before, you can also observe that with ubuntu if you use SDL(X11) 
instead of vnc.

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] kvm module for centos ovzkernel?

2010-04-06 Thread Dietmar Maurer
No clock setting there either.  Maybe I do have the problem but just 
attributed it to remote X lag

Hi Scott,

the bug is really obvious if you use my test case over X11. The problem does 
not show up if 
you use the default VNC screen driver.

But if you do a WindowsServer2008R2 install you can also notice the delays - it 
is quite unusable.

Those delays are not there with previous OpenVZ kernels (seem to be related to 
recent scheduler changes).

Can you reproduce it using the WindowsServer2008R2 install?

- Dietmar 



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] inaccurate timers with ovzkernel-2.6.18-164.11.1.el5.028stab068.3

2010-03-09 Thread Dietmar Maurer
We run kvm on ovz kernels. But it seems that the latest ovzkernel
has problems with posix timers, so kvm mouse movement in not smooth.
By default kvm uses timer_create() and timer_settime() syscalls.

To show the behavior I use the following command:

 /usr/libexec/qemu-kvm -drive 
file=ubuntu-9.04-desktop-amd64.iso,if=ide,index=2,media=cdrom -m 512 -net none 
-clock dynticks

Everything runs normal when I use any other timer option ('rtc' or 'unix'). For 
example
this works perfectly:

 /usr/libexec/qemu-kvm -drive 
file=ubuntu-9.04-desktop-amd64.iso,if=ide,index=2,media=cdrom -m 512 -net none 
-clock unix

I also tested with standard redhat kernel without openvz patches - everything 
work well there.

We run on debian, but you can also reproduce the bug on RHEL/CENTOS with the 
packages provided by opennode:

# wget 
http://opennode.activesys.org/CentOS/5/opennode/x86_64/RPMS/ovzkernel-2.6.18-164.11.1.el5.028stab068.3.x86_64.rpm
# wget 
http://opennode.activesys.org/CentOS/5/opennode/x86_64/RPMS/kmod-kvm-83-105.asys.22.4.x86_64.rpm
# wget 
http://opennode.activesys.org/CentOS/5/opennode/x86_64/RPMS/kvm-83-105.asys.22.4.x86_64.rpm

# rpm -i ovzkernel-2.6.18-164.11.1.el5.028stab068.3.x86_64.rpm
# rpm -i kmod-kvm-83-105.asys.22.4.x86_64.rpm
# rpm -i kvm-83-105.asys.22.4.x86_64.rpm

Any ideas whats wrong?

- Dietmar
  














___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] vzctl enter potentially dangerous

2010-02-16 Thread Dietmar Maurer
Hi all,

On the following URL http://download.swsoft.com/virtuozzo...erence/386.htm I 
can read:
However, be aware that vzctl enter is a potentially dangerous command if you 
have un-trusted users inside the Container. Your shell will have its file 
descriptors accessible for the Container root in the /proc filesystem and a 
malicious user could run ioctl calls on it. Never use vzctl enter for 
Containers you do not trust.

Is there a way to avoid that security problem? Is there an example exploit for 
above issue?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Unable to open pty

2010-02-16 Thread Dietmar Maurer
 when i start my container i got an error Unable to open pty: No such
 file or directory.
 
 I tried to fix it with the following:
 
 - - copied /dev from a working comtainer
 - - vzctl exec 600 update-rc.d -f udev remove
 - - vzctl exec 600 'dpkg --force-depends --purge udev'
 
 - - vzctl exec 600 /sbin/MAKEDEV tty
 - - vzctl exec 600 /sbin/MAKEDEV pty = /sbin/MAKEDEV: warning: can't
 read
 /proc/devices
 
 Copied /proc/devices from the hn to vm.
 No error, but still does not work.
 
 The problems started after a dist upgrade in the vm from ubuntu 8.04.4
 to 9.10.
 
 Any ideas ?

Try to run MAKEDEV on the host (cd /var/lib/vz/private/...).

ubuntu 9.10 is not very container friendly :-/

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] BUG: scheduling while atomic

2010-02-02 Thread Dietmar Maurer
 -Original Message-
 From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
 Behalf Of Cliff Wells
 Sent: Dienstag, 02. Februar 2010 22:28
 To: users@openvz.org
 Subject: [Users] BUG: scheduling while atomic
 
 I'm running proxmox 1.4:
 
 Linux proxmox1 2.6.24-9-pve #1 SMP PREEMPT Tue Nov 17 09:34:41 CET 2009
 x86_64 GNU/Linux

I suggest to update to proxmox 1.5 and try the 2.6.18 kernel branch.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] New Kernel Patch

2010-01-18 Thread Dietmar Maurer
 - Dietmar Maurer diet...@proxmox.com wrote:
  Sorry, but so far we only tested on Debian Lenny. But I guess it
 works
  on Debian Squeeze as well.
 
 Suno, want to give that a try?

Just tested - 2.6.18 does not work with new udev (missing signalfd support).

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] New Kernel Patch

2010-01-16 Thread Dietmar Maurer
 What does that mean?  Well as is obvious to you, as time passes, the
 number of distributions that are appropriate to use as an OpenVZ host
 node is reduced... and it appears that RHEL and CentOS truly are the
 best distros to recommend for the host node.  As the type of fanboy I
 am, that does not frustrate me at all but I realise how frustrating
 that can be to others.  I would indeed call that a limitation.

We at Proxmox ended up compiling the RHEL kernel for Debian. So we now
have a Debian system with RHEL kernel and OpenVZ. So far that works
quite good.

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] New Kernel Patch

2010-01-16 Thread Dietmar Maurer
  I'm very glad to hear that.  Would you recommend that a stock Debian
 user use your kernel for OpenVZ stuff?  If so, I have to wonder how
 well it would work on the upcoming distro releases that Suno was
 talking about.
 
 Not at all until the new RHEL will be released, because modern versions
 of udev (like the one in Debian testing/unstable) do not support 2.6.18
 kernels.

Really, do you have more information on that?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] New Kernel Patch

2010-01-16 Thread Dietmar Maurer
 On Jan 16, Dietmar Maurer diet...@proxmox.com wrote:
 
   Not at all until the new RHEL will be released, because modern
 versions
   of udev (like the one in Debian testing/unstable) do not support
 2.6.18
   kernels.
  Really, do you have more information on that?
 The current version of udev requires a kernel = 2.6.26 (with
 CONFIG_SYSFS_DEPRECATED=n so the standard lenny kernel will not work
 anyway).
 This is caused by the need for features like CONFIG_INOTIFY_USER,
 CONFIG_SIGNALFD and sysfs improvements so it cannot be resolved with
 trivial patches (I already did this to not require 2.6.27).
 
 The last version which supports 2.6.18 is 145 and it cannot be used
 with
 squeeze anyway without a substantial effort because other packages
 depend on newer versions.
 
 I am the maintainer of the Debian udev package and a frequent upstream
 contributor.

Wow, that is very bad news - I guess there will be a major blocker for 
debian squeeze. What is the suggested workaround for people using older
kernels?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Seeing Boot Progress for Guest VM

2009-12-29 Thread Dietmar Maurer


 -Original Message-
 From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
 Behalf Of Anatoly Pugachev
 Sent: Dienstag, 29. Dezember 2009 10:33
 To: Dietmar Maurer
 Cc: users@openvz.org
 Subject: Re: [Users] Seeing Boot Progress for Guest VM
 
 
 Can you please tell, why it was rejected or not accepted upstream?

I don't know why it was not accepted - sorry.

 
 On 29.12.2009 / 10:17:08 +0100, Dietmar Maurer wrote:
  I have sent a patch to this list a year ago, called 'init-logger'.
 
  We use it in proxmox ve (pve.proxmox.com) to display init output.
 
   -Original Message-
   From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
   Behalf Of Gordan Bobic
   Sent: Dienstag, 29. Dezember 2009 08:30
   To: users@openvz.org
   Subject: [Users] Seeing Boot Progress for Guest VM
  
   Is there a way to observe the VM console / boot-up screen (e.g. for
   errors/warnings)? I know I can vzctl enter ID a VM, but that
   doesn't
   let me actually see the progress of init and the services it is
   starting
   up while it's booting up. Is there a way to do this?
 ___
 Users mailing list
 Users@openvz.org
 https://openvz.org/mailman/listinfo/users



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] kernel panic 2.6.18-164.2.1.el5.028stab066.10 drbd_connector_callback

2009-12-24 Thread Dietmar Maurer
We also had problem with DRDB on that kernel. We ended up compiling 
the DRBD module ourselves.

- Dietmar

 -Original Message-
 From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
 Behalf Of Aleksandar Ivanisevic
 Sent: Donnerstag, 24. Dezember 2009 13:07
 To: users@openvz.org
 Subject: [Users] kernel panic 2.6.18-164.2.1.el5.028stab066.10
 drbd_connector_callback
 
 
 Hi,
 
 I'm trying to use drbd in the latest rhel5 based openvz kernel but i'm
 getting the following oops when starting DRBD. I'm using drbd83
 package from centos extras for userland.
 
 Is anyone else using drbd with 2.6.18-164.2.1.el5.028stab066.10?
 
 Dec 24 12:23:50  Unable to handle kernel NULL pointer dereference
 Dec 24 12:23:50   at 029c RIP:


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Anyone using KVM with latest OpenVZ RHEL-5 kernel?

2009-12-09 Thread Dietmar Maurer
Hi Scott,

 I've seen quite a bit of interest in using KVM and OpenVZ together.
 Proxmox VE has been doing this for some time but they use a 2.6.24-
 based kernel.  Anyone using the latest OpenVZ RHEL5-based kernel and
 KVM together.  

We are already testing that kernel for proxmox ve - first test looks promising. 
Only KSM have problems.

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] new vzdump 1.2 beta - testers needed

2009-09-21 Thread Dietmar Maurer
Hi all,

we have done a complete rewrite of vzdump. There is not much additional 
functionality for OpenVZ, mostly code cleanups. 

* stop mode does not use --tmpdir anymore. So downtime is longer, but you do 
not need additional space (as requested by many users)
* no more --restore option (instead we include a vzrestore binary)
* acquire VM lock during backup

Download: ftp://pve.proxmox.com/sources/vzdump_2009-09-16.tar.gz

Please test and report bugs to me.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] ERROR: unable to detect lvm volume group, using 'suspend' mode

2009-09-02 Thread Dietmar Maurer
Sorry, forget my last answer. I guess the problem is your locale setting. Try 
to run with LANG=C

- Dietmar

 -Original Message-
 From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
 Behalf Of Dietmar Maurer
 Sent: Mittwoch, 02. September 2009 15:59
 To: users@openvz.org
 Subject: RE: [Users] ERROR: unable to detect lvm volume group, using
 'suspend' mode
 
 The problem is the '-' in the volume group name. I will fix that bug in
 the next vzdump release (soon).
 
  -Original Message-
  From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
  Behalf Of Nicolas Gorguès
  Sent: Dienstag, 18. August 2009 11:32
  To: users@openvz.org
  Subject: RE: [Users] ERROR: unable to detect lvm volume group, using
  'suspend' mode
 
  Hello,
 
  I have the same problem here, under Debian Lenny:
 
  # uname -a
  Linux breizh.siloh.net 2.6.24-7-pve #1 SMP PREEMPT Mon Aug 17
 10:37:00
  CEST 2009 x86_64 GNU/Linux
 
  # vzctl --help | grep version
  vzctl version 3.0.23-1pve3
 
  #apt-cache show vzdump | grep Version
  Version: 1.1-2
 
  # df -h
  Sys. de fich. Tail. Occ. Disp. %Occ. Monté sur
  /dev/sda1 9,7G  740M  8,5G   8% /
  tmpfs1000M 0 1000M   0% /lib/init/rw
  udev   10M   48K   10M   1% /dev
  tmpfs1000M 0 1000M   0% /dev/shm
  /dev/sda3 440G  5,8G  412G   2% /backup
  /dev/mapper/vg0-vz453G  3,3G  427G   1% /var/lib/vz
 
  # vzdump --dumpdir /backup --snapshot 101
  INFO: Starting new backup job - vzdump --dumpdir /backup --snapshot
 101
  INFO: Starting Backup of VM 101 (openvz)
  INFO: status = CTID 101 exist mounted running
  ERROR: unable to detect lvm volume group, using 'suspend' mode
  INFO: starting first sync /var/lib/vz/private/101 to
  /backup/tmp/vzdumptmp29021
 
  # lvdisplay
--- Logical volume ---
LV Name/dev/vg0/vz
VG Namevg0
LV UUIDcObdzd-ht4E-l3S5-SLeS-g7Lg-bWA2-7nOWb6
LV Write Accessread/write
LV Status  available
# open 1
LV Size460,00 GB
Current LE 29440
Segments   1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device   254:0
 
  # vgdisplay
--- Volume group ---
VG Name   vg0
System ID
Formatlvm2
Metadata Areas1
Metadata Sequence No  10
VG Access read/write
VG Status resizable
MAX LV0
Cur LV1
Open LV   1
Max PV0
Cur PV1
Act PV1
VG Size   465,75 GB
PE Size   16,00 MB
Total PE  29808
Alloc PE / Size   29440 / 460,00 GB
Free  PE / Size   368 / 5,75 GB
VG UUID   34LpzH-k8Ym-a6Mi-GTrO-OYDh-awIJ-rWqd4p
 
  I can't see where I got wrong Any idea?
 
  Regards,
 
  Nicolas.
 
  ___
  Users mailing list
  Users@openvz.org
  https://openvz.org/mailman/listinfo/users
 
 
 
 ___
 Users mailing list
 Users@openvz.org
 https://openvz.org/mailman/listinfo/users



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Remote storage and migration

2009-08-04 Thread Dietmar Maurer
 Hello, list. I've been using OpenVZ since last year. Now I'd like to
 configure the cluster I've been using to use remote storage, so that
 migrations do not require to copy the container's filesystem.
 
 Reading the wiki and the forum, I've learned that NFS is not
 recommended, but I don't know why. iSCSI has been suggested as a way
 to go, although no success story supported the suggestion. Finally,
 somebody said that he was using GFS without problems, but one of the
 OpenVZ developers said (at that time) that GFS was not recommended due
 to stability issuess.
 
 I've been told that remote storage with OpenVZ is not a well-known
 area, but I have to ask anyway, so as to leverage in previous
 experiences. Any information is welcome, even more the problems that
 were found with each approach, so that I know were to go and were not
 to.

I am also interested to make openvz more flexible. The new proxmox release
will have a very flexible storage model which supports iscsi/nfs/lvm, but
it is currently KVM only, because openvz lacks that feature.

I am especially interested in mounting devices (lvm) as container root,
something like

# mount -t ext3 /dev/xzy /var/lib/vz/private/777

Looking at the source (vzctl/src/fs_simfs.c vz_mount) it seem to be
easy to implement. If ROOT is a device we use 'ext3' instead of 'simfs'.

But I have no idea how this interacts with the rest of the openvz code?
Does quotas work that way? Or would it be better to use an additional 
configuration option to specify the root device:

ROOTDEV=/dev/xzy
ROOT=...
PRIVATE=...

We then simply mount ROOTDEV first, then use simfs as usual?

I can write that code if some of the OpenVZ developers give me some hints.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] ERROR: unable to detect lvm volume group, using 'suspend' mode

2009-08-03 Thread Dietmar Maurer
 vzvdump snapshot doesn't work at fresh proxmox install :
 
 
 proxmox:~# vzdump --snapshot --compress --dumpdir /backup 101
 INFO: Starting new backup job - vzdump --snapshot --compress
 --dumpdir /backup 101
 INFO: Starting Backup of VM 101 (qemu)
 INFO: status = running
 ERROR: unable to detect lvm volume group, using 'suspend' mode
 INFO: starting first sync /var/lib/vz/images/101
 to /var/tmp/vzdumptmp9788

So it works - using 'suspend' instead of 'snapshot' mode.

Snapshot mode only works if you use LVM2 on /var/lib/vz. What is the
output of:

# df /var/lib/vz

Also, please use the proxmox forum to post proxmox related problems.

Regards,

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] RE: vzdump lvm+xfs snapshot support patch

2009-06-02 Thread Dietmar Maurer
I have upload the new version which fixes that problem.

http://www.proxmox.com/cms_proxmox/en/virtualization/openvz/vzdump/

- Dietmar

 -Original Message-
 From: Gregory M. Turner [mailto:g...@malth.us]
 Sent: Donnerstag, 28. Mai 2009 22:42
 To: users@openvz.org; Dietmar Maurer
 Subject: vzdump lvm+xfs snapshot support patch
 
 Hello, this vzdump patch (against the 1.02 version which happened to be
 on my centos box) attempts to detect when an lvm snapshot is being made
 of an XFS filesystem and add the necessary mount options to have this
 actually succeed.

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] swappages and untu-hardy-openvz

2009-05-28 Thread Dietmar Maurer
What kernel patch do I need to get --swappages working with
http://git.openvz.org/?p=ubuntu-hardy-openvz;a=summary

Or isn't that possible?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] veth address persistence

2009-03-24 Thread Dietmar Maurer
 The
 VETH_IP_ADDRESS and VE_DEFAULT_GATEWAY statements don't seem to have
 any
 effect

OpenVZ does not have that functionality. IP setup inside the CT is 
only implemented for venet.

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] high load average on OpenVZ servers

2009-03-19 Thread Dietmar Maurer

  One of them have 12 VEs, not CPU intensive, and we are having this
 load:
 
 You don't mention what you have for disks.  On Linux the load average
 includes processes blocking on I/O.  A slow disk setup can cause a
high
 load.

But then 'wa' would show a higher value.

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Suggestion for a new parameter: PRIMARY_IP

2009-01-12 Thread Dietmar Maurer
 
  What is we simple add 'private' IPs after visible IPs?
 
 That would make me happy, at least for my current setup. Although it's
 possible that someone might have a more complicated internal network,
 where some RFC1918 network is NATed to the outside world, but others
 not. It would not be sufficient in such case.

Yes, it is not flexible enough.


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] OpenVZ vs Xen - for the base of Cloud computing

2009-01-10 Thread Dietmar Maurer
 Even no well defined API for job automation
 (http://forum.openvz.org/index.php?t=msggoto=10694;)

I my opinion there is an API - called 'vzctl'

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] kernel: ioctl32(mount:326): Unknown cmd

2009-01-09 Thread Dietmar Maurer
 Have you found the reason?

no, unfortunately not.

 It seems strange from my point of view.
 cmd =80041272 should be BLKGETSIZE64_32
 Seems in your case the call chain is:
 compat_sys_ioctl -  compat_ioctl_error - compat_printk(ioctl32
...)
 
 But IMHO it should be
 ---8---
 compat_sys_ioctl:
 
  if (filp-f_op  filp-f_op-compat_ioctl) {
  error = filp-f_op-compat_ioctl(filp, cmd, arg);

 ---8---
 
 
 flip-f_op-compat_ioctl  is  compat_blkdev_ioctl
 
 ---8---
 const struct file_operations def_blk_fops = {
 ...
 #ifdef CONFIG_COMPAT
 .compat_ioctl   = compat_blkdev_ioctl,
 #endif
 ...
 };
 ---8---

Yes, its strange.

 
 You have CONFIG_COMPAT enabled, haven't you?

Yes, I have that enabled.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] kernel: ioctl32(mount:326): Unknown cmd

2009-01-09 Thread Dietmar Maurer
 It may be some another ioctl. Could you please check mount version
 inside your
 container? Then you can grep all ioctls in mount sources and found
this
 place.

Hi Vasily,

I just found the error - I forgot to close a filehandle in my
init-logger patch.

So everything works now.

many thanks for your help.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Suggestion for a new parameter: PRIMARY_IP

2009-01-09 Thread Dietmar Maurer
 Please correct me if I'm wrong, but given that you have only one
 interface, I
 don't think that routing can affect address binding (which happens
 waaay before
 the kernel gets to routing any packets).

What is we simple add 'private' IPs after visible IPs?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] kernel: ioctl32(mount:326): Unknown cmd

2009-01-08 Thread Dietmar Maurer
Hi all,

I am testing the newest ubuntu hardy openvz kernel (amd64).

git://kernel.ubuntu.com/ubuntu/ubuntu-hardy.git

When I start a container I get the following errors:

Jan  8 10:43:12 oahu kernel: ioctl32(mount:886): Unknown cmd fd(4)
cmd(80041272){t:12;sz:4} arg(bfaf9f48) on /
Jan  8 10:43:12 oahu kernel: ioctl32(mount:886): Unknown cmd fd(4)
cmd(80041272){t:12;sz:4} arg(bfaf9f48) on /

Any ideas?

- Dietmar  


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] [PVE-User] iptables -L -t nat not working inside VE

2009-01-08 Thread Dietmar Maurer
I have the same behavior. It works on the HN, but inside the CT there is no nat 
table:

# cat /proc/net/ip_tables_names
mangle
filter

no idea why.

 -Original Message-
 From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
 Behalf Of Pongracz Istvan
 Sent: Donnerstag, 08. Jänner 2009 12:53
 To: Users@openvz.org
 Subject: [Users] [PVE-User] iptables -L -t nat not working inside VE
 
 Hi All,
 
 I try to use iptables rules inside the container but it seems, nat
 table
 is not accessible inside the container:
 
 # iptables -L -t nat
 FATAL: Could not load /lib/modules/2.6.24-1-pve/modules.dep: No such
 file or directory
 iptables v1.3.6: can't initialize iptables table `nat': Table does not
 exist (do you need to insmod?)
 Perhaps iptables or your kernel needs to be upgraded.
 
 
 I googled around but I did not find solution for this
 problem.
 
 I use Proxmox version of openvz, which is based on debian.
 2.6.24-openvz kernel
 I think, you know them, their developers are on this list :)
 
 I used the following systems as VE for testing this problem:
 debian
- lenny i386
- etch i386
- etch amd64
 
 I found that, if I try to load ip_conntrack on the HN by modprobe
 ip_conntrack, nothing happens.
 This module does not appear on the list (lsmod).
 There is nothing in the dmesg log.
 
 Sometimes I got this dmesg error, I think that time, when '-m state '
 exists in the iptables parameters:
 'can't load conntrack support for proto=2'
 
 I have this line in my vz.conf to enable modules for VEs:
 
 IPTABLES=ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter
 iptable_mangle ipt_TCPMSS ipt_tcpmss \
   ipt_ttl ipt_length ip_conntrack ip_conntrack_ftp
 ip_conntrack_irc ipt_LOG ipt_conntrack ipt_helper \
   ipt_state iptable_nat ip_nat_ftp ip_nat_irc ipt_TOS  
 
 
 Normal iptables rules are working but NAT and related parameters.
 On the hardware node there is a well working shorewall firewall, if it
 does matter
 
 Does anybody know this behaviour and the solution (if there is any
 solution)?
 
 Further investigation is possible, if somebody has an idea :)
 I'm more or less out with fresh ideas at this moment.
 
 Thanks in advance,
 István
 
 
 --
 BSA. Mert megérdemlitek.
 Open Source. Mert megérdemlem.
 --
 BSA. They value it.
 Open Source. The value. It.
 --
 http://www.startit.hu
 http://www.osbusiness.hu
 
 
 ___
 Users mailing list
 Users@openvz.org
 https://openvz.org/mailman/listinfo/users


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] OS template creation - which directories and files needto be excluded

2009-01-07 Thread Dietmar Maurer
 Where can I find the information regarding the directories and files
 which
 each VE take from the HN ? which means files and directories are not
 taken
 from inside the VE and those directories and files are virtual from the
 HN.

AFAIK there are no such files, but some files get modified. Maybe the best thing
is to take a look at the scripts in /etc/vz/dists/

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Suggestion for a new parameter: PRIMARY_IP

2009-01-07 Thread Dietmar Maurer
 I read that manpage multiple times, trying to figure out what exactly
 happens when. It states that specifying INADDR_ANY is equivalent to
not
 calling bind() at all before connect(). However if you read closely,
it
 does not state the semantics of such situation for active sockets
 (i.e. sockets you call connect() on, as opposed to sockets on which
you
 call listen()/accept()).
 
 In fact I could not find any documentation on such behaviour on the
 internet, so I read the Linux source code. The description in the
 footnote of my initial email in this thread is my interpretation of
 what
 happens (which matches experiments I made).

Ok, I was not aware of that.

  What application are we talking about?
 
 Oh, just about anything that does: socket(); connect(); (without a
 bind() in between), for example default usage of wget, telnet, ssh..
 any
 TCP client really.

If you have a server using several IP addresses, the client IP address
used by tcp client is undefined.

But what application depends on the client IP used?

Anyways, usually you can specify the bind address:

wget: --bind-address=ADDRESS 
telnet: -b address

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Suggestion for a new parameter: PRIMARY_IP

2009-01-04 Thread Dietmar Maurer
How does adding an additional setting like PRIMARY_IP help? Instead
you can simply change the order of IP_ADDRESS. What is the difference?

- Dietmar

 -Original Message-
 From: users-boun...@openvz.org [mailto:users-boun...@openvz.org] On
 Behalf Of Marcin Owsiany
 Sent: Samstag, 03. Jänner 2009 18:10
 To: users@openvz.org
 Subject: Re: [Users] Suggestion for a new parameter: PRIMARY_IP
 
 On Sun, Dec 14, 2008 at 03:43:47PM +, Marcin Owsiany wrote:
  My suggestion is to add another optional configuration parameter,
 called
  for example PRIMARY_IP, that, _if_specified_, would be used with
  HOSTNAME to set up the /etc/hosts entry. If it's not specified, then
 the
  first address from IP_ADDRESS would be used, as usual.
 
 Can developers please comment on this?


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Re: [PATCH 6/6] addons/vz-MAKEDEV: add udev/makedev.d file

2008-12-22 Thread Dietmar Maurer
But what is with devices added with --devnodes ? Does that still work
if udev starts?

- Dietmar

 diff --git a/addons/vz-MAKEDEV/40-vz-misc.nodes b/addons/vz-MAKEDEV/40-
 vz-misc.nodes
 new file mode 100644
 index 000..8b49c26
 --- /dev/null
 +++ b/addons/vz-MAKEDEV/40-vz-misc.nodes
 @@ -0,0 +1,9 @@
 +console
 +core
 +full
 +null
 +ptyp
 +random
 +ttyp
 +urandom
 +zero

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] RE: another init-logger patch

2008-12-18 Thread Dietmar Maurer
Hi all,

here is a slightly improved version. It work now with sysvinit and
upstart.

Any change to get that merged into upstream code?

- Dietmar

 -Original Message-
 From: Dietmar Maurer
 Sent: Mittwoch, 17. Dezember 2008 14:36
 To: users@openvz.org
 Subject: another init-logger patch
 
 This one uses BSD pseudo terminal - seem to work much better that the
 previous 'fifo' approach.


vzctl.diff
Description: vzctl.diff
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] asterisk ztdummy problem

2008-12-18 Thread Dietmar Maurer
Hi all,

I just moved our asterisk installation into a container. Everything
worked well
besides the ztdummy timer device.

After some debugging it turns out that it is a 64bit/32bit problem.

My host is an amd64 debian etch (Proxmox VE).

Container: debian lenny 32bit - fails
Container: debian lenny 64bit - works

The code which fails is a simple ioctl:

int x = 160;
int fd = open(/dev/zap/timer, O_RDWR);

ioctl(fd, ZT_TIMERCONFIG, x); // this fails on 32bit

I am out of ideas. I can't see any 32/64 bit issues in the drivers.

Any ideas?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] another init-logger patch

2008-12-17 Thread Dietmar Maurer
This one uses BSD pseudo terminal - seem to work much better that the
previous 'fifo' approach. 

What do you think?

- Dietmar


vzctl.diff
Description: vzctl.diff
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] debian hostname confusion

2008-12-03 Thread Dietmar Maurer
Hi all,

the debian documentation states
(http://www.debian.org/doc/manuals/reference/ch-gateway.en.html)

  The kernel maintains a system hostname. The initscript
/etc/init.d/hostname.sh sets the 
 system hostname at boot time (using the hostname command) to the name
stored in /etc/hostname. 
 This file should contain only the system hostname, not a fully
qualified domain name. 

So /etc/hostname should not contain the fully qualified domain name.

How can I use vzctl to get a correct /etc/hostname and /etc/hosts file.

I want:

/etc/hostname:
--
myname
--

/etc/hosts
--
127.0.0.1 localhost.localdomain localhost
# Auto-generated hostname. Please do not remove this comment.
192.168.3.104 myname.test.com  myname
--

I can do

# vzctl set 777 --hostname myname --searchdoamin test.com

but then /etc/hosts is wrong. And

# vzctl set 777 --hostname myname.test.com

results in a wrong /etc/hostname

any ideas?

- Dietmar




___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Samba server using veth

2008-12-03 Thread Dietmar Maurer
If you use Proxmox VE, the bridge device is automatically created for
you by
the installer. Also, bridge-utils are automatically installed.

How do you installed the system?

  yes, veth is always bridged (automatically). So there is nothing to
  configure on the main host.
 
 Perhaps i misread/misunderstood the documentation about veth,
 and all the emails about it which i found after a search-engine
search.
 
 I'm using a bridge on the HN, because i thought it was needed for
veth.
 
 Is it not needed ?
 And does veth need bridge-utilities installed ?



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Announcement: Proxmox Virtual Environment 1.0 - Firststable release

2008-11-21 Thread Dietmar Maurer
 Whithout having gone through the docs I'm curious as to what kind of
 protocol it uses to talk to the remote VZ hosts.

https and VNC
 
 Can you talk a little about the security of the model used by Proxmox?
 Can I, on the client VZ HNs managed by Proxmox, limit what commands
 Proxmox can execute? (important in the case that my Proxmox server
 gets compromised)

Not sure if I understand your question. If someone gets root access to 
the HOST you have a real problem. But that’s true for any unix system.

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Re: Announcement: Proxmox Virtual Environment 1.0 -Firststable release

2008-11-21 Thread Dietmar Maurer
 what is the minimum HW requirements for Proxmox?
 Can it be installed on an AMD 686 single core CPU? (just for
 testing/learning of course... :-)

http://pve.proxmox.com/wiki/Installation#System_requirements

So an old AMD 686 will not work.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Announcement: Proxmox Virtual Environment 1.0 -Firststable release

2008-11-21 Thread Dietmar Maurer
  https and VNC
 
 And I would imagine that cluster nodes talk to each other over ssh,
 right?

Yes.



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Announcement: Proxmox Virtual Environment 1.0 -Firststable release

2008-11-21 Thread Dietmar Maurer
 It uses HTTPS to issue commands to the VZ nodes in the cluster? Really?

I guess you should look at the code yourself if you want to know how it works.
 
  Can you talk a little about the security of the model used by
 Proxmox?
  Can I, on the client VZ HNs managed by Proxmox, limit what commands
  Proxmox can execute? (important in the case that my Proxmox server
  gets compromised)
 
  Not sure if I understand your question. If someone gets root access
 to
  the HOST you have a real problem. But that's true for any unix
 system.
 
 Yes, I know that a compromise is a real problem. It's always a real
 problem. Hence the need for mitigation measures.
 
 If a regular server is compromised, that is one server. What I am
 asking is what happens if my Proxmox server gets compromised? How does

Then all controlled servers are at risk. Again, that is also true for any other
virtualization platform I know.

 it talk to the VZ HNs that it is controlling? Is it SSH running shell
 commands? Or does each VZ HN have to run some sort of daemon that
 listens for commands from the Proxmox server? Or what?

Please read all available openvz documentation, first. Then study our code. 

 The web site says Proxmox uses kernel 2.6.24, which AFAIK isn't deemed
 as stable by the OpenVZ kernel team. Has 2.6.24 with the OpenVZ patch
 been tested much?

We use the following kernel source:

http://git.openvz.org/?p=ubuntu-hardy-openvz;a=summary

which is very stable IMO.

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Announcement: Proxmox Virtual Environment 1.0 -Firststable release

2008-11-21 Thread Dietmar Maurer
  It uses HTTPS to issue commands to the VZ nodes in the cluster?
 Really?
 
 I guess you should look at the code yourself if you want to know how it
 works.

A short overview:

Web based clients connect via HTTPS to an apache2 server (and VNC proxyies
for the java console).

Technologies: HTTPS, AJAX, JSON, VNC, HTML, embedded-perl, ...

The Apache servers connects to an control daemon which issues
all commands:

Technologies: SOAP, perl

There is a VPN tunnel between all Cluster nodes.

Hope that helps?

Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Announcement: Proxmox Virtual Environment 1.0 -Firststable release

2008-11-21 Thread Dietmar Maurer
 It uses HTTPS to issue commands to the VZ nodes in the cluster? Really?

What are VZ nodes?

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Re: Announcement: Proxmox Virtual Environment 1.0-Firststable release

2008-11-21 Thread Dietmar Maurer
 it possible to install pve on i386 as well, the minimun packages
 and the most pve scripts are written in perl, only useing pve with

The i386 architecture has some serious drawbacks, and we do not want to
deal with them (pve itself is written in perl and not really 
architecture dependent). 

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Re: Announcement: Proxmox Virtual Environment 1.0-Firststable release

2008-11-21 Thread Dietmar Maurer
 setup.  We have asked about the possibility of a lite version that
 was for OpenVZ only but the Proxmox VE folks are interested in doing
 that... so... since the source is GPLed, if someone wants to grab the
 ball and run with it, it is possible.

One problem is that we are a small team, the project is open source,
and we provide support for free. So the only way to provide good support
is to restrict ourselves to one well defined environment.

A second problem are the restrictions of the i386 architecture. 

And finally, the required hardware is standard and not expensive anyways.

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Re: Announcement: Proxmox Virtual Environment1.0-Firststable release

2008-11-21 Thread Dietmar Maurer
 But before you start the i386 port think twice - there are many useful
 things you can do instead ;-)

Which reminds me about the following issues with openvz:

- '-cpus' is still not working with 2.6.24 - very, very, bad!

- live migration is still unstable with 2.6.24

...

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] Re: Announcement: Proxmox Virtual Environment1.0-Firststable release

2008-11-21 Thread Dietmar Maurer
 ... ok, what can we i do ;-)

Depends on what you want to work on?

Kernel 2.6.24: implement '-cpus' and make live migration stable

openvz: we need a way to describe the contents of an openvz template.
Like the control file in a debian package. And we also want apt-like 
repositories for those templates, and tools to manipulate them, ...
I can send you more infos about that when interested.

kvm: to many things to list here - also wrong list ;-)

vncterm: we need to implement ssl.

or maybe something of: http://pve.proxmox.com/wiki/Roadmap

or simple look at our sources and the tell me what you are interested in.

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] create CT with password

2008-11-11 Thread Dietmar Maurer
 On Tue, Nov 11, 2008 at 10:58:46AM +0100, Dietmar Maurer wrote:
  Is there are real world example where my approach does not work?
 
 I think your approach won't work as is, at least in any tcb-enabled
 system (see http://www.openwall.com/tcb/) for two obvious reasons:
 - file where root shadow entry is stored is not /etc/shadow;

I guess it is possible to detect the file and store the password?

 - password hashing algorithm in the host system and in containers may
   differ (this issue is not specific to tcb).

If I interpret the documentation correct the password includes the
algorithm
used to encode it - so auth will succeed no matter how you 
configure pam_unix (hashing algorithm configuration is only used to
store password)

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] create CT with password

2008-11-11 Thread Dietmar Maurer
  I think your approach won't work as is, at least in any tcb-enabled
  system (see http://www.openwall.com/tcb/) for two obvious reasons:
  - file where root shadow entry is stored is not /etc/shadow;
 
 I guess it is possible to detect the file and store the password?

It is a simple test for '/etc/tcb/root/shadow' ?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] create CT with password

2008-11-11 Thread Dietmar Maurer
Is there are real world example where my approach does not work?

I check for /etc/shadow, and store as md5 - AFAIK the user is able to
login with that password on all distribution using pam_unix. If not, we can 
still
try to read and parse the pam configuration.

It will not work for nis, but that is a rare case. But nis requires a network 
anyways, 
so the current code also fails.

So how can I create a VM with a password? For example:

# vzctl create
# vzctl start
# vzctl set --password

can also fail because the network is not running when we execute the passwd 
command (vzctl start does not wait until the network is fully functional, and 
passwd requires
the network when it uses nis).

Or is that wrong?

- Dietmar


  The only problem is the solution is not generic. In other words, we
  can't know how different distros handle local users. It used to be
  crypt(3) and /etc/passwd (later /etc/shadow) manipulation. Now
  everybody
  uses PAM which can be configured in this or that way. For example,
 new
  passwords are checked (by pam_cracklib) for minimum length etc. (see
  pam_cracklib(8) for much more details). Also they could be stored in
 a
  different ways (this applies to both storage and hashes), say use (or
  not use) /etc/shadow, md5 or sha256 hash or even NIS (see pam_unix(8)
  for more details).
 
 I just thought my approach works in 99,99% of all cases, but maybe I am
 wrong.

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] create CT with password

2008-11-11 Thread Dietmar Maurer
 This way you'll have to either use the most weak hashing algorithm
 supported by every container OS, or risk that your modern hashing
 algorithm is not supported by some container OS.

We can customize the scripts per OS (as we do already for other
settings). And
md5 is supported on almost any system?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] create CT with password

2008-11-11 Thread Dietmar Maurer
And is it really possible to store the root password on NIS? What happen on
filesystem errors - usually single user mode ask for a password before fsck. 
But sure,
that can't happen within a container.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] create CT with password

2008-11-10 Thread Dietmar Maurer
 The only problem is the solution is not generic. In other words, we
 can't know how different distros handle local users. It used to be
 crypt(3) and /etc/passwd (later /etc/shadow) manipulation. Now
 everybody
 uses PAM which can be configured in this or that way. For example, new
 passwords are checked (by pam_cracklib) for minimum length etc. (see
 pam_cracklib(8) for much more details). Also they could be stored in a
 different ways (this applies to both storage and hashes), say use (or
 not use) /etc/shadow, md5 or sha256 hash or even NIS (see pam_unix(8)
 for more details).

I just thought my approach works in 99,99% of all cases, but maybe I am wrong.

 Because of the above, the only reliable way is to run passwd --stdin
 inside the container (somewhat less generic (?) and more low-level way
 is to call pam_chauthtok(3) function from a C code -- this is what I
 assume passwd does). Using 'passwd' is the only way to make sure we are
 doing what we should, not ignoring local configuration, not
 circumventing any local restrictions etc. Unfortunately we need to
 start
 the VE in order to run passwd (just chroot()'ing is not enough secure).
 
 So, what if you approach the problem in a different way? Is it possible
 that you run 'vzctl set --userpasswd' *after* VE start?

And save the password in plaintext somewhere? (we do not want to start the
VM on create).

There is another problem with your suggestion. Assume we do:

vzctl start
vzctl set --userpasswd
vzctl stop

Unfortunately the stop will abort any initialization tasks which are
running in background (mysql database initialization for example).

Maybe we can generate a init script (stored inside the VE) which sets 
the password?

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] create CT with password

2008-11-06 Thread Dietmar Maurer
Hi all,

 

currently you need to use the following command to change the password
inside a CT:

 

vzctl set CTID --userpasswd root:XXX

 

This starts/stop the CT if it is not already running.

 

That is OK unless you have preconfigured appliance templates which does
some

initialization at first startup. Let me explain:

 

1.)User create the CT: vzctl creat 777 --ostemplate name ...

2.)User set the password: vzctl set 777 --userpasswd root:XXX
(start/stop CT)

3.)User starts the CT

 

As you see, there is a totally unnecessary start/stop action. Even
worse, the container

is not fully functional at that time because HOSTNAME, DOMAIN,... in not
set before the

container is started with vzctl start.

 

I wonder if it would be possible to add a  --userpasswd parameter to the
'create' command? Or maybe

only a --rootpasswd option (because root is always a local user).

 

/etc/passwd and /etc/shadow should be easy to modify directly, or are
there some distributions

with unusual file formats?

 

- Dietmar

 

 

 

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] create CT with password

2008-11-06 Thread Dietmar Maurer
Attached is a patch which passes the password to the postcreate script:

 

VE_ROOTPASSWD .. plain text passwd

VE_CROOTPASSWD .. crypted  passwd (md5)

 

postcreate script can then modify /etc/passwd and /etc/shadow.

 

what do you think?

 

- Dietmar

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Dietmar Maurer
Sent: Donnerstag, 06. November 2008 10:51
To: users@openvz.org
Subject: [Users] create CT with password

 

Hi all,

 

currently you need to use the following command to change the password
inside a CT:

 

vzctl set CTID --userpasswd root:XXX

 

This starts/stop the CT if it is not already running.

 

That is OK unless you have preconfigured appliance templates which does
some

initialization at first startup. Let me explain:

 

1.)User create the CT: vzctl creat 777 --ostemplate name ...

2.)User set the password: vzctl set 777 --userpasswd root:XXX
(start/stop CT)

3.)User starts the CT

 

As you see, there is a totally unnecessary start/stop action. Even
worse, the container

is not fully functional at that time because HOSTNAME, DOMAIN,... in not
set before the

container is started with vzctl start.

 

I wonder if it would be possible to add a  --userpasswd parameter to the
'create' command? Or maybe

only a --rootpasswd option (because root is always a local user).

 

/etc/passwd and /etc/shadow should be easy to modify directly, or are
there some distributions

with unusual file formats?

 

- Dietmar

 

 

 



pwhack.diff
Description: pwhack.diff
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


RE: [Users] create CT with password

2008-11-06 Thread Dietmar Maurer
 postcreate script can then modify /etc/passwd and /etc/shadow.

attached is a modified postcreate script

- Dietmar


postcreate.sh
Description: postcreate.sh
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] new vzdump - need testers

2008-09-22 Thread Dietmar Maurer
Hi all,

 

I am looking for testers for the new vzdump version, available here:

 

DEB:
http://www.proxmox.com/cms_proxmox/cms/upload/vzdump/vzdump_1.1-1_all.de
b

 

RPM:
http://www.proxmox.com/cms_proxmox/cms/upload/vzdump/vzdump-1.1-1.noarch
.rpm

 

SOURCE:
http://www.proxmox.com/cms_proxmox/cms/upload/vzdump/vzdump-1.1.tar.gz
http://www.proxmox.com/cms_proxmox/cms/upload/vzdump/vzdump-1.1.tar.gz


 

New features:

 

* Only send one mail per backup job

* Bandwidth limitations (avoid high loads on server)

* Support qemu-server images (used by Proxmox VE)

* Bug fixes

 

Changelog:

 

2008-09-17  Proxmox Support Team  [EMAIL PROTECTED]

 

* vzdump (snapshot_vm): use --no-whole-file --inplace for rsync
(works

better for large files), also use --stats --numeric-id and

apply bandwidth limits with --bwlimit

(archive_vm): use --sparse option for tar

 

* vzdump: support to backup/restore qemu-server images

 

* vzdump: new --stdexcludes option (we no longer exclude files
by

default, because most users expect to have a full backup
including

all files and logs)

 

* vzdump: add --tmpdir option as suggested by Ugo Bellavance

 

* vzdump: add --wait option, using locbal lock file to

make sure only one instance is running

 

* vzdump: set default snapshot size to 1GB, new --size option to

specify snapshot size

 

* copyright: fixed fsf address

 

* Makefile (SBINDIR): set to /usr/sbin (command is only useful
for

user root)

 

* vzdump.spec, control.in: we now depend on rsync, cstream and
MTA

 

2008-09-16  Proxmox Support Team  [EMAIL PROTECTED]

 

* vzdump (read_vzdump_defaults): added global configuration
file.

 

2008-08-18  Proxmox Support Team  [EMAIL PROTECTED]

 

* vzdump: added --node option (proxmox ve cluster support),

use --rsyncable for compressed files

removed --xdelta option

 

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: AW: [Users] Iptables problem Debian HN / CentOS VE

2008-08-29 Thread Dietmar Maurer
You cant load modules inside the container.

- Dietmar 

 this is strange because I have all those modules loaded on 
 HardwareNode...

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: [Users] Iptables problem Debian HN / CentOS VE

2008-08-28 Thread Dietmar Maurer
  Aug 28 17:09:19 localhost kernel: can't load conntrack support for 
  proto=2

What kind of network do you use - venet or veth? 

Try veth if not already done.

There is also that vzctl --capability option, maybe you need some
additional capabilities (net_broadcast, net_admin, net_raw). 

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] User list archives

2008-08-28 Thread Dietmar Maurer
 
Btw, i just noticed that the mailing list archives are not up to date:

http://forum.openvz.org/index.php?t=threadfrm_id=7;

Last entry is fron August 13

- Dietmar

___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: [Users] ovzkernel-xen ?

2008-08-25 Thread Dietmar Maurer
  Having not used Xen but being very interested in all forms of 
  virtualization and how folks are using it, I'm curious.
  
  What does one do with a kernel that does both OpenVZ and 
 Xen? Do you 
  run multiple Doms and a few of them use OpenVZ? Is there a 
 reason that 
  neither OpenVZ nor Xen do exactly what you want by themselves?
 
 Yes, there is a fundamental difference in how the two systems 
 work, RTFM :) For example with Xen each child gets a whole 
 new kernel instance with everything that that entails, most 
 obvious example being separate memory.

On Proxmox VE (pve.proxmox.com), we combine KVM and openvz. That way
we are able to run fully virtualized guests (i.e. windows) and openvz
CTs.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] Another 2.6.24 problem

2008-07-11 Thread Dietmar Maurer
Hi all,

With latest 2.6.24 from git we get errors inside 'futex_wake'
Not always in same program. It only happens from time to time.

Any idea what can cause that? v2.6.24-ovz004 works without problems.

- Dietmar



Unable to handle kernel paging request at 8fcc289b RIP:
 [8025cbf2] futex_wake+0x58/0xd4
PGD 203067 PUD 207063 PMD 0
Oops:  [1] PREEMPT SMP
CPU: 2
Modules linked in: e1000 thermal e1000e button processor evdev floppy sg
pcspkr sermouse psmouse dm_mod usbhid hid usb_storage sd_mod
sr_mod ide_disk ide_generic ide_cd cdrom ide_core shpchp pci_hotplug
uhci_hcd ehci_hcd iTCO_wdt ahci libata scsi_mod i2c_i801 i2c_core isofs
zlib_inflate msdos fat
Pid: 4927, comm: pycentral Not tainted 2.6.24 #1 ovz005
RIP: 0010:[8025cbf2]  [8025cbf2]
futex_wake+0x58/0xd4
RSP: 0018:810205287dd8  EFLAGS: 00010282
RAX: 0001fec2 RBX: 2ad4fac5d0e4 RCX: a1dc
RDX: a3a5f0f6 RSI: 97c3d800 RDI: 8fcc2883
RBP:  R08: 2ad4fab5a2b4 R09: 
R10: 2ad4fac5d0e0 R11: 0202 R12: 80637f80
R13: 81011451c520 R14: 80637f88 R15: 7fff
FS:  2ad4fb121f60() GS:810215d19b40()
knlGS:
CS:  0010 DS:  ES:  CR0: 8005003b
CR2: 8fcc289b CR3: 000175d6e000 CR4: 06e0
DR0:  DR1:  DR2: 
DR3:  DR6: 0ff0 DR7: 0400
Process pycentral (pid: 4927, veid=0, threadinfo 810205286000, task
810215f6e120)
Stack:  2ad4fac5d000 81011451c4c0 00e6
802b0e9a
 810205287ea8 2ad4fab5a2b4 2ad4fac5d0e0 2ad4fab5c000
 0001 fab5c320 7fff 8025d8c4
Call Trace:
 [802b0e9a] may_open+0xc2/0x21f
 [8025d8c4] do_futex+0x84/0xa66
 [8025e3a0] sys_futex+0xfa/0x118
 [8020c03e] system_call+0x7e/0x83


Code: 48 8b 5f 18 eb 43 48 8b 14 24 48 39 57 48 48 8d 47 48 75 2e
RIP  [8025cbf2] futex_wake+0x58/0xd4
 RSP 810205287dd8
CR2: 8fcc289b
---[ end trace 542031ea75a6aeb3 ]---
note: pycentral[4927] exited with preempt_count 1



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: AW: [Users] Multiple bridge support

2008-07-10 Thread Dietmar Maurer
 I don't quite get it. Is it supposed to be a replacement for 
 vznetaddbr, an addition to it, or is it orthogonal to it? Who 
 and when calls vznetaddbr?

It merges vznetaddbr into vznetcfg, making
vznetaddbr obsolete.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: [Users] Multiple bridge support

2008-07-06 Thread Dietmar Maurer
 It would be just great if you can provide a patch to vzctl 
 man page describing the new parameter, and the according wiki 
 modifications/additions.

Here is the patch for the man page.

I am not sure how to edit the wiki. Howto indicate
that the feature is only available in newest version
from git. Can I use 'version  3.0.22' ?

- Dietmar


vzctl.8.diff
Description: vzctl.8.diff
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] Multiple bridges and firewalls

2008-07-04 Thread Dietmar Maurer
Hi all,

with the new vzctl bridge patch sent yesterday it is easy to build up
hosts with complex 'virtual' networks. In Proxmox VE we have 9 bridges -
each CT can connect to one or more bridges. 

I guess in theory it is possible to run a fully functional firewall
inside a CT. Does somebody has experiences with that?

Also, when you assign ip addresses to the bridges, the host routes
between those bridges. If you want to restrict traffic you need to setup
a firewall on the host. I just tried shorewall, and it seems to work
perfectly. Does somebody else using shorewall with openvz host? - does
it work reliable? Are there other 'simple' solutions besides shorewall?

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: [Users] Multiple bridge support

2008-07-03 Thread Dietmar Maurer
And here is the vznetaddbr we use (attached).

  I wonder if we can include that into the vzctl release - I 
 will post 
  the patch if soembody is interested.
  
 
  Dietmar,
 
  it will be useful indeed, please, provide patch to devel@ 
 mailing list. 
 

 Please do so. I've written my own solution for this, but 
 yours looks much better.



vznetaddbr
Description: vznetaddbr
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: [Users] Multiple bridge support

2008-07-03 Thread Dietmar Maurer
Hi Kir,

 Von: Kir Kolyshkin [mailto:[EMAIL PROTECTED] 
 Gesendet: Donnerstag, 03. Juli 2008 13:35
 An: users@openvz.org; Dietmar Maurer
 Betreff: Re: AW: [Users] Multiple bridge support
 
 How do you invoke it? Using EXTERNAL_SCRIPT?
 
 Would be good to have a patch adding (conditional?) 
 invocation of vznetaddbr to vznetcfg.

One idea was to add a new global option in vz.conf:

DEF_BRIDGE=

If set, we automatically setup the bridge (we need to pass an additional
parameter to vznetcfg, but i guess thats no problem at all). That also
avoid a hardcoded default bridge name (vmbr0).

Here is the totally untested code. If you like the idea I will test it
;-)

---
#!/bin/sh
CONFIGFILE='@PKGCONFDIR@/vz.conf'

[ -f $CONFIGFILE ] . $CONFIGFILE

VZNETCFG='@PKGCONFDIR@/vznet.conf'

[ -f $VZNETCFG ]  . $VZNETCFG

usage()
{
echo 2 vznetcfg init veth dev [bridge]
}

init_veth()
{
local dev=$1
local bridge=$2

if [ -n $DEV_BRIDGE ]; then
if [ ! -n $bridge ]; then
bridge=$DEV_BRIDGE
fi
echo Adding interface $dev to bridge $bridge on CT0 for
CT$VEID
/sbin/ifconfig $dev 0
echo 1  /proc/sys/net/ipv4/conf/$dev/proxy_arp
echo 1  /proc/sys/net/ipv4/conf/$dev/forwarding
/usr/sbin/brctl addif $bridge $dev
else
ip link set $dev up
fi
}

# Call the external script if defined
if [ -n $EXTERNAL_SCRIPT -a -x $EXTERNAL_SCRIPT ]; then
export VEID
exec $EXTERNAL_SCRIPT $@
fi

if test $# -le 2; then
usage
exit 0
fi

CMD=$1
case $CMD$2 in
initveth)
if test $# -le 3; then
usage
exit 1
fi

init_veth $3 $4
;;
*)
echo invalid action
exit 1
;;
esac
exit 0


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] Multiple bridge support

2008-07-02 Thread Dietmar Maurer
Hi all,

In Proxmox VE we want to support multiple bridges. I currently use a
patch
which adds an bridge parameter to the netif options: 

NETIF=ifname=XXX,bridge=XXX,mac=XXX,host_ifname=XXX,host_mac=XXX

--netif_add ifname[,mac,host_ifname,host_mac,bridge]

I also modified --netif_add to accept empty parameters, for example:

--netif_add eth3vmbr3

I wonder if we can include that into the vzctl release - I will post 
the patch if soembody is interested.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: [Users] Veth mac generation

2008-06-13 Thread Dietmar Maurer
 Do I understand correctly that you actually experience the 
 following problem:
 1. veth MAC address is lower then your ethX MAC.
 2. so brX is assigned min(vethX-MAC, ethX-MAC) which is vethX-MAC.
 3. and what is the your problem with that? that host system 
 MAC changes dynamically and networking breaks or what?

The host gets unreachable for about 20 seconds (because ARP mappings
are wrong now)

 I just can't see how fully random 6 bytes MAC can help. 
 Because sometimes it will be low enough as well and you 
 will hit the problem anyway.

Well one idea was to assign macs starting with 'fe' - but ist not
a good idea anyways.

 If I got your problem right then I can advise you a possible 
 solution - in RHEL5 kernel we have a functionality called 
 via_phys_dev (triggered by BRCTL_SET_VIA_ORIG_DEV ioctl). 
 This forces kernel to work with original interface ethX 
 (first added to bridge) and pass the traffic to it. This 
 allows to add ethX to bridge w/o need to propogate it's 
 netfilter rules and other settings to brX.

Interesting - thanks for that hint.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: [Users] Veth mac generation

2008-06-13 Thread Dietmar Maurer
 
 If I got your problem right then I can advise you a possible 
 solution - in RHEL5 kernel we have a functionality called 
 via_phys_dev (triggered by BRCTL_SET_VIA_ORIG_DEV ioctl). 
 This forces kernel to work with original interface ethX 
 (first added to bridge) and pass the traffic to it. This 
 allows to add ethX to bridge w/o need to propogate it's 
 netfilter rules and other settings to brX.

Looking at the openvz-2.6.24 sources that via_phys_dev is
already there. I just wonder how to use it:

brctl addbr vmbr0
echo 1  /sys/class/net/vmbr0/bridge/via_phys_dev
brctl addif eth0

But looks like ip setting of eth0 gets lost (or what is 
meant by 'and other settings'?). Maybe you have further info
How to use that feature?

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] iosched question

2008-06-12 Thread Dietmar Maurer
Hi all,

whats the best iosched for openvz servers. I found:

The deadline scheduler uses five I/O queues to keep track of I/O. It's
designed to emphasize
average read-request response time for workloads that seek all over the
disk.

Maybe the deadline scheduler is better than using the default cfq?

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: [Users] Veth mac generation

2008-06-11 Thread Dietmar Maurer
Why I asked is because of that bridge problem:

http://forum.openvz.org/index.php?t=msgth=5291#msg_26576

A bridge always select the lowest mac address.

This patch solves the problem, but i am not sure if there are side effects.

https://lists.linux-foundation.org/pipermail/bridge/2008-June/005895.html
 
The SWSOFT OID is quite 'low', so the problem occurs frequently.

- Dietmar


 -Ursprüngliche Nachricht-
 Von: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] Im Auftrag von Kirill Korotaev
 Gesendet: Mittwoch, 11. Juni 2008 15:47
 An: users@openvz.org
 Betreff: Re: [Users] Veth mac generation
 
 and yes and no.
 These upper 3 bytes are reserved for our company, so 
 selecting them you will never conflict with other devices in 
 network infrastructure.
 i.e. the worst what can happen 2 veths will conflict.
 
 On the other hand - you are right, 6 bytes are better :)


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] Kernel panic with latest 2.6.24 from git

2008-06-09 Thread Dietmar Maurer
Hi all,

Just compiled latest 2.6.24 from git. I consistently get a kernel 
Panic when i stop a CT (ipv6 related)  - someone else observing that?

- Dietmar



___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: [Users] Kernel panic with latest 2.6.24 from git

2008-06-09 Thread Dietmar Maurer
 Dietmar Maurer wrote:
  Hi all,
  
  Just compiled latest 2.6.24 from git. I consistently get a kernel 
  Panic when i stop a CT (ipv6 related)  - someone else 
 observing that?
 
 We do. Fill a bug in bugzilla, we'll look whether this is 
 already fixed.

I just update to latest git (commit
da8a02e8fc4f14f976d38c844b6e5d98badea9eb), and it works again.

 But, please, provide some more details on the problem, rather 
 than I see some crashes in ipv6 code.

Well, just tell me how i extract that kernel log from the console (no
digicam here, and log is too long for the screen, so ist only partially
displayed - and no entries in syslog)?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] Kernel Developement books?

2008-06-09 Thread Dietmar Maurer
Hi all,

Are there any good books around concerning linux kernel developement -
with 
up to date infos for new 2.6 features like cgroups?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] VLAN bug with 2.6.24

2008-05-06 Thread Dietmar Maurer
Tested wit openvz 2.6.24 from git and debian etch.

We normaly use a bridged network config (/etc/network/interfaces):

---
auto vmbr0
iface vmbr0 inet static
address  192.168.1.2
netmask  255.255.255.0
gateway  192.168.1.1
bridge_ports eth0 
---

To add vlan support we do (VLAN 5):

---
auto vmbr0
iface vmbr0 inet static
address  192.168.1.2
netmask  255.255.255.0
gateway  192.168.1.1
bridge_ports eth0.5 
---

This does not work on all machine we tested, and if we issue:

 vconfig add eth0 6

Network freezes on all machines tested. 

Ubuntu kernel (8.04 server) with the same hardware worked perfectly.

Andy idea whats wrong? Can somebody else reproduce the bug?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] Announcement: Proxmox Virtual Environment

2008-04-16 Thread Dietmar Maurer
Hi all,

I am glad to announce the first beta release of 'Proxmox Virtual
Environment' - an open source virtualization platform for the
enterprise. 

The main features are:

- All code is GPL
- OpenVZ and KVM support
- bare metal installer (debian etch 64)
- Backup/restore with vzdump/LVM2
- web based management
- integrated virtual appliance download (include certified
appliances)
- configuration cluster

You can find more information at http://pve.proxmox.com

We encourage anyone interested to download and test.
The CD image is available at: http://pve.proxmox.com/wiki/Downloads

Let us know what you think! 

Best regards,

Dietmar

--
Dietmar Maurer   Proxmox Server Solutions GmbH
   CTO
[EMAIL PROTECTED] http://www.proxmox.com
--


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: [Users] problems with vzctl init logging patch

2008-03-13 Thread Dietmar Maurer
Attached is the new patch.

- Dietmar 


vzctl.diff
Description: vzctl.diff
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] State of 2.6.24

2008-03-13 Thread Dietmar Maurer
Hi all,

I just tested 2.6.24 with the new fairsched. Everything seems to works
like expected - great.

I wonder if openvz-2.6.24 is now feature complete, or is there still
something missing?

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


[Users] problems with vzctl init logging patch

2008-03-12 Thread Dietmar Maurer
hi all,

my init logging patch works so far, but unfortunately it breaks
checkpointing:
---
vzctl chkpnt 101
Setting up checkpoint...
suspend...
dump...
Can not dump container: Invalid argument
Error: d_path err=-22
Checkpointing failed
---

Maybe some of the developers can give me a hint whats wrong?

lsof shows (16531 id the logging process)

lt-vzctl  16531   root  cwd   DIR   0,22 4096
1226401 /var/lib/vz/root/101
lt-vzctl  16531   root  rtd   DIR   0,22 4096
1226401 /var/lib/vz/root/101
lt-vzctl  16531   root  txt   REG8,198155
2047179 /home/dietmar/pve/vzctl/vzctl-3.0.22/src/.libs/lt-vzctl
lt-vzctl  16531   root  mem   REG0,0
0 [heap] (stat: No such file or directory)
lt-vzctl  16531   root  mem   REG8,197928
1896840 /lib/ld-2.3.6.so
lt-vzctl  16531   root  mem   REG8,1   488939
2031943
/home/dietmar/pve/vzctl/vzctl-3.0.22/src/lib/.libs/libvzctl-0.0.2.so
lt-vzctl  16531   root  mem   REG8,110392
1896846 /lib/libdl-2.3.6.so
lt-vzctl  16531   root  mem   REG8,110520
1896843 /lib/libutil-2.3.6.so
lt-vzctl  16531   root  mem   REG8,1  1282008
1896845 /lib/libc-2.3.6.so
lt-vzctl  16531   root0u  CHR1,3
1423308 /var/lib/vz/root/101/dev/null
lt-vzctl  16531   root1w  REG   0,22 1941
1232142 /var/lib/vz/root/101/var/log/init.log
lt-vzctl  16531   root2r FIFO   0,22
1232141 /var/lib/vz/root/101/var/log/init.fifo




env.c.diff
Description: env.c.diff
___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: [Users] problems with vzctl init logging patch

2008-03-12 Thread Dietmar Maurer
Just a guess: its the logging proxess itself, because that process still runs 
on the host - I need to do a exec instead?

- Dietmar 

 -Ursprüngliche Nachricht-
 Von: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] Im Auftrag von Dietmar Maurer
 Gesendet: Mittwoch, 12. März 2008 10:37
 An: users@openvz.org
 Betreff: [Users] problems with vzctl init logging patch
 
 hi all,
 
 my init logging patch works so far, but unfortunately it breaks
 checkpointing:
 ---
 vzctl chkpnt 101
 Setting up checkpoint...
 suspend...
 dump...
 Can not dump container: Invalid argument
 Error: d_path err=-22
 Checkpointing failed
 ---
 
 Maybe some of the developers can give me a hint whats wrong?
 
 lsof shows (16531 id the logging process)
 
 lt-vzctl  16531   root  cwd   DIR   0,22 4096
 1226401 /var/lib/vz/root/101
 lt-vzctl  16531   root  rtd   DIR   0,22 4096
 1226401 /var/lib/vz/root/101
 lt-vzctl  16531   root  txt   REG8,198155
 2047179 /home/dietmar/pve/vzctl/vzctl-3.0.22/src/.libs/lt-vzctl
 lt-vzctl  16531   root  mem   REG0,0
 0 [heap] (stat: No such file or directory)
 lt-vzctl  16531   root  mem   REG8,197928
 1896840 /lib/ld-2.3.6.so
 lt-vzctl  16531   root  mem   REG8,1   488939
 2031943
 /home/dietmar/pve/vzctl/vzctl-3.0.22/src/lib/.libs/libvzctl-0.0.2.so
 lt-vzctl  16531   root  mem   REG8,110392
 1896846 /lib/libdl-2.3.6.so
 lt-vzctl  16531   root  mem   REG8,110520
 1896843 /lib/libutil-2.3.6.so
 lt-vzctl  16531   root  mem   REG8,1  1282008
 1896845 /lib/libc-2.3.6.so
 lt-vzctl  16531   root0u  CHR1,3
 1423308 /var/lib/vz/root/101/dev/null
 lt-vzctl  16531   root1w  REG   0,22 1941
 1232142 /var/lib/vz/root/101/var/log/init.log
 lt-vzctl  16531   root2r FIFO   0,22
 1232141 /var/lib/vz/root/101/var/log/init.fifo
 
 
 


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


AW: AW: AW: [Users] problems with vzctl init logging patch

2008-03-12 Thread Dietmar Maurer
 Adding a check makes sense. But first -- why do you need perl 
 at all? Is there something that can't be done in shell?

I guess you are right - will rewrite it.

- Dietmar


___
Users mailing list
Users@openvz.org
https://openvz.org/mailman/listinfo/users


  1   2   >