Re: [ovirt-users] Mouse USB passthrough not working

[Wesley Stewart]

Further testing...

Something is definitely odd, after adding everything in the USB Bus 3
things are working fine; Mouse, keyboard, no crashes.  VM has a couple
extra things in the device manager, but since none of my other VM's require
anything USB it is fine for now.  Just found it all odd.

On Mon, Oct 9, 2017 at 1:19 PM, Wesley Stewart  wrote:

> I did some more testing.  Is it possible ovirt is assigning the incorrect
> devices?
>
> I found out that if I don't assign the keyboard to my VM, but still hit
> ctrl + alt + delete, everything still crashes! (Host and VM).
>
> I checked the VMs devices:
> [image: Inline image 1]
>
> and I also ran lsusb on my host
>
> [image: Inline image 3]
>
> Shouldnt the host have *3_2* & *3_3*, not *3_1 *& *3_2*? even though this
> is what the gui has listed for the keyboard and mouse?
>
> On Mon, Oct 9, 2017 at 12:45 PM, Wesley Stewart 
> wrote:
>
>> I have a windows guest that I use to use without issue, but since
>> upgrading from 4.1.4 to 4.1.6 I cannot get a mouse to pass through to the
>> VM using USB Passthrough.
>>
>> Keyboard using USB passthrough and my GPU works without an issue.  I have
>> tried multiple mice with the same issue, they just wont work.
>>
>> Any ideas?
>>
>
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] ovirt 4.1 hosted engine: clear Task error: Operation is not allowed in this task state: ("can't clean in state running", )

[yayo (j)]

Hi,


2017-10-11 16:13 GMT+02:00 Adam Litke :

> What is the status of your Datacenter?
>

The status of datacenter is "operational"



> Are these hosts both operational?
>

yes


> Are you experiencing other problems with your storage other than the
> inconsistent task state?
>

No, what kind of problem?


> Do you see the KeyError: 'VERSION' message related to domain 
> *b6730d64-2cf8-42a3-8f08-24b8cc2c0cd8
> also on Node02?  *
>

Is from node 2


> *Did you experience any disaster (power outage, FC storage outage,
> network, etc) around the time this started happening?*
>


No
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] ovirt 4.1 hosted engine: clear Task error: Operation is not allowed in this task state: ("can't clean in state running", )

[Adam Litke]

What is the status of your Datacenter?  Are these hosts both operational?
Are you experiencing other problems with your storage other than the
inconsistent task state?Do you see the KeyError: 'VERSION' message
related to domain *b6730d64-2cf8-42a3-8f08-24b8cc2c0cd8 also on Node02?
Did you experience any disaster (power outage, FC storage outage, network,
etc) around the time this started happening?*

On Wed, Oct 11, 2017 at 9:21 AM, yayo (j)  wrote:

> Hi all,
>
> ovirt 4.1 hosted engine on 2 node cluster and FC LUN Storage
>
> I'm trying to clear some task pending from months using vdsClient but I
> can't do anything.  Below are the steps (on node 1, the SPM):
>
> 1. Show all tasks:
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *# vdsClient -s 0 getAllTasksInfofd319af4-d160-48ce-b682-5a908333a5e1 :
>  verb = createVolume id =
> fd319af4-d160-48ce-b682-5a908333a5e19bbc2bc4-3c73-4814-a785-6ea737904528 :
>verb = prepareMerge id =
> 9bbc2bc4-3c73-4814-a785-6ea737904528e70feb21-964d-49d9-9b5a-8e3f70a92db1 :
>verb = prepareMerge id =
> e70feb21-964d-49d9-9b5a-8e3f70a92db1cf064461-f0ab-4e44-a68f-b2d58fa83a21 :
>verb = prepareMerge id =
> cf064461-f0ab-4e44-a68f-b2d58fa83a2185b7cf4e-d658-4785-94f0-391fe9616b41 :
>verb = prepareMerge id =
> 85b7cf4e-d658-4785-94f0-391fe9616b417416627a-fe50-4353-b129-e01bba066a66 :
>verb = prepareMerge id =
> 7416627a-fe50-4353-b129-e01bba066a66*
>
>
> 2. Stop all tasks (repeted for every task):
>
> *# vdsClient -s 0 stopTask 7416627a-fe50-4353-b129-e01bba066a66 *
> Task is aborted: u'7416627a-fe50-4353-b129-e01bba066a66' - code 411
>
> 3. Tring to clear tasks:
>
> * # vdsClient -s 0 clearTask 7416627a-fe50-4353-b129-e01bba066a66*
> *Operation is not allowed in this task state: ("can't clean in state
> running",)*
>
>
>
> *On Node 01 (the SPM) I have multiple errors
> in /var/log/vdsm/vdsm.log like this:*
>
> *2017-10-11 15:09:53,719+0200 INFO  (jsonrpc/3) [storage.TaskManager.Task]
> (Task='9519d4db-2960-4b88-82f2-e4c1094eac54') aborting: Task is aborted:
> u'Operation is not allowed in this task state: ("can\'t clean in state
> running",)' - code 100 (task:1175)*
> *2017-10-11 15:09:53,719+0200 ERROR (jsonrpc/3) [storage.Dispatcher]
> FINISH clearTask error=Operation is not allowed in this task state: ("can't
> clean in state running",) (dispatcher:78)*
> *2017-10-11 15:09:53,720+0200 INFO  (jsonrpc/3) [jsonrpc.JsonRpcServer]
> RPC call Task.clear failed (error 410) in 0.01 seconds (__init__:539)*
> *2017-10-11 15:09:53,743+0200 INFO  (jsonrpc/6) [vdsm.api] START
> clearTask(taskID=u'7416627a-fe50-4353-b129-e01bba066a66', spUUID=None,
> options=None) from=:::192.168.0.226,36724, flow_id=7cd340ec (api:46)*
> *2017-10-11 15:09:53,743+0200 INFO  (jsonrpc/6) [vdsm.api] FINISH
> clearTask error=Operation is not allowed in this task state: ("can't clean
> in state running",) from=:::192.168.0.226,36724, flow_id=7cd340ec
> (api:50)*
> *2017-10-11 15:09:53,743+0200 ERROR (jsonrpc/6) [storage.TaskManager.Task]
> (Task='0e12e052-2aca-480d-b50f-5de01ddebe35') Unexpected error (task:870)*
> *Traceback (most recent call last):*
> *  File "/usr/share/vdsm/storage/task.py", line 877, in _run*
> *return fn(*args, **kargs)*
> *  File "", line 2, in clearTask*
> *  File "/usr/lib/python2.7/site-packages/vdsm/common/api.py", line 48, in
> method*
> *ret = func(*args, **kwargs)*
> *  File "/usr/share/vdsm/storage/hsm.py", line 2258, in clearTask*
> *return self.taskMng.clearTask(taskID=taskID)*
> *  File "/usr/share/vdsm/storage/taskManager.py", line 175, in clearTask*
> *t.clean()*
> *  File "/usr/share/vdsm/storage/task.py", line 1047, in clean*
> *raise se.TaskStateError("can't clean in state %s" % self.state)*
> *TaskStateError: Operation is not allowed in this task state: ("can't
> clean in state running",)*
>
>
> *On Node 02 (is a 2 node cluster) I have other errors (I don't know if are
> related):*
>
> *2017-10-11 15:11:57,083+0200 INFO  (jsonrpc/7) [storage.LVM] Refreshing
> lvs: vg=b50c1f5c-aa2c-4a53-9f89-83517fa70d3b lvs=['leases'] (lvm:1291)*
> *2017-10-11 15:11:57,084+0200 INFO  (jsonrpc/7) [storage.LVM] Refreshing
> LVs (vg=b50c1f5c-aa2c-4a53-9f89-83517fa70d3b, lvs=['leases']) (lvm:1319)*
> *2017-10-11 15:11:57,124+0200 INFO  (jsonrpc/7) [storage.VolumeManifest]
> b50c1f5c-aa2c-4a53-9f89-83517fa70d3b/d42f671e-1745-46c1-9e1c-2833245675fc/c86afaa5-6ca8-4fcb-a27e-ffbe0133fe23
> info is {'status': 'OK', 'domain': 'b50c1f5c-aa2c-4a53-9f89-83517fa70d3b',
> 'voltype': 'LEAF', 'description': 'hosted-engine.metadata', 'parent':
> '----', 'format': 'RAW', 'generation': 0,
> 'image': 'd42f671e-1745-46c1-9e1c-2833245675fc', 'ctime': '1499437345',
> 'disktype': '2', 'legality': 'LEGAL', 'mtime': '0', 'apparentsize':
> '134217728', 'children': [], 'pool': '', 'capacity': '134217728', 'uuid':
> u'c86afaa5-6ca8-4fcb-a27e-ffbe0133fe23', 

Re: [ovirt-users] Add FC domain failed - but reported as used

[Adam Litke]

Please provide engine and vdsm logs during the failure window.

On Wed, Oct 11, 2017 at 8:23 AM, Roberto Nunin  wrote:

> I've tried to add a second FC data domain to our oVirt remote infra, built
> with 6 hosts in remote and 4 local, where hosted-engine is running.
>
> Currently, we are using  4.0.1.1-1.el7.centos.
>
> After FC storage setup (zoning/masking), tried to add the new volume to
> the remote DC.
>
> Process was failing with:
>
> 2017-10-11 12:57:31,174 ERROR [org.ovirt.engine.core.dal.
> dbbroker.auditloghandling.AuditLogDirector] (default task-5) [bfcbca2]
> Correlation ID: bfcbca2, Job ID: 0850b9ba-a898-472c-9dbd-3ae4f27b2992,
> Call Stack: null, Custom Event ID: -1, Message: Failed to attach Storage
> Domain oVirt_datastore_2_NO to Data Center CompanyDCoVirt4. (User:
> m...@srv-ldap-new.company.com-authz).
>
> on SPM, vdsm log report:
>
> jsonrpc.Executor/0::ERROR::2017-10-11 12:57:26,503::sdc::140::
> Storage.StorageDomainCache::(_findDomain) looking for unfetched domain
> 17d3d910-3f79-468e-9ffb-a7bd2bd174aa
> jsonrpc.Executor/0::ERROR::2017-10-11 12:57:26,503::sdc::157::
> Storage.StorageDomainCache::(_findUnfetchedDomain) looking for domain
> 17d3d910-3f79-468e-9ffb-a7bd2bd174aa
> jsonrpc.Executor/0::ERROR::2017-10-11 12:57:26,505::sdc::146::
> Storage.StorageDomainCache::(_findDomain) domain 
> 17d3d910-3f79-468e-9ffb-a7bd2bd174aa
> not found
>
>
> After this attempt, I've double checket that all 6 hosts have identified
> the new volume. All are ok.
>
> Another attempt to add the volume to the remote DC, was failing blocking
> me to chosse the volume ID into the GUI interface, because "the LUN is
> already part of a Storage DOmain".
>
> I think that something is still marking as used the new volume into the
> host-engine DB, even if it isn't available into the GUI interface.
> If this could be the reason, how to correctly manage this issue ? (apart
> update the entire installation, planned :) )
>
> Thanks in advance
>
> --
> Roberto
>
>
>
>
> ___
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
>


-- 
Adam Litke
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] what does memory balloon optimize means in cluster?

[Martin Sivak]

Hi,

Memory ballooning is a technique that allows taking memory from one
running VM when the VM is not actively using it and "returning" it
when the VM needs it.

oVirt uses it when:
- ballooning it is enabled in cluster
- memory overcommit is enabled for cluster
- ballooning device is present in VM (it is by default)
- host's memory load gets above 80%

We are deliberately pretty slow in changing the available memory so it
works best for VMs where the memory consumption does not show sudden
jumps.

As a summary: Memory ballooning is a technique that allows memory
overcommiting a host (overselling if you want).

I did a presentation couple of years back about it:
https://www.youtube.com/watch?v=PRYo1uOniFo

Best regards

--
Martin Sivak
SLA / oVirt

On Wed, Oct 11, 2017 at 3:13 PM, pengyixiang  wrote:
> hello, every!
> I want know what does memory balloon optimize means? and what should i
> do to test it's effective?
>
>
> 【网易自营|30天无忧退货】仅售同款价1/4！MUJI制造商“2017秋冬舒适家居拖鞋系列”限时仅34.9元>>
>
> ___
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

[ovirt-users] what does memory balloon optimize means in cluster?

[pengyixiang]

hello, every!
I want know what does memory balloon optimize means? and what should i do 
to test it's effective?
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] Fwd: ovirt-engine-extension-aaa-ldap active directory

[Ondra Machacek]

I don't know what did you downloaded.
It should be CA used to sign the LDAP services on AD.

If it's CA created by AD SSL, you can get it for example as follows:

1. Press "Start" -> "Run" and write "cmd" and press "Enter".
2. Extract the CA certificate using the following command:

```
> certutil -ca.cert ca.der
```
3. Copy ca.der to oVirt machine into /tmp.
4. Convert to PEM format using the following command:

```
$ openssl x509 -in /tmp/ca.der -inform DER -out /tmp/ca.crt
```

On Wed, Oct 11, 2017 at 3:02 PM, nicola gentile
 wrote:
> I do this already.
> The CA certificate that i download is fine also for ldap?
>
> Nick
>
> 2017-10-11 14:56 GMT+02:00 Ondra Machacek :
>> You can download it just a temporary, for example to /tmp.
>> Then aaa-setup-tool wil create jks file in /etc/ovirt-engine/aaa/ directory.
>> After that you can remove the CA file and keep just jks file.
>>
>> On Wed, Oct 11, 2017 at 2:37 PM, nicola gentile
>>  wrote:
>>> Yes I created by aaa-setup tool.
>>> I noticed that the CA certificate was expired, than I download new
>>> certificate and I run aaa-setup tool.
>>>
>>> is there a specific place to put the certificate file ca? I put in root 
>>> home.
>>>
>>> Thank a lot
>>>
>>> Nick
>>>
>>> 2017-10-11 14:18 GMT+02:00 Ondra Machacek :
 It fails on SSL handshake:
  sun.security.validator.ValidatorException: No trusted certificate found

 How did you create 'polito.it.jks' file? By aaa-setup tool?
 Are use sure you've entered correct CA certificate there?

 On Wed, Oct 11, 2017 at 1:30 PM, nicola gentile
  wrote:
> 2017-10-11 10:11 GMT+02:00 nicola gentile :
>> Hi Martin,
>> I attach aaa.log you suggest
>>
>> Nick
>>
>> 2017-10-10 20:41 GMT+02:00 Martin Perina :
>>> Hi,
>>>
>>> most probably you are affected by [1], so could you please check
>>> certificates on all your AD servers?
>>> You can verify using following command:
>>>
>>>   ovirt-engine-extensions-tool --log-level=FINEST aaa login-user
>>> --user-name= --profile=
>>>
>>>
>>> Thanks
>>>
>>> Martin
>>>
>>> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1465463
>>>
>>>
>>> On Tue, Oct 10, 2017 at 6:13 PM, Luca 'remix_tj' Lorenzetto
>>>  wrote:

 On Tue, Oct 10, 2017 at 4:41 PM, nicola gentile
  wrote:
 > I run the command you suggest
 > ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D 
 > u...@dom.it
 > -W -x sAMAccountName=user_to_search userPrincipalName | grep
 > userPrincipalName
 >
 > This is the result:
 >
 > Enter LDAP Password:
 > # requesting: userPrincipalName
 >

 Supposing you're using all the right parameters in ldapsearch command,
 it seems that the user you were looking up is not a valid user in that
 directory server.

 Please check with someone that can access to AD and verify the status
 of the user with ADSI Edit.

 Luca


 --
 "E' assurdo impiegare gli uomini di intelligenza eccellente per fare
 calcoli che potrebbero essere affidati a chiunque se si usassero delle
 macchine"
 Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716)

 "Internet è la più grande biblioteca del mondo.
 Ma il problema è che i libri sono tutti sparsi sul pavimento"
 John Allen Paulos, Matematico (1945-vivente)

 Luca 'remix_tj' Lorenzetto, http://www.remixtj.net ,
 
 ___
 Users mailing list
 Users@ovirt.org
 http://lists.ovirt.org/mailman/listinfo/users
>>>
>>>
>
> ___
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

[ovirt-users] ovirt 4.1 hosted engine: clear Task error: Operation is not allowed in this task state: ("can't clean in state running", )

[yayo (j)]

Hi all,

ovirt 4.1 hosted engine on 2 node cluster and FC LUN Storage

I'm trying to clear some task pending from months using vdsClient but I
can't do anything.  Below are the steps (on node 1, the SPM):

1. Show all tasks:



















*# vdsClient -s 0 getAllTasksInfofd319af4-d160-48ce-b682-5a908333a5e1 :
 verb = createVolume id =
fd319af4-d160-48ce-b682-5a908333a5e19bbc2bc4-3c73-4814-a785-6ea737904528 :
   verb = prepareMerge id =
9bbc2bc4-3c73-4814-a785-6ea737904528e70feb21-964d-49d9-9b5a-8e3f70a92db1 :
   verb = prepareMerge id =
e70feb21-964d-49d9-9b5a-8e3f70a92db1cf064461-f0ab-4e44-a68f-b2d58fa83a21 :
   verb = prepareMerge id =
cf064461-f0ab-4e44-a68f-b2d58fa83a2185b7cf4e-d658-4785-94f0-391fe9616b41 :
   verb = prepareMerge id =
85b7cf4e-d658-4785-94f0-391fe9616b417416627a-fe50-4353-b129-e01bba066a66 :
   verb = prepareMerge id =
7416627a-fe50-4353-b129-e01bba066a66*


2. Stop all tasks (repeted for every task):

*# vdsClient -s 0 stopTask 7416627a-fe50-4353-b129-e01bba066a66 *
Task is aborted: u'7416627a-fe50-4353-b129-e01bba066a66' - code 411

3. Tring to clear tasks:

* # vdsClient -s 0 clearTask 7416627a-fe50-4353-b129-e01bba066a66*
*Operation is not allowed in this task state: ("can't clean in state
running",)*



*On Node 01 (the SPM) I have multiple errors in /var/log/vdsm/vdsm.log like
this:*

*2017-10-11 15:09:53,719+0200 INFO  (jsonrpc/3) [storage.TaskManager.Task]
(Task='9519d4db-2960-4b88-82f2-e4c1094eac54') aborting: Task is aborted:
u'Operation is not allowed in this task state: ("can\'t clean in state
running",)' - code 100 (task:1175)*
*2017-10-11 15:09:53,719+0200 ERROR (jsonrpc/3) [storage.Dispatcher] FINISH
clearTask error=Operation is not allowed in this task state: ("can't clean
in state running",) (dispatcher:78)*
*2017-10-11 15:09:53,720+0200 INFO  (jsonrpc/3) [jsonrpc.JsonRpcServer] RPC
call Task.clear failed (error 410) in 0.01 seconds (__init__:539)*
*2017-10-11 15:09:53,743+0200 INFO  (jsonrpc/6) [vdsm.api] START
clearTask(taskID=u'7416627a-fe50-4353-b129-e01bba066a66', spUUID=None,
options=None) from=:::192.168.0.226,36724, flow_id=7cd340ec (api:46)*
*2017-10-11 15:09:53,743+0200 INFO  (jsonrpc/6) [vdsm.api] FINISH clearTask
error=Operation is not allowed in this task state: ("can't clean in state
running",) from=:::192.168.0.226,36724, flow_id=7cd340ec (api:50)*
*2017-10-11 15:09:53,743+0200 ERROR (jsonrpc/6) [storage.TaskManager.Task]
(Task='0e12e052-2aca-480d-b50f-5de01ddebe35') Unexpected error (task:870)*
*Traceback (most recent call last):*
*  File "/usr/share/vdsm/storage/task.py", line 877, in _run*
*return fn(*args, **kargs)*
*  File "", line 2, in clearTask*
*  File "/usr/lib/python2.7/site-packages/vdsm/common/api.py", line 48, in
method*
*ret = func(*args, **kwargs)*
*  File "/usr/share/vdsm/storage/hsm.py", line 2258, in clearTask*
*return self.taskMng.clearTask(taskID=taskID)*
*  File "/usr/share/vdsm/storage/taskManager.py", line 175, in clearTask*
*t.clean()*
*  File "/usr/share/vdsm/storage/task.py", line 1047, in clean*
*raise se.TaskStateError("can't clean in state %s" % self.state)*
*TaskStateError: Operation is not allowed in this task state: ("can't clean
in state running",)*


*On Node 02 (is a 2 node cluster) I have other errors (I don't know if are
related):*

*2017-10-11 15:11:57,083+0200 INFO  (jsonrpc/7) [storage.LVM] Refreshing
lvs: vg=b50c1f5c-aa2c-4a53-9f89-83517fa70d3b lvs=['leases'] (lvm:1291)*
*2017-10-11 15:11:57,084+0200 INFO  (jsonrpc/7) [storage.LVM] Refreshing
LVs (vg=b50c1f5c-aa2c-4a53-9f89-83517fa70d3b, lvs=['leases']) (lvm:1319)*
*2017-10-11 15:11:57,124+0200 INFO  (jsonrpc/7) [storage.VolumeManifest]
b50c1f5c-aa2c-4a53-9f89-83517fa70d3b/d42f671e-1745-46c1-9e1c-2833245675fc/c86afaa5-6ca8-4fcb-a27e-ffbe0133fe23
info is {'status': 'OK', 'domain': 'b50c1f5c-aa2c-4a53-9f89-83517fa70d3b',
'voltype': 'LEAF', 'description': 'hosted-engine.metadata', 'parent':
'----', 'format': 'RAW', 'generation': 0,
'image': 'd42f671e-1745-46c1-9e1c-2833245675fc', 'ctime': '1499437345',
'disktype': '2', 'legality': 'LEGAL', 'mtime': '0', 'apparentsize':
'134217728', 'children': [], 'pool': '', 'capacity': '134217728', 'uuid':
u'c86afaa5-6ca8-4fcb-a27e-ffbe0133fe23', 'truesize': '134217728', 'type':
'PREALLOCATED', 'lease': {'owners': [], 'version': None}} (volume:272)*
*2017-10-11 15:11:57,125+0200 INFO  (jsonrpc/7) [vdsm.api] FINISH
getVolumeInfo return={'info': {'status': 'OK', 'domain':
'b50c1f5c-aa2c-4a53-9f89-83517fa70d3b', 'voltype': 'LEAF', 'description':
'hosted-engine.metadata', 'parent': '----',
'format': 'RAW', 'generation': 0, 'image':
'd42f671e-1745-46c1-9e1c-2833245675fc', 'ctime': '1499437345', 'disktype':
'2', 'legality': 'LEGAL', 'mtime': '0', 'apparentsize': '134217728',
'children': [], 'pool': '', 'capacity': '134217728', 'uuid':

Re: [ovirt-users] Fwd: ovirt-engine-extension-aaa-ldap active directory

[nicola gentile]

I do this already.
The CA certificate that i download is fine also for ldap?

Nick

2017-10-11 14:56 GMT+02:00 Ondra Machacek :
> You can download it just a temporary, for example to /tmp.
> Then aaa-setup-tool wil create jks file in /etc/ovirt-engine/aaa/ directory.
> After that you can remove the CA file and keep just jks file.
>
> On Wed, Oct 11, 2017 at 2:37 PM, nicola gentile
>  wrote:
>> Yes I created by aaa-setup tool.
>> I noticed that the CA certificate was expired, than I download new
>> certificate and I run aaa-setup tool.
>>
>> is there a specific place to put the certificate file ca? I put in root home.
>>
>> Thank a lot
>>
>> Nick
>>
>> 2017-10-11 14:18 GMT+02:00 Ondra Machacek :
>>> It fails on SSL handshake:
>>>  sun.security.validator.ValidatorException: No trusted certificate found
>>>
>>> How did you create 'polito.it.jks' file? By aaa-setup tool?
>>> Are use sure you've entered correct CA certificate there?
>>>
>>> On Wed, Oct 11, 2017 at 1:30 PM, nicola gentile
>>>  wrote:
 2017-10-11 10:11 GMT+02:00 nicola gentile :
> Hi Martin,
> I attach aaa.log you suggest
>
> Nick
>
> 2017-10-10 20:41 GMT+02:00 Martin Perina :
>> Hi,
>>
>> most probably you are affected by [1], so could you please check
>> certificates on all your AD servers?
>> You can verify using following command:
>>
>>   ovirt-engine-extensions-tool --log-level=FINEST aaa login-user
>> --user-name= --profile=
>>
>>
>> Thanks
>>
>> Martin
>>
>> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1465463
>>
>>
>> On Tue, Oct 10, 2017 at 6:13 PM, Luca 'remix_tj' Lorenzetto
>>  wrote:
>>>
>>> On Tue, Oct 10, 2017 at 4:41 PM, nicola gentile
>>>  wrote:
>>> > I run the command you suggest
>>> > ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D u...@dom.it
>>> > -W -x sAMAccountName=user_to_search userPrincipalName | grep
>>> > userPrincipalName
>>> >
>>> > This is the result:
>>> >
>>> > Enter LDAP Password:
>>> > # requesting: userPrincipalName
>>> >
>>>
>>> Supposing you're using all the right parameters in ldapsearch command,
>>> it seems that the user you were looking up is not a valid user in that
>>> directory server.
>>>
>>> Please check with someone that can access to AD and verify the status
>>> of the user with ADSI Edit.
>>>
>>> Luca
>>>
>>>
>>> --
>>> "E' assurdo impiegare gli uomini di intelligenza eccellente per fare
>>> calcoli che potrebbero essere affidati a chiunque se si usassero delle
>>> macchine"
>>> Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716)
>>>
>>> "Internet è la più grande biblioteca del mondo.
>>> Ma il problema è che i libri sono tutti sparsi sul pavimento"
>>> John Allen Paulos, Matematico (1945-vivente)
>>>
>>> Luca 'remix_tj' Lorenzetto, http://www.remixtj.net ,
>>> 
>>> ___
>>> Users mailing list
>>> Users@ovirt.org
>>> http://lists.ovirt.org/mailman/listinfo/users
>>
>>

 ___
 Users mailing list
 Users@ovirt.org
 http://lists.ovirt.org/mailman/listinfo/users

___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] Fwd: ovirt-engine-extension-aaa-ldap active directory

[Ondra Machacek]

You can download it just a temporary, for example to /tmp.
Then aaa-setup-tool wil create jks file in /etc/ovirt-engine/aaa/ directory.
After that you can remove the CA file and keep just jks file.

On Wed, Oct 11, 2017 at 2:37 PM, nicola gentile
 wrote:
> Yes I created by aaa-setup tool.
> I noticed that the CA certificate was expired, than I download new
> certificate and I run aaa-setup tool.
>
> is there a specific place to put the certificate file ca? I put in root home.
>
> Thank a lot
>
> Nick
>
> 2017-10-11 14:18 GMT+02:00 Ondra Machacek :
>> It fails on SSL handshake:
>>  sun.security.validator.ValidatorException: No trusted certificate found
>>
>> How did you create 'polito.it.jks' file? By aaa-setup tool?
>> Are use sure you've entered correct CA certificate there?
>>
>> On Wed, Oct 11, 2017 at 1:30 PM, nicola gentile
>>  wrote:
>>> 2017-10-11 10:11 GMT+02:00 nicola gentile :
 Hi Martin,
 I attach aaa.log you suggest

 Nick

 2017-10-10 20:41 GMT+02:00 Martin Perina :
> Hi,
>
> most probably you are affected by [1], so could you please check
> certificates on all your AD servers?
> You can verify using following command:
>
>   ovirt-engine-extensions-tool --log-level=FINEST aaa login-user
> --user-name= --profile=
>
>
> Thanks
>
> Martin
>
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1465463
>
>
> On Tue, Oct 10, 2017 at 6:13 PM, Luca 'remix_tj' Lorenzetto
>  wrote:
>>
>> On Tue, Oct 10, 2017 at 4:41 PM, nicola gentile
>>  wrote:
>> > I run the command you suggest
>> > ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D u...@dom.it
>> > -W -x sAMAccountName=user_to_search userPrincipalName | grep
>> > userPrincipalName
>> >
>> > This is the result:
>> >
>> > Enter LDAP Password:
>> > # requesting: userPrincipalName
>> >
>>
>> Supposing you're using all the right parameters in ldapsearch command,
>> it seems that the user you were looking up is not a valid user in that
>> directory server.
>>
>> Please check with someone that can access to AD and verify the status
>> of the user with ADSI Edit.
>>
>> Luca
>>
>>
>> --
>> "E' assurdo impiegare gli uomini di intelligenza eccellente per fare
>> calcoli che potrebbero essere affidati a chiunque se si usassero delle
>> macchine"
>> Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716)
>>
>> "Internet è la più grande biblioteca del mondo.
>> Ma il problema è che i libri sono tutti sparsi sul pavimento"
>> John Allen Paulos, Matematico (1945-vivente)
>>
>> Luca 'remix_tj' Lorenzetto, http://www.remixtj.net ,
>> 
>> ___
>> Users mailing list
>> Users@ovirt.org
>> http://lists.ovirt.org/mailman/listinfo/users
>
>
>>>
>>> ___
>>> Users mailing list
>>> Users@ovirt.org
>>> http://lists.ovirt.org/mailman/listinfo/users
>>>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] Fwd: ovirt-engine-extension-aaa-ldap active directory

[nicola gentile]

Yes I created by aaa-setup tool.
I noticed that the CA certificate was expired, than I download new
certificate and I run aaa-setup tool.

is there a specific place to put the certificate file ca? I put in root home.

Thank a lot

Nick

2017-10-11 14:18 GMT+02:00 Ondra Machacek :
> It fails on SSL handshake:
>  sun.security.validator.ValidatorException: No trusted certificate found
>
> How did you create 'polito.it.jks' file? By aaa-setup tool?
> Are use sure you've entered correct CA certificate there?
>
> On Wed, Oct 11, 2017 at 1:30 PM, nicola gentile
>  wrote:
>> 2017-10-11 10:11 GMT+02:00 nicola gentile :
>>> Hi Martin,
>>> I attach aaa.log you suggest
>>>
>>> Nick
>>>
>>> 2017-10-10 20:41 GMT+02:00 Martin Perina :
 Hi,

 most probably you are affected by [1], so could you please check
 certificates on all your AD servers?
 You can verify using following command:

   ovirt-engine-extensions-tool --log-level=FINEST aaa login-user
 --user-name= --profile=


 Thanks

 Martin

 [1] https://bugzilla.redhat.com/show_bug.cgi?id=1465463


 On Tue, Oct 10, 2017 at 6:13 PM, Luca 'remix_tj' Lorenzetto
  wrote:
>
> On Tue, Oct 10, 2017 at 4:41 PM, nicola gentile
>  wrote:
> > I run the command you suggest
> > ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D u...@dom.it
> > -W -x sAMAccountName=user_to_search userPrincipalName | grep
> > userPrincipalName
> >
> > This is the result:
> >
> > Enter LDAP Password:
> > # requesting: userPrincipalName
> >
>
> Supposing you're using all the right parameters in ldapsearch command,
> it seems that the user you were looking up is not a valid user in that
> directory server.
>
> Please check with someone that can access to AD and verify the status
> of the user with ADSI Edit.
>
> Luca
>
>
> --
> "E' assurdo impiegare gli uomini di intelligenza eccellente per fare
> calcoli che potrebbero essere affidati a chiunque se si usassero delle
> macchine"
> Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716)
>
> "Internet è la più grande biblioteca del mondo.
> Ma il problema è che i libri sono tutti sparsi sul pavimento"
> John Allen Paulos, Matematico (1945-vivente)
>
> Luca 'remix_tj' Lorenzetto, http://www.remixtj.net ,
> 
> ___
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users


>>
>> ___
>> Users mailing list
>> Users@ovirt.org
>> http://lists.ovirt.org/mailman/listinfo/users
>>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

[ovirt-users] Add FC domain failed - but reported as used

[Roberto Nunin]

I've tried to add a second FC data domain to our oVirt remote infra, built
with 6 hosts in remote and 4 local, where hosted-engine is running.

Currently, we are using  4.0.1.1-1.el7.centos.

After FC storage setup (zoning/masking), tried to add the new volume to the
remote DC.

Process was failing with:

2017-10-11 12:57:31,174 ERROR
[org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector]
(default task-5) [bfcbca2] Correlation ID: bfcbca2, Job ID:
0850b9ba-a898-472c-9dbd-3ae4f27b2992, Call Stack: null, Custom Event ID:
-1, Message: Failed to attach Storage Domain oVirt_datastore_2_NO to Data
Center CompanyDCoVirt4. (User: m...@srv-ldap-new.company.com-authz).

on SPM, vdsm log report:

jsonrpc.Executor/0::ERROR::2017-10-11
12:57:26,503::sdc::140::Storage.StorageDomainCache::(_findDomain) looking
for unfetched domain 17d3d910-3f79-468e-9ffb-a7bd2bd174aa
jsonrpc.Executor/0::ERROR::2017-10-11
12:57:26,503::sdc::157::Storage.StorageDomainCache::(_findUnfetchedDomain)
looking for domain 17d3d910-3f79-468e-9ffb-a7bd2bd174aa
jsonrpc.Executor/0::ERROR::2017-10-11
12:57:26,505::sdc::146::Storage.StorageDomainCache::(_findDomain) domain
17d3d910-3f79-468e-9ffb-a7bd2bd174aa not found


After this attempt, I've double checket that all 6 hosts have identified
the new volume. All are ok.

Another attempt to add the volume to the remote DC, was failing blocking me
to chosse the volume ID into the GUI interface, because "the LUN is already
part of a Storage DOmain".

I think that something is still marking as used the new volume into the
host-engine DB, even if it isn't available into the GUI interface.
If this could be the reason, how to correctly manage this issue ? (apart
update the entire installation, planned :) )

Thanks in advance

-- 
Roberto
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] Fwd: ovirt-engine-extension-aaa-ldap active directory

[Ondra Machacek]

It fails on SSL handshake:
 sun.security.validator.ValidatorException: No trusted certificate found

How did you create 'polito.it.jks' file? By aaa-setup tool?
Are use sure you've entered correct CA certificate there?

On Wed, Oct 11, 2017 at 1:30 PM, nicola gentile
 wrote:
> 2017-10-11 10:11 GMT+02:00 nicola gentile :
>> Hi Martin,
>> I attach aaa.log you suggest
>>
>> Nick
>>
>> 2017-10-10 20:41 GMT+02:00 Martin Perina :
>>> Hi,
>>>
>>> most probably you are affected by [1], so could you please check
>>> certificates on all your AD servers?
>>> You can verify using following command:
>>>
>>>   ovirt-engine-extensions-tool --log-level=FINEST aaa login-user
>>> --user-name= --profile=
>>>
>>>
>>> Thanks
>>>
>>> Martin
>>>
>>> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1465463
>>>
>>>
>>> On Tue, Oct 10, 2017 at 6:13 PM, Luca 'remix_tj' Lorenzetto
>>>  wrote:

 On Tue, Oct 10, 2017 at 4:41 PM, nicola gentile
  wrote:
 > I run the command you suggest
 > ldapsearch -h domaincontroller.dom.it -b "dc=dom,dc=it" -D u...@dom.it
 > -W -x sAMAccountName=user_to_search userPrincipalName | grep
 > userPrincipalName
 >
 > This is the result:
 >
 > Enter LDAP Password:
 > # requesting: userPrincipalName
 >

 Supposing you're using all the right parameters in ldapsearch command,
 it seems that the user you were looking up is not a valid user in that
 directory server.

 Please check with someone that can access to AD and verify the status
 of the user with ADSI Edit.

 Luca


 --
 "E' assurdo impiegare gli uomini di intelligenza eccellente per fare
 calcoli che potrebbero essere affidati a chiunque se si usassero delle
 macchine"
 Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716)

 "Internet è la più grande biblioteca del mondo.
 Ma il problema è che i libri sono tutti sparsi sul pavimento"
 John Allen Paulos, Matematico (1945-vivente)

 Luca 'remix_tj' Lorenzetto, http://www.remixtj.net ,
 
 ___
 Users mailing list
 Users@ovirt.org
 http://lists.ovirt.org/mailman/listinfo/users
>>>
>>>
>
> ___
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] Help with SSL

[~Stack~]

On 10/11/2017 05:51 AM, Martin Perina wrote:
> 
> [snip]
> On Tue, Oct 10, 2017 at 11:48 PM, ~Stack~  are you able to login to oVirt webadmin successfully? If so then oVirt
> side should be fine.
> 
I am able to log into oVirt webmin successfully. Is there a reason to
keep the old cert, or was it OK for me to replace
/etc/pki/ovirt-engine/ca.pem with mine?

> About Foreman, is it installed on the same machine as oVirt?

It is on a separate machine.

> If not
> could you please check, that your custom CA is included either in host
> wide truststore or in specific trustore for Foreman (no idea what
> Foreman is using, better to ask in specific Foreman​
> ​mailing list).

I will check. Thanks Martin!
~Stack~




signature.asc
Description: OpenPGP digital signature
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

[ovirt-users] [ANN] oVirt 4.1.7 Third Release Candidate is now available

[Sandro Bonazzola]

The oVirt Project is pleased to announce the availability of the Third
Release Candidate of oVirt 4.1.7, as of October 11th, 2017

This update is the seventh in a series of stabilization updates to the 4.1
series.

Starting from 4.1.5 oVirt supports libgfapi [5]. Using libgfapi provides a
real performance boost for ovirt when using GlusterFS .
Due  to a known issue [6], using this will break live storage migration.
This is expected to be fixed soon. If you do not use live storage
migration you can give it a try. Use [7] for more details on how to  enable
it.

This release is available now for:
* Red Hat Enterprise Linux 7.4 or later
* CentOS Linux (or similar) 7.4 or later

This release supports Hypervisor Hosts running:
* Red Hat Enterprise Linux 7.4 or later
* CentOS Linux (or similar) 7.4 or later
* oVirt Node 4.1

See the release notes draft [3] for installation / upgrade instructions and
a list of new features and bugs fixed.

Notes:
- oVirt Appliance is already available
- oVirt Live is already available[4]
- oVirt Node is already available[4]

Additional Resources:
* Read more about the oVirt 4.1.7 release highlights:
http://www.ovirt.org/release/4.1.7/
* Get more oVirt Project updates on Twitter: https://twitter.com/ovirt
* Check out the latest project news on the oVirt blog:
http://www.ovirt.org/blog/

[1] https://www.ovirt.org/community/
[2] https://bugzilla.redhat.com/enter_bug.cgi?classification=oVirt
[3] http://www.ovirt.org/release/4.1.7/
[4] http://resources.ovirt.org/pub/ovirt-4.1-pre/iso/
[5]
http://staged-gluster-docs.readthedocs.io/en/release3.7.0beta1/Features/libgfapi/
[6] https://bugzilla.redhat.com/show_bug.cgi?id=1306562
[7]
http://www.ovirt.org/develop/release-management/features/storage/glusterfs-storage-domain/

-- 

SANDRO BONAZZOLA

ASSOCIATE MANAGER, SOFTWARE ENGINEERING, EMEA ENG VIRTUALIZATION R

Red Hat EMEA 

TRIED. TESTED. TRUSTED. 

___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] Help with SSL

[Martin Perina]

On Tue, Oct 10, 2017 at 11:48 PM, ~Stack~  wrote:

> Greetings,
>
> OS: Scientific Linux 7.3
> Ovirt: 4.1.6.2-1.el7.centos
> Foreman: 1.16.0-RC1
>
> I updated my OVirt SSL cert from a self-signed to a purchased one using
> the directions here:
> https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL/
>
> Everything seems to work from the web interface.
>
> Then I tried to add in Foreman. Thats where I get the error:
>
> Unable to save
> ERF56-1309 [Foreman::FingerprintException]: The remote system presented
> a public key signed by an unidentified certificate authority. If you are
> sure the remote system is authentic, go to the compute resource edit
> page, press the 'Test Connection' or 'Load Datacenters' button and submit.
>
> Everything I can find says that it *should* be resolved - From Red Hat,
> to Foreman, to even the Ovirt list! Yet there it is!
>
> Well after poking at it for a while, I realized that the cert Foreman
> was auto-resolving was still the /OLD/ cert!
>
> Step #2 in those ovirt directions says to break the symbolic link to
> /etc/pki/ovirt-engine/ca.pem. But it doesn't say what to do with that
> file. So I replaced it with my cert. Restarted ovirt and now Foreman
> resolves the correct X509 cert! (I have no idea if that broke something
> else.)
>
> But I still get the error in foreman. :-(
>
> I feel like I'm still missing something in the ovirt configs. Something
> needs to be updated/replaced in ovirt that isn't in those docs.
>
> Can anyone help me out please? I've been trying for hours and not making
>

​Hi,

are you able to login to oVirt webadmin successfully? If so then oVirt side
should be fine.

About Foreman, is it installed on the same machine as oVirt? If not could
you please check, that your custom CA is included either in host wide
truststore or in specific trustore for Foreman (no idea what Foreman is
using, better to ask in specific Foreman​

​mailing list).

Regards

Martin
​

> progress.
> Thanks!
>
> ~Stack~
>
>
>
> ___
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] Info on manual operations after removing FC storage domain

[Yaniv Kaul]

On Tue, Oct 10, 2017 at 2:57 PM, Gianluca Cecchi 
wrote:

> On Tue, Oct 10, 2017 at 1:29 PM, Yaniv Kaul  wrote:
>
>>
>>
>> On Oct 6, 2017 2:41 PM, "Gianluca Cecchi" 
>> wrote:
>>
>> Hello,
>> I'm relocating some disks from some storage domains to other ones.
>> At the end I'm going to remove source storage domains.
>> All the SD involved are FC and the hosts are CentOS 7.4
>> I see that after removing an SD from oVirt, the multipath part on host
>> remains.
>> What is the correct sequence of operations to do at hosts' side after
>> completing the Webadmin Gui part?
>>
>>
>> https://access.redhat.com/documentation/en-us/red_hat_enterp
>> rise_linux/7/html/storage_administration_guide/removing_devices
>>
>> (which seems to be similar to your steps below. I'd remove it from the
>> storage side after flushing though).
>> Y.
>>
>>
> Yes, when removing from physical servers I took that link as reference and
> my steps reproduce them in practice.
> I have not understood what do you mean with
>
> "
>  I'd remove it from the storage side after flushing though
> "
>
> Do yo mean this sequence:
> 1) flush the single path devices
> 2) remove the multipath device with multipath -f
> ??
> O another thing?
>

As soon as you are done flushing IO, I'd remove the device (unzone). The
reason is that you do not want it to be re-discovered.
Y.


>
> Also I found in the mean time this bugzilla (for RHEV)
> https://bugzilla.redhat.com/show_bug.cgi?id=1310330
> where you replied and have work in progress... thanks!
>
> I also found a reference (I miss the bugzilla id right now), that if you
> have vdsm > of a certain version there are "no problems" on hosts in case
> some unused (from oVirt point of view) LUNs are removed from storage array
> while the hosts still enumerating them in their multipath listing. So that
> this can lower potential problems...
> I don't now if the enhancement s related to some sort of blacklisting or
> what has been done at vdsm level
>
> Gianluca
>
>
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] Maximum storage per VM?

[Yaniv Kaul]

On Tue, Oct 10, 2017 at 3:31 PM, Dmitri Chebotarov  wrote:

> Good Morning
>
> I'm using virtio-scsi (also tried virtio), not using IDE (doesn't IDE have
> 4 devices limit? it's long time since I used IDE...).
>
> This is for servers hosting own/nextCloud and Samba for a small/medium
> groups with large datasets (60-80TB) per server.
>
> If ovirt-scsi allows to attach >20 disks  then it meets my needs in this
> case. Thank you.
>
> The reason I opted for LVM is performance. It's so much faster with LVM
> and striped volumes compared to a single large disk. I'm seeing very high
> 'iowait' numbers (to the point when VM is unresponsive) when I'm dumping
> large amount of data to a single disk. But with LVM striped volumes
> 'iowait' at around ~20% and I can get to ~750MB/s in the same environment
> (same config with single disk is ~160MB/s).
>

Interesting. What version of Gluster are you using? Are you using sharding?
What's the underlying storage for Gluster and how is it set up?


>
> Also, healing a single large disk on gluster takes ages (I'm using erasure
> coded volumes) .
>

Sharding and newer versions of Gluster should help here.
Y.


>
>
> Thank you,
> --
> Dmitri Chebotarov.
> George Mason University,
> 4400 University Drive,
> Fairfax, VA, 22030
> GPG Public key# 5E19F14D: [https://goo.gl/SlE8tj]
>
>
> 
> From: Yaniv Kaul 
> Sent: Tuesday, October 10, 2017 4:03:08 AM
> To: Dmitri Chebotarov
> Cc: users@ovirt.org
> Subject: Re: [ovirt-users] Maximum storage per VM?
>
> On Fri, Oct 6, 2017 at 10:24 PM, Dmitri Chebotarov  > wrote:
> Hello
>
> I'm trying to find any info on how much storage I can attach to a VM.
>
> Is there a recommended/maximum for number of disks and maximum disk size?
>
> Disk count depends on the interface - IDE - very few, virtio- 20-something
> (depends on the number of PCI slots available), virtio-SCSI - more.
> What is the use case?
>
>
> I'm using GlusterFS as backend storage for the cluster.
>
> The VM uses LVM (/w striped volumes) to manage attached disks.
>
> Aren't you having layers over layers over layers? Is that the optimal
> arrangement?
> (Again, would be interesting to understand the use case to better provide
> information).
> Y.
>
>
> Thank you,
> --
> Dmitri Chebotarov.
> George Mason University,
> 4400 University Drive,
> Fairfax, VA, 22030
> GPG Public key# 5E19F14D: [https://goo.gl/SlE8tj]
>
> ___
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users