June 2019 - Users - oVirt List Archives

Issue with oVirt aaa-ldap connector on fresh install of 4.3.3
by Vrgotic, Marko 05 Jun '19

05 Jun '19

________________________________ From: Vrgotic, Marko Sent: Tuesday, June 4, 2019 4:44:08 PM To: users(a)ovirt.org Cc: Stojchev, Darko Subject: Issue with aaa-ldap connector on fresh install of 4.3.3 Dear oVIrt, We are running 4.3.3 latest with SHE. Tried to connect our domain users using aaa-ldap extension tool provided. We tried multiple different accounts, with multiple dn search tree syntaxes and verified the passwords. The error is always the same: `2019-06-04 14:03:30,763+0000 ERROR otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._customization_late:835 Cannot authenticate using 'uid=**FILTERED**,ou=ABC Users,dc=example,dc=com': {'info': '80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1', 'desc': 'Invalid credentials'}` The log file is showing the following: 2019-06-04 14:02:31,666+0000 DEBUG otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._getURLs:283 URLs: [u'ldap://hqdc2.example.com:389', u'ldap://eudc1.example.com:389', u'ldap://eudc2.example.com:389', u'ldap://hqdc1.example.com:389'] 2019-06-04 14:02:31,666+0000 INFO otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._connectLDAP:393 Connecting to LDAP using 'ldap://hqdc2.example.com:389' 2019-06-04 14:02:31,675+0000 INFO otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._connectLDAP:444 Executing startTLS 2019-06-04 14:02:32,420+0000 DEBUG otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._connectLDAP:447 Perform search 2019-06-04 14:02:32,567+0000 DEBUG otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._connectLDAP:455 Result: [('', {'supportedLDAPVersion': ['3', '2']})] 2019-06-04 14:02:32,568+0000 INFO otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._connectLDAP:457 Connection succeeded 2019-06-04 14:02:32,568+0000 DEBUG otopi.plugins.otopi.dialog.human human.queryString:159 query OVAAALDAP_LDAP_USER 2019-06-04 14:02:32,568+0000 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204 DIALOG:SEND Enter search user DN (for example uid=username,dc=example,dc=com or leave empty for anonymous): 2019-06-04 14:02:57,540+0000 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204 DIALOG:RECEIVE uid=da-dstojchev,ou=Users,dc=example,dc=com 2019-06-04 14:02:57,541+0000 DEBUG otopi.plugins.otopi.dialog.human human.queryString:159 query OVAAALDAP_LDAP_PASSWORD 2019-06-04 14:02:57,541+0000 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204 DIALOG:SEND Enter search user password: 2019-06-04 14:03:00,713+0000 INFO otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._bindLDAP:478 Attempting to bind using 'uid=da-dstojchev,ou=Users,dc=example,dc=com' 2019-06-04 14:03:00,862+0000 ERROR otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._customization_late:835 Cannot authenticate using 'uid=da-dstojchev,ou=Users,dc=example,dc=com': {'info': '80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1', 'desc': 'Invalid credentials'} 2019-06-04 14:03:00,863+0000 DEBUG otopi.plugins.otopi.dialog.human human.queryString:159 query OVAAALDAP_LDAP_USER 2019-06-04 14:03:00,863+0000 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204 DIALOG:SEND Enter search user DN (for example uid=username,dc=example,dc=com or leave empty for anonymous): 2019-06-04 14:03:27,376+0000 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204 DIALOG:RECEIVE uid=openstack-test,ou=ABC Users,dc=example,dc=com 2019-06-04 14:03:27,376+0000 DEBUG otopi.plugins.otopi.dialog.human human.queryString:159 query OVAAALDAP_LDAP_PASSWORD 2019-06-04 14:03:27,377+0000 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204 DIALOG:SEND Enter search user password: 2019-06-04 14:03:30,616+0000 INFO otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._bindLDAP:478 Attempting to bind using 'uid=**FILTERED**,ou=ABC Users,dc=example,dc=com' 2019-06-04 14:03:30,763+0000 ERROR otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common common._customization_late:835 Cannot authenticate using 'uid=**FILTERED**,ou=ABC Users,dc=example,dc=com': {'info': '80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1', 'desc': 'Invalid credentials'} 2019-06-04 14:03:30,764+0000 DEBUG otopi.plugins.otopi.dialog.human human.queryString:159 query OVAAALDAP_LDAP_USER 2019-06-04 14:03:30,764+0000 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204 DIALOG:SEND Enter search user DN (for example uid=username,dc=example,dc=com or leave empty for anonymous): 2019-06-04 14:03:41,055+0000 DEBUG otopi.context context._executeMethod:145 method exception Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/otopi/context.py", line 132, in _executeMethod method['method']() File "/usr/share/ovirt-engine-extension-aaa-ldap/setup/bin/../plugins/ovirt-engine-extension-aaa-ldap/ldap/common.py", line 812, in _customization_late default='', File "/usr/share/otopi/plugins/otopi/dialog/human.py", line 211, in queryString value = self._readline(hidden=hidden) File "/usr/lib/python2.7/site-packages/otopi/dialog.py", line 246, in _readline value = self.__input.readline() File "/usr/lib/python2.7/site-packages/otopi/main.py", line 53, in _signal raise RuntimeError("SIG%s" % signum) RuntimeError: SIG2 2019-06-04 14:03:41,057+0000 ERROR otopi.context context._executeMethod:154 Failed to execute stage 'Environment customization': SIG2 2019-06-04 14:03:41,057+0000 DEBUG otopi.context context.dumpEnvironment:731 ENVIRONMENT DUMP – BEGIN This is fresh install of oVIrt 4.3.3 latest, assigned for our prod env. Kindly awaiting your reply, Marko Vrgotic ActiveVideo

1 0

Planned restart of production services
by Evgheni Dereveanchin 05 Jun '19

05 Jun '19

Hi everyone, I will be restarting several production systems within the following hour to apply updates. The following services may be unreachable for some period of time: - resources.ovirt.org - package repositories - jenkins.ovirt.org - CI master - glance.ovirt.org - Glance image repository Package repositories will be unreachable for a short period of time. No new CI jobs will be started during this period. I will announce you once maintenance is complete. -- Regards, Evgheni Dereveanchin

1 1

fence_rhevm not working with ovirt 4.3.4.2-1.el7 (RC2)
by Strahil Nikolov 04 Jun '19

04 Jun '19

Hello Community, I'm sending this e-mail just to notify you that I have raised a bug for the fence_rhevm (RHEL 8) which has problems parsing the response from the oVirt's API. The bug is : 1717179 – fence_rhevm cannot obtain plug status on oVirt 4.3.4.2-1.el7 (RC2) | | | | 1717179 – fence_rhevm cannot obtain plug status on oVirt 4.3.4.2-1.el7 (... | | | I guess the package won't work also with RHV (unless the changes in the API are in a recent version). Best Regards,Strahil Nikolov

1 0

Error importing kvm vm to oVirt 4.3.3: https://bugzilla.redhat.com/show_bug.cgi?id=1667488
by adrianquintero＠gmail.com 04 Jun '19

04 Jun '19

Has a resolution for https://bugzilla.redhat.com/show_bug.cgi?id=1667488 been provided somewhere? I cant seem to find a work around except to create an empty ISO domain. Engine logs: 2019-06-04 14:17:45,364-04 INFO [org.ovirt.engine.core.bll.exportimport.ImportVmFromExternalProviderCommand] (default task-223) [f65d3feb-e76b-4e76-98f2-852152032a48] Lock Acquired to object 'EngineLock:{exclusiveLocks='[11553d4c-e084-4dfa-8ceb-6b00d62da19f=VM, testvm.mydomain.com=VM_NAME]', sharedLocks=''}' 2019-06-04 14:17:45,421-04 WARN [org.ovirt.engine.core.bll.exportimport.ImportVmFromExternalProviderCommand] (default task-223) [] Validation of action 'ImportVmFromExternalProvider' failed for user admin@internal-authz. Reasons: VAR__ACTION__IMPORT,VAR__TYPE__VM,ERROR_CANNOT_FIND_ISO_IMAGE_PATH 2019-06-04 14:17:45,422-04 INFO [org.ovirt.engine.core.bll.exportimport.ImportVmFromExternalProviderCommand] (default task-223) [] Lock freed to object 'EngineLock:{exclusiveLocks='[11553d4c-e084-4dfa-8ceb-6b00d62da19f=VM, testvm.mydomain.com=VM_NAME]', sharedLocks=''}' Thanks, AQ

1 0

VM import doesn't see VMs on storage
by Dmitry Filonov 04 Jun '19

04 Jun '19

Hi, I have 2 independent oVirt datacenters. Need to move some of the VMs from DC1 to DC2. So far the strategy was as simple as this - 1) connect new storage domain (NFS) to DC1 2) move VM disks to that storage 3) shut down VMs 4) disconnect storage from DC1 5) import same storage into DC2 6) import VMs from that storage and optionally move VM disks to storage local to DC2. Works fine for a dozen VMs until last Friday when I tried to import another 13 VMs into DC2 and VM import shows only 6. I can see disks in Disk import tab, but not VMs. I guess this is related to the fact that some of the VMs to be moved are based on a template that is still on DC1. But how do I move these VMs then? I can't move the template as 1) I still need it in DC1 2) it doesn't have any disks attached, so I can't really do the same steps to move it. Any ideas are very welcome here. Thanks a lot. -- Dmitry Filonov Linux Administrator SBGrid Core | Harvard Medical School 250 Longwood Ave, SGM-114 Boston, MA 02115

2 3

Feature Request: oVirt to warn when VDO is getting full
by Strahil 04 Jun '19

04 Jun '19

Hello All, I would like to ask how many of you use VDO before asking the oVirt Devs to assess a feature in oVirt for monitoring the size of the VDOs on hyperconverged systems. I think such warning, will save a lot of headaches, but it will not be usefull if most of the community is not using VDO at all. Best Regards, Strahil Nikolov

3 2

SSO problem for Window 7 VM (64)
by Harry Conings 04 Jun '19

04 Jun '19

Hi i am new to oVirt so i think i am missing something. I my case ovirt-engine-extension-aaa-ldap-setup did not work and i am not a domain administrator so i had to set it up by hand I can login with my AD user into the VM portal but SSO to a windows 7 machine does not happen Thks for your help rgds Harry my files: in /etc/ovirt-engine/aaa/zkf200mut.prd.properties vars.user = CN=HARRY (Adm),OU=Administrative Accounts,OU=Operations,OU=203,DC=zkf200mut,DC=prd vars.password = password pool.default.auth.simple.bindDN = ${global:vars.user} pool.default.auth.simple.password = ${global:vars.password} pool.default.serverset.type = single pool.default.serverset.single.server = 10.63.123.22 pool.default.dc-resolve.default.serverset.type = single pool.default.dc-resolve.serverset.single.server = 10.63.123.22 pool.default.socketfactory.type = java /etc/ovirt-engine/extensions.d/zkf200mut.prd-authn.properties ovirt.engine.extension.name = zkf200mut.prd-authn ovirt.engine.extension.bindings.method = jbossmodule ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.ldap.AuthnExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name = zkf200mut.prd ovirt.engine.aaa.authn.authz.plugin = zkf200mut.prd config.profile.file.1 = ../aaa/zkf200mut.prd.properties /etc/ovirt-engine/extensions.d/zkf200mut.prd.properties ovirt.engine.extension.name = zkf200mut.prd ovirt.engine.extension.bindings.method = jbossmodule ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 = ../aaa/zkf200mut.prd.properties engine.log -> when i login and click on the console of the VM 2019-06-04 12:24:30,442+02 INFO [org.ovirt.engine.core.bll.aaa.TerminateSessionsForTokenCommand] (default task-8) [354a4756] Running command: TerminateSessionsForTokenCommand internal: true. 2019-06-04 12:24:46,247+02 INFO [org.ovirt.engine.core.sso.utils.AuthenticationUtils] (default task-7) [] User m203hcon(a)zkf200mut.prd successfully logged in with scopes: ovirt-app-admin ovirt-app-api ovirt-app-portal ovirt-ext=auth:sequence-priority=~ ovirt-ext=revoke:revoke-all ovirt-ext=token-info:authz-search ovirt-ext=token-info:public-authz-search ovirt-ext=token-info:validate ovirt-ext=token:password-access 2019-06-04 12:24:46,316+02 INFO [org.ovirt.engine.core.bll.aaa.CreateUserSessionCommand] (default task-7) [d7805c4] Running command: CreateUserSessionCommand internal: false. 2019-06-04 12:24:46,331+02 INFO [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-7) [d7805c4] EVENT_ID: USER_VDC_LOGIN(30), User m203hcon@zkf200mut.prd@zkf200mut.prd connecting from '10.63.120.199' using session 'CGIKs/CP4HQdLoUhWAzsq996BKkMcKDrqdfHT1x/kIBzixxbNl/hle8BZCZmS2L/ehVZdoStH2JByXragQxeqw==' logged in. 2019-06-04 12:24:47,015+02 ERROR [org.ovirt.engine.core.bll.GetPermissionsForObjectQuery] (default task-3) [1e271632-b9f4-4bcc-8205-ccd8ff1421f6] Query execution failed due to insufficient permissions. 2019-06-04 12:24:47,017+02 ERROR [org.ovirt.engine.api.restapi.resource.AbstractBackendResource] (default task-3) [] Operation Failed: query execution failed due to insufficient permissions. 2019-06-04 12:24:50,106+02 INFO [org.ovirt.engine.core.bll.SetVmTicketCommand] (default task-8) [6f85887f] Running command: SetVmTicketCommand internal: false. Entities affected : ID: 3985528e-5bd3-4d87-b766-361c7985788f Type: VMAction group CONNECT_TO_VM with role type USER 2019-06-04 12:24:50,118+02 INFO [org.ovirt.engine.core.vdsbroker.vdsbroker.SetVmTicketVDSCommand] (default task-8) [6f85887f] START, SetVmTicketVDSCommand(HostName = ovirtServer1.zkf200mut.prd, SetVmTicketVDSCommandParameters:{hostId='d28491ac-2c3b-4462-b24b-1c673155c644', vmId='3985528e-5bd3-4d87-b766-361c7985788f', protocol='SPICE', ticket='PzMAJhjN75ij', validTime='120', userName='m203hcon(a)zkf200mut.prd', userId='12f092ed-db4c-4ed0-b4bb-f3051c4fc677', disconnectAction='LOCK_SCREEN'}), log id: 103ea2 2019-06-04 12:24:50,150+02 INFO [org.ovirt.engine.core.vdsbroker.vdsbroker.SetVmTicketVDSCommand] (default task-8) [6f85887f] FINISH, SetVmTicketVDSCommand, return: , log id: 103ea2 2019-06-04 12:24:50,168+02 INFO [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-8) [6f85887f] EVENT_ID: VM_SET_TICKET(164), User m203hcon@zkf200mut.prd@zkf200mut.prd initiated console session for VM W203YZ001V

1 0

Re: [External] Re: ovirt metrics - vm dashboard not working
by Jayme 04 Jun '19

04 Jun '19

I just get a blank output from that command. I'm running oVirt Node NG 4.3.3.1 hosts On Mon, Jun 3, 2019 at 3:48 PM Morris, Roy <roy.morris(a)ventura.org> wrote: > Jayme, > > > > Can you run the following command and report back with the results? > > > > #systemctl status selinux* -l > > > > Best regards, > > Roy Morris > > GSA Virtualization Systems Analyst > > County of Ventura > > (805) 654-3625 > > (805) 603-9403 > > [image: cid:7c03dd9d67a9cfb78447b56087323d91a66d7c29.camel@ventura.org] > > > > *From:* Jayme <jaymef(a)gmail.com> > *Sent:* Monday, June 3, 2019 11:40 AM > *To:* users <users(a)ovirt.org> > *Subject:* [External] [ovirt-users] Re: ovirt metrics - vm dashboard not > working > > > > *CAUTION: *This email contains links. If it looks suspicious or is not > expected, DO NOT click and immediately forward to Spam.Manager(a)ventura.org > . > > > > > I'm seeing this in the journal for collectd on all of my hosts: > > > > collectd[18380]: write_syslog plugin: error with wr_send_message > collectd[18380]: write_syslog plugin: Connecting to localhost:44514 > failed. The last error was: Connection refused > collectd[18380]: write_syslog plugin: wr_callback_init failed. > collectd[18380]: write_syslog plugin: error with wr_send_message > collectd[18380]: write_syslog plugin: send failed with status -1 > (Connection reset by peer) > collectd[18380]: write_syslog plugin: error with wr_send_message > collectd[18380]: write_syslog plugin: send failed with status -1 > (Connection reset by peer) > > > > collectd and rsyslog are running, I tried restarting both. I can also > telnet to port 44514 on localhost and it's responding. > > > > > > On Mon, Jun 3, 2019 at 3:12 PM Jayme <jaymef(a)gmail.com> wrote: > > I finally managed to get oVirt metrics store running. I loaded sample > dashboards, searches and visualizations in to Kibana from > /etc/ovirt-engine-metrics/dashboards-examples. When importing searches and > visualizations there are warnings about missing index patterns. > > > > It appears that the "VM" dashboard is completely broken, no stats are > showing on it at all including simple stats such as running VM count. > > > > The other two dashboards Hosts and System are working and showing all > stats (sans VM count on the host dashboard). > > > > I believe I have a cash here of either missing indexes or potentially an > issue with the example dashboards? I can see that collectd is running on > all hosts and has the virt plugin loaded. > > > > What part of the config is responsible for suppling the VM > information/indexes? > >

2 2

Uploading disk images (oVirt 4.3.3.1)
by adrianquintero＠gmail.com 03 Jun '19

03 Jun '19

Hi, I have an issue while trying to upload disk images thru the Web UI. "Connection to ovirt-imageio-proxy service has failed. Make sure the service is installed, configured, and ovirt-engine certificate is registered as a valid CA in the browser." My ovirt engine's fqdn is ovirt-engine.mydomain.com however due to network restrictions I had to set rules in order to reach our ovirt-engine ovirt-engine.mydomain.com = 192.168.0.45 For example ovirt-engine.mydomain.otherstuff.com - 192.168.10.109:80, 192.168.10.109:443, 192.168.0.45:80 So as you can see I need to hit the ovirt-engine using ovirt-engine.mydomain.otherstuff.com which I am able to by modifyting the 11-setup-sso.conf file and adding "SSO_ENGINE_URL="https://ovirt-engine.mydomain.otherstuff.com:443/ovirt-engine/" I am able to upload disk images when using http://ovirt-engine.mydomain.com but not able to http://ovirt-engine.mydomain.otherstuff.com I know it might be related to the certificates but I need to be able to upload disk images using both URLs. any ideas?

3 6

ovirt metrics - vm dashboard not working
by Jayme 03 Jun '19

03 Jun '19

I finally managed to get oVirt metrics store running. I loaded sample dashboards, searches and visualizations in to Kibana from /etc/ovirt-engine-metrics/dashboards-examples. When importing searches and visualizations there are warnings about missing index patterns. It appears that the "VM" dashboard is completely broken, no stats are showing on it at all including simple stats such as running VM count. The other two dashboards Hosts and System are working and showing all stats (sans VM count on the host dashboard). I believe I have a cash here of either missing indexes or potentially an issue with the example dashboards? I can see that collectd is running on all hosts and has the virt plugin loaded. What part of the config is responsible for suppling the VM information/indexes?

2 2