- Users - oVirt List Archives

import VM from Qemu-KVM
by Enrico Becchetti 15 Dec '25

15 Dec '25

Dear all, I've a question about import VM from an external hypervisor. My oVirt is 4.3: N. 3 Dell R7525 servers with CentOS 7 SAN BROCADE and HPE MSA P 2050 (domain: DATA_FC_P2050) 10Gbps network, NFS Server (domain: NFS) I need to import a virtual machine running on a Qemu-KVM server into ovirt. The file type is qcow2, about 100GB. I tried with GUI "Storage->Disk->Upload" but I've got an error: "Connection to ovirt-imageio-proxy service has failed. Make sure the service is installed, configured, and the ovirt-engine certificate is registered as a valid CA in the browser." Can you tell me the correct sequence for this operation and for importing and running the virtual machine in ovirt? Thanks a lot Best Regards Enrico -- __________________________________________________________________________ Enrico Becchetti Servizio di Calcolo e Reti Istituto Nazionale di Fisica Nucleare - Sezione di Perugia Via Pascoli,c/o Dipartimento di Fisica 06123 Perugia (ITALY) Phone:+39 075 5852777 Mobile: +39 075 9696225 FAX: +39 075 5847296 Microsoft Teams: becchett(a)infn.it Mail: Enrico.Becchetti<at>pg.infn.it Pagina web personale: https://www.pg.infn.it/home/enrico-becchetti _________________________________________________________________________

2 2

swtpm
by Winfried de Heiden 12 Dec '25

12 Dec '25

Hi all, I'm currently running oVirt 4.5.7 and added a (virtual) tpm2 device to one of my VM's for the sake of experimenting with tpm2 and it's commands. Experimenting means breaking stuff :) and I need to reset the tpm device on a regular base. Using kvm and virsh; this is fairly easy: "rm -rf /var/lib/libvirt/swtpm/$(virsh domuuid tpm2)/tpm2" will do to start with a new virtual tpm device. On oVirt, how can I reset (destroy, create new one) the virtual tpm device? Thanks! Winfried

1 0

Installing oVirt 4.5 on RHEL 9 (Offline / NIST 800-53 Compliance)
by Rockwell, Jenn - US 11 Dec '25

11 Dec '25

Hi all, I’m working on setting up production oVirt 4.5 with a self-hosted engine on RHEL 9 in an offline, NIST 800-53 environment. The server does not have internet access, but I can download repositories and packages separately and hand transfer them over. I’ve looked through the available documentation, but aside from https://www.ovirt.org/download/install_on_rhel.html, I haven’t found details on which additional repositories (RHEL, oVirt, dependencies, etc.) are required for a full installation. I’m looking for guidance on the best approach for this type of setup. Ideally, whether there’s a simpler or supported method to get a self-hosted engine running in an offline environment without having to mirror all repositories manually. Thanks in advance for any advice or pointers. Cheers ________________________________ This electronic message contains information from CACI International Inc or subsidiary companies, which may be company sensitive, proprietary, privileged or otherwise protected from disclosure. The information is intended to be used solely by the recipient(s) named above. If you are not an intended recipient, be aware that any review, disclosure, copying, distribution or use of this transmission or its contents is prohibited. If you have received this transmission in error, please notify the sender immediately.

5 4

Need advice with 3 servers and 1 SAN
by provensen＠aol.com 11 Dec '25

11 Dec '25

I am new to oVirt, and I am trying to find the right solution for my LAN. On an air-gapped network, I have 3 Dell PowerEdge servers running Alma Linux 9 and 1 IBM SAN. I have 3 iSCSI connections from the IBM SAN to the 3 Dell servers. I am looking to install oVirt as 3 Enterprise Linux hosts on the 3 Dell servers. I need the 3 Enterprise Linux hosts to have shared storage, so all 3 hosts can access all of the virtual machines. I need the storage to have high availability, so if 1 host goes down the virtual machines can run on the other hosts. Which kind of storage do I use for this? NFS, iSCSI, cluster...etc? Also, do I connect the IBM SAN to only 1 host, and share that IBM SAN storage with the other 2 hosts, or would I create 3 separate iSCSI connections to each host? I would really appreciate any assistance from anyone. Thank you.

5 4

Unable to upload or download iso via admin portal
by Igor Filipovic 09 Dec '25

09 Dec '25

Hi, I'm having a trouble on fresh 4.4.10.7 installation (on oracle linux), I'm not able to upload or download any file using storage domain upload image function. I've imported CA certificate and have tried on several browsers (firefow, chrome,edge), on different computers (and browsers are green - claiming that I'm securely connected), but I'm always getting error regarding CA certificate when I test connection, or when I try to upload ISO image. I've tried to upload ISO image via cli commands (upload_disk.py), and that scenario was successful, however this method It is not very convenient for my co-workers. I have 5 physical hosts, one is dedicated to run ovirt-engine, and other 4 are kvm hypervisors. When I try to upload ISO this is what engine.log logs: 2023-04-08 11:00:28,339+02 INFO [org.ovirt.engine.core.bll.storage.disk.image.TransferImageStatusCommand] (default task-2) [f6b62add-0a0c-45ee-a985-a76171843382] Running command: TransferImageStatusCommand internal: false. Entities affected : ID: 1eb97088-b805-4616-af55-0ac9d1d7dfbe Type: SystemAction group CREATE_DISK with role type USER 2023-04-08 11:00:28,340+02 INFO [org.ovirt.engine.core.bll.storage.disk.image.ImageTransferUpdater] (default task-2) [f6b62add-0a0c-45ee-a985-a76171843382] Updating image transfer a78b18c5-e395-4c29-aa5c-15ffff8a1cb6 (image 4f758325-ac11-4071-a9fa-d180425e8604) phase to Paused by System (message: 'Sent 0MB') 2023-04-08 11:00:28,363+02 ERROR [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-2) [f6b62add-0a0c-45ee-a985-a76171843382] EVENT_ID: UPLOAD_IMAGE_NETWORK_ERROR(1,062), Unable to upload image to disk 4f758325-ac11-4071-a9fa-d180425e8604 due to a network error. Ensure ovirt-engine's CA certificate is registered as a trusted CA in the browser. The certificate can be fetched from https://engine-dr.somedomain/ovirt-engine/services/pki-resource?resource=ca… 2023-04-08 11:00:28,363+02 INFO [org.ovirt.engine.core.bll.storage.disk.image.TransferImageStatusCommand] (default task-2) [f6b62add-0a0c-45ee-a985-a76171843382] Running command: TransferImageStatusCommand internal: false. Entities affected : ID: 1eb97088-b805-4616-af55-0ac9d1d7dfbe Type: SystemAction group CREATE_DISK with role type USER Can you please point me in some direction to try to fix this? Thanks, and best regards Igor

5 5

PoSh-oVirt Windows PowerShell Module
by itsavant＠gmail.com 03 Dec '25

03 Dec '25

For System Engineers managing ovirt or OLVM from Windows PoSh-oVirt is officially available on the Oracle github samples website. https://github.com/oracle-samples/posh-ovirt

2 1

"400 Bad request" error logging in
by Dan O'Brien 19 Nov '25

19 Nov '25

This is even more mysterious now that I've discovered it's only a problem for ME and only when I'm logged in to Chrome. Safari and Edge work, and so does a Chrome private browsing window. Nonetheless, there seems to be a fix on the server side, if I'm correct. After entering credentials on the logon screen (internalsso), I get a "400 Bad Request" error in the browser and I'm seeing these errors in /var/log/httpd/error_log: [Wed Nov 19 14:37:04.988719 2025] [proxy_ajp:error] [pid 2364:tid 2392] AH03229: ajp_msg_append_cvt_string(): BufferOverflowException 4 8159 I found this post on the list https://lists.ovirt.org/archives/list/users@ovirt.org/thread/K4MBGS3ZD4LK6S… and these in the Red Hat knowledge base (must log in to view) https://access.redhat.com/solutions/1525873 https://access.redhat.com/solutions/732343 (for JBoss 6) https://access.redhat.com/solutions/6166212 (For JBoss 7, which I think oVirt 4.5 uses) The solution is to change a couple of settings in httpd.conf (or in httpd.conf.d): LimitRequestFieldsize 65536 ProxyIOBufferSize 65536 There's a corresponding setting that needs to be changed in JBoss/Wildfly. I think the standalone.xml file referred to in the KB articles is in /usr/share/ovirt-engine-wildfly/standalone/configuration Can someone confirm? Also, is oVirt 4.5 (4.5.7-0.master.20251029141850.git6e58a03353.el9, specifically) using 6 or 7? Running ./jboss-cli.sh from /usr/share/ovirt-engine-wildfly/bin fails with the error Failed to connect to the controller: The controller is not available at localhost:9990: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://localhost:9990. The connection failed: WFLYPRT0053: Could not connect to remote+http://localhost:9990. The connection failed: Connection refused Is it listening on another port? I tried ./jboss-cli.sh --version but it wants to be connected

1 0

certs expired, now engine won't start
by Michael Thomas 18 Nov '25

18 Nov '25

I seem to have gotten myself into a bit of a pickle. My ovirt host certs (4-node 4.4.1 cluster) expired recently and I didn't notice until one of my hosts got fenced on Friday. I was finally able to get it back online by rebooting, telling the ovirt-engine the host had been rebooted (so that it didn't think VMs were running on it), and then going into maintenance mode and 'enroll certificates' to renew the certs. This worked with the second host as well. But I was unable to put the third host into maintenance mode because the engine claimed "Another power management action is already in progress". Sure enough, the task list showed the engine trying to take action against this host. It was stuck in that state for over an hour, so I finally poked the ovirt-engine database directly to fail these tasks: psql engine -c "UPDATE job SET status = 'FAILED', end_time = NOW() WHERE status NOT IN ('FINISHED', 'FAILED');" psql engine -c "UPDATE step SET status = 'FAILED', end_time = NOW() WHERE status NOT IN ('FINISHED', 'FAILED');" This got the tasks to clear, but the engine UI still claimed that the stuck host still had "Another power management action is already in progress". Then I made the fatal mistake of rebooting the ovirt-engine (which was still running on the fourth host with expired certs). Now my engine won't start, even when I try to start it on one of the host that had certs renewed. The libvirt logs indicate that it's because the vnc cert is expired: qemu-kvm: -object tls-creds-x509,id=vnc-tls-creds0,dir=/etc/pki/vdsm/libvirt-vnc,endpoint=server,verify-peer=no: The server certificate /etc/pki/vdsm/libvirt-vnc/server-cert.pem has expired Since I don't care about vnc access to the engine, is there a way to get the engine running again without vnc? Alternately, is there a way that I can manually get some of the more critical VMs running without an engine running? FWIW, I tried searching the list archives, but I get a 500 server error when trying to go to lists.ovirt.org. --Mike

2 1

oVirt and iSCSI storage
by Dan O'Brien 17 Nov '25

17 Nov '25

TL;DR: I’d like to better understand iSCSI “connections” versus oVirt iSCSI multipath bonds. Also how oVirt caches iSCSI connection information and credentials. I’m standing up a new cluster that will replace an aging cluster running oVirt 4.3 on CentOS 7 hosts and GlusteFS storage. I’ve cleared most of the milestones I need to proceed with migrating the VMs, but I’m struggling a bit with the interaction of oVirt’s networking and the iSCSI storage for the new cluster. The new cluster is Rocky 9.6 hosts, and oVirt installed from the master snapshot on 10/31/2025. My storage for the new cluster is using the Ceph iSCSI gateway (2 hosts, 1 iSCSI target, 1 IP from each assigned as portal). I have a dedicated VLAN for iSCSI traffic (VLAN 42: 192.168.42.0/24). I removed one of the hosts from the old cluster (Dell PowerEdge R620) and have used it to seed the new cluster with the self-hosted engine. I have 2 Ceph hosts running the iSCSI gateway on VLAN 42 assigned IPs .85 and .88. During the deployment of the hosted engine, I’m prompted for the storage and I used 192.168.42.88 as the iSCSI portal and logged in to the target and the deployment succeeded. I had a LUN on the iSCSI target for the hosted engine and the associated storage domain. For the deployment of the hosted engine, I had one NIC set up and assigned a static IP on our internal network (access port, no VLAN tagging). The ovirtmgmt logical network gets assigned to this and the hosted engine coexists happily with the host sharing the NIC in the same subnet. Before deployment, the host was set up with a bond of 2x10G ethernet ports in a LAG and a VLAN interface for VLAN 42. If I look at the host Network Interfaces after deployment, I can see the existing bond (bond0). The VLAN interface I created before deployment (bond0.42) is listed under Logical Networks, but is flagged as Unmanaged. Once in the UI, I created 2 additional Storage Domains (Data): one for ISOs and one for VMs using additional LUNs (backed by Ceph RBD images). The UI seems to have re-used the iSCSI connection set up for the hosted engine. I could see the LUNs I created for and was able to assign the LUNs to the storage domains (1x512Gb RBD for ISOs and 2x512Gb RBD for the storage domain). All of this is great, BUT I’m only using one of the iSCSI gateways. One option I have is to set up iSCSI multipathing in the datacenter. This doesn’t seem to be possible for two reasons: My storage network is being accessed by the unmanaged logical network, AND I need an ADDITIONAL VLAN using a different subnet to set up another logical network for the iSCSI multipath bond. This is a bit of a headache, but I think it’s doable after I add another host, and migrate the hosted engine so I can remove the unmanaged VLAN 42 from the bond and replace it with a managed logical network tagged with VLAN 42 and assigned an appropriate IP address. HOWEVER – I noticed on the storage domain, there’s a CONNECTIONS button. This shows a panel with an “Attached” connection to the iSCSI target and the portal address I specified during the hosted engine setup. After putting the ISOs storage domain in maintenance, I could add another connection with the second portal of the target (I’m not sure this actually did anything). When I tried to do this for the storage domain, I got an error that a connection already existed. Attempting discovery entering the IP address of one of the portals and the CHAP username/password doesn’t seem to work; I keep getting authentication failures even though I’m pretty sure I’m using the right credentials. So my questions: - What’s the difference between multiple “paths” and the multipathing set up in oVirt? - What information about the iSCSI connections is oVirt storing and how is it using it when you set up later storage domains? - Are multiple “paths” in the storage domain equivalent to the multipath bonds? I’d like to use the existing portals in my iSCSI VLAN and not have to set up another VLAN (which is not terrible, just inconvenient). - Is there a way of manipulating the iSCSI connection information after-the-fact? There's a warning in the docs that adding paths isn't supported, but it seems to only refer to the UI. Can it be done with the REST API or Ansible? Sorry for the long read. I've been using oVirt since I started at my present job and it's been solid. I appreciate the work you're doing keeping this project going. I'm looking forward to having a cluster with the latest software and retiring GlusterFS.

3 3

Reclaim Storage OLVM
by Đỗ Tài 11 Nov '25

11 Nov '25

I have a case with a customer. They are using the KVM/OLVM system because they do not enable discard after delete, so when deleting VM, they do not send the umap command to SAN Storage, so over time there is a difference between OLVM and SAN metadata. Specifically, on OLVM, it reports 8TB free but on SAN, it only reports 3TB free. SAN cannot reclaim 5TB free of OLVM because it is blocking under SAN because SAN understands that those blocks are in use. The first thing I did was enable discard after delete for the storage domain, but now I want to free up 5TB on OLVM so that SAN can reclaim that capacity, how do I do that?

1 0