<div dir="ltr">I suspect this has something to do with macspoofing because I found that I was able to start a guest by changing the virtual network interface profile to remove network filtering. I verified the guests are able to start with filtering enabled on the vnic profile if it is set to false in engine-config and ovirt-engine service bounced. I'd prefer to leaf macspoofing disabled globally and only enable for things like VRR, CARP; but I'll have to leave it enabled for now. Could it be that the macs of the imported guests, being from the foreign mac pool, are being blocked by an ebtables policy? I wonder if I add their Ethernet range to the pools of the gaining Manager...</div><br><div class="gmail_quote"><div dir="ltr">On Fri, Nov 18, 2016 at 9:35 PM Kenneth Bingham <<a href="mailto:w@qrk.us">w@qrk.us</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="gmail_msg"><div class="gmail_msg">I imported a guest from its iscsi storage domain and clicked the green UP button, but the guest failed to start. This was the first time vdsm tried to create a temporary storage domain for a host other than hosted_engine. I'm using the same chap credential that was used with the same iscsi storage domain with the old instance of Manager. It looks like it wasn't able to get permission to do something, but everything was set up with sudo-as-root. I used CentOS 7.2 with the ovirt-release repository and hosted-engine script to deploy Manager.</div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">From /var/log/vdsm/vdsm.log on the host where it tried to start:</div><div class="gmail_msg"><font face="monospace" class="gmail_msg">Thread-23385::ERROR::2016-11-19 02:12:41,907::vm::765::virt.vm::(_startUnderlyingVm) vmId=`c3125d32-ae2a-4d2f-af4c-13661d90ddf9`::<b class="gmail_msg">The vm start process failed</b></font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg">Traceback (most recent call last):</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> File "/usr/share/vdsm/virt/vm.py", line 706, in _startUnderlyingVm</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> self._run()</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> File "/usr/share/vdsm/virt/vm.py", line 1996, in _run</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> self._connection.createXML(domxml, flags),</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> File "/usr/lib/python2.7/site-packages/vdsm/libvirtconnection.py", line 123, in wrapper</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> ret = f(*args, **kwargs)</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> File "/usr/lib/python2.7/site-packages/vdsm/utils.py", line 917, in wrapper</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> return func(inst, *args, **kwargs)</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> File "<b class="gmail_msg">/usr/lib64/python2.7/site-packages/libvirt.py</b>", line 3611, in <b class="gmail_msg">createXML</b></font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> if ret is None:raise libvirtError('virDomainCreateXML() failed', conn=self)</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg">libvirtError: internal error: <b class="gmail_msg">Could not get access to ACL tech driver 'ebiptables'</b></font></div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg"><div class="gmail_msg">From <span style="font-family:monospace" class="gmail_msg">/usr/lib64/python2.7/site-packages/libvirt.py which raised the error:</span></div><div class="gmail_msg"><font face="monospace" class="gmail_msg">def createXML(self, xmlDesc, flags=0):</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> """Launch a new guest domain, based on an XML description similar</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> to the one returned by virDomainGetXMLDesc()</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> This function may require privileged access to the hypervisor.</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> The domain is not persistent, so its definition will disappear when it</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> is destroyed, or if the host is restarted (see virDomainDefineXML() to</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> define persistent domains).</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> </font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> If the VIR_DOMAIN_START_PAUSED flag is set, the guest domain</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> will be started, but its CPUs will remain paused. The CPUs</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> can later be manually started using virDomainResume.</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> </font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> If the VIR_DOMAIN_START_AUTODESTROY flag is set, the guest</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> domain will be automatically destroyed when the virConnectPtr</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> object is finally released. This will also happen if the</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> client application crashes / loses its connection to the</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> libvirtd daemon. Any domains marked for auto destroy will</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> block attempts at migration, save-to-file, or snapshots.</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> </font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> virDomainFree should be used to free the resources after the</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> domain object is no longer needed. """</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> ret = libvirtmod.virDomainCreateXML(self._o, xmlDesc, flags)</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> if ret is None:raise libvirtError('virDomainCreateXML() failed', conn=self)</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> __tmp = virDomain(self,_obj=ret)</font></div><div class="gmail_msg"><font face="monospace" class="gmail_msg"> return __tmp</font></div></div><div class="gmail_msg"><br class="gmail_msg"></div></div></blockquote></div>