1. Home
  2. XCP-ng

Subcategories

  • All Xen related stuff

    622 Topics
    6k Posts
    K
    Filed both XO related issues: Memory visibility at VM creation: https://github.com/vatesfr/xen-orchestra/issues/10225 domain_crash invisible in XO: https://github.com/vatesfr/xen-orchestra/issues/10226 Linking to this thread as promised earlier, thanks all. Hope this helps someone out.

  • The integrated web UI to manage XCP-ng

    30 Topics
    380 Posts
    tjkreidlT
    More options: to Prevent overwriting the file: Method 1: Probably the best option. Use a Configuration Directory. Modern OpenSSH versions (8.2+) support an include directive. This is the cleanest approach. Create a drop-in file: Put your custom settings in a separate file, such as /etc/ssh/sshd_config.d/custom.conf. The rule: Package updates will not touch files inside this directory. Verification: Ensure the line Include /etc/ssh/sshd_config.d/*.conf is active at the top of your main /etc/ssh/sshd_config file. Method 2: Lock the File (Alternative) You can force the filesystem to make the file immutable so nothing can change it. Lock the file: Run sudo chattr +i /etc/ssh/sshd_config Unlock for edits: Run sudo chattr -i /etc/ssh/sshd_config when you need to make intentional changes. Method 3: Tell Apt to Ignore Updates. If you are on a Debian-based system, you can force the package manager to always keep your local version. Add this line to /etc/apt/apt.conf.d/local: UCF_FORCE_CONFFOLD=true

  • Section dedicated to migrations from VMWare, HyperV, Proxmox etc. to XCP-ng

    128 Topics
    1k Posts
    acebmxerA
    If i recall from my migration I belive thats all there is to it. I know the docs mention about doing a test migration but mine just migrated and it just worked as you stated after making the needed adjustments. Let other chime in but i think you are good to go. And you could delete the snapshot from the vm.

  • Hardware related section

    174 Topics
    2k Posts
    olivierlambertO
    Very cool, thanks for the feedback @maximsachs !

  • The place to discuss new additions into XCP-ng

    254 Topics
    3k Posts
    DanpD
    @rvreugde I believe this is already being reviewed internally.
Log in to post
Load new posts
  • B

    Get a price quote on a plan

    2
    0 Votes
    2 Posts
    37 Views
    DanpD
    Hi, I found your original request. I will make sure someone from the Sales team responds ASAP. Regards, Dan
  • O

    VM autostart stopped working

    Unsolved
    5
    0 Votes
    5 Posts
    178 Views
    poddingueP
    My earlier wording was the problem here, not your reading of it. There are two official descriptions and they do not say the same thing. The CLI reference calls start-delay "the delay to wait before a call to start up the VM returns", which is the one I quoted. The XenAPI field description calls it "the delay to wait before proceeding to the next order in the startup sequence". That second one is exactly what you saw: the delay lands on the next VM to start, not on the one you set it on. I quoted the confusing one and then said it explained your behaviour, which it does not really. What I still cannot explain is why a start-delay would stop a VM autostarting altogether. Neither wording predicts that, so I would rather say I do not know than invent a reason. On auto_poweron_delay, I went looking and could not find it anywhere in the XCP-ng or XO docs, so I think your instinct about that search result was right. I have updated the docs PR I had open so it leads with the XenAPI wording and cites both, since the CLI reference phrasing is what sent me wrong in the first place.
  • D

    Autostart behaviour after upgrade 8.2 -> 8.3

    Unsolved
    4
    1
    0 Votes
    4 Posts
    121 Views
    poddingueP
    Thanks for coming back with the actual cause instead of leaving it hanging. To me, a permissions reset on /etc/rc.d/rc.local would explain it completely, and it fails in the worst way, since nothing complains at boot and the VMs just never start. It also looks worth documenting, because our own troubleshooting page tells people to append a clocksource workaround to /etc/rc.local without mentioning the executable bit either, so anyone following that could end up with a workaround that quietly does nothing. I haven't tested whether the 8.2 to 8.3 upgrade resets that bit every time or just happened to in your case, so that half stays your finding, not mine. I'm curious what you turn up on the colon versus equals behaviour.
  • jerry1333J

    CPU Usage of empty server

    Unsolved
    15
    3
    0 Votes
    15 Posts
    1k Views
    marcoiM
    i think im seeing the same with fake cpu spikes. I started a second pool yesterday to patch and left it on over night. typically i just shut it down once done so the servers dont get too far behind patching. Under the pool stats im seeing spikes but under hosts nothing. It doesnt really bother me, but figure i add to the thread that im also seeing it. [image: 1784817154694-c75fecec-d618-4f05-a931-edea6bc6ecce-image-resized.jpeg] [image: 1784817189696-1b9ea5aa-d349-4ff8-af89-30a970d36fbb-image-resized.jpeg] [image: 1784817219194-0f579999-cd96-4216-a0d4-d637ea5febf1-image-resized.jpeg]
  • B

    The Lowest Priority Bug Ever? (/etc/udev/rules.d/z10-xen-vcpu-hotplug.rules)

    Unsolved
    10
    0 Votes
    10 Posts
    2k Views
    poddingueP
    Two PRs out of the lowest priority bug ever, that made my morning.
  • henri9813H

    Unable to live migrate VM between 2 local storages SR

    Solved
    5
    0 Votes
    5 Posts
    409 Views
    poddingueP
    I converted the topic to a question, then marked it solved. Thanks!
  • M

    HOST_NOT_ENOUGH_FREE_MEMORY during host.restart / host-evacuate despite destination having ample free RAM

    5
    0 Votes
    5 Posts
    699 Views
    gthvn1G
    PRs upstream are in review
  • T

    Can't restart stopped VMs; unclear error message

    8
    0 Votes
    8 Posts
    712 Views
    acebmxerA
    @the_jest Not showen in this picutre but this is where the message would be displayed. Next to the name of the host... [image: 1782931263879-screenshot-2026-07-01-144023.png]
  • N

    Start: no host available?

    9
    2
    0 Votes
    9 Posts
    1k Views
    olivierlambertO
    For your storage question, it's fully explained in the doc: https://docs.xcp-ng.org/storage/#-how-to-modify-an-existing-sr-connection And yes, it's planned to get the complete error visible in XO, sadly, it's not "obvious" since the error message isn't returned by XAPI when you try to start but by another method we need to call after it fails ("assert can be started here" from the top of my head). Let me ping @julienXOvates
  • N

    14 VMs Running: After Pool patch update - message states I need to restart to take effect?

    9
    0 Votes
    9 Posts
    1k Views
    N
    @Danp said: Smart Reboot option found on the host's Advanced tab does what you are asking Very nice!
  • AlexanderKA

    xcp-ng update to latest june patch - error - requires: perl-interpreter

    2
    0 Votes
    2 Posts
    363 Views
    bleaderB
    @AlexanderK you could try to install perl-interpreter manually maybe? I happened to have a test host at hand that hasn't been updated since december, and the yum update went fine, perl interpreter was not installed before and yum update did install it on its own as a depency for openssl 3. Maybe others will have ideas as to why this would happen in your case.
  • R

    cifs-utils LPE (CVE-2026-46243) / 8.3 dom0 vulnerability inquiry

    5
    0 Votes
    5 Posts
    1k Views
    R
    Closing the loop on this one — VSA-2026-021 went up yesterday (June 10) covering CIFSwitch / CVE-2026-46243: https://docs.vates.tech/security/advisories/2026/vates-sa-2026-021 A few things worth flagging for anyone following along: Severity landed at Moderate 🟠 — same ballpark as CopyFail/DirtyFrag, as Lucien anticipated. XCP-ng 8.3 and XOA both confirmed affected. XCP-ng 8.3 fix isn't in the main repo yet. The advisory notes there's a publicly available package with the fix, but it's not in the standard channel — Vates is asking people to reach out for the install procedure so you don't break future Rolling Pool Updates. So don't go hand-rolling the kernel commit yourself if you want to stay on the RPU path. XOA is already handled — fixed in Debian kernel 6.1.174-1, pushed via the unattended update mechanism. Just note the XOA VM needs a restart for it to take effect, and anything older than Debian 11/12 won't get the update and needs an OS upgrade first. Mitigation is unchanged from what we discussed: blacklist the cifs module if you're not using SMB-based SRs (which breaks SMB SRs, so only if you don't rely on them). Good turnaround given the disclosure-to-advisory window. Thanks again @LucienLassalle and the security team.
  • B

    Adding new host to pool fails - Stunnel SSL certiticate verification failure

    Solved
    16
    0 Votes
    16 Posts
    2k Views
    LucienLassalleL
    @Bryanvh No problem The issue you encountered wasn't very clear. Therefore, I've proposed a change to the XAPI to make the error more explicit (this will likely be implemented in future XAPI releases). So instead of SSL Certification failure the message will be: POOL_JOINING_MASTER_CERTIFICATE_NOT_IN_POOL_BUNDLE. Thank you very much for your patience and for bringing this issue to our attention. References: https://github.com/xapi-project/xen-api/pull/7112
  • S

    Ubuntu 24.04 VMs not reporting IP addresses to XCP-NG 8.2.1

    13
    5
    0 Votes
    13 Posts
    5k Views
    olivierlambertO
    Because it works already better than the GO tool from Citrix… There's no urgent fix to do, I personally use it in my production since it's available. It's just less a priority for extra features because it's already ultra stable. Right now, we choose to work in priority on XCP-ng 9.0 than the Rust tools, we can't do everything at once yet.
  • J

    [Solved] SR_SOURCE_SPACE_INSUFFICIENT - Problems enabling HA

    Solved
    10
    0 Votes
    10 Posts
    1k Views
    J
    @olivierlambert Thanks again for your input and recomendations! I'll verify that this is solved by having the LUN expanded to 8GB instead. Afterwards I'll mark your answer as the solution!
  • ForzaF

    Citrix or XCP-ng drivers for Windows Server 2022

    19
    0 Votes
    19 Posts
    9k Views
    ForzaF
    @iams3le we have switched to the signed xcp-ng drivers. We also replaced our older 2022 servers.
  • D

    xe-gues-utilities woes on openSUSE Leap 16

    8
    0 Votes
    8 Posts
    935 Views
    D
    @MajorP93 that’s fine - I never use ballooning anyway so I guess I am covered good
  • M

    log_fs_usage / /var/log directory on pool master filling up constantly

    21
    1
    0 Votes
    21 Posts
    4k Views
    poddingueP
    The sr.scan-driven SMlog growth angle that gumbo2k surfaced is a real lead; there's some context in the storage-related log files reference, but the docs don't go as far as "here's how to throttle it safely on a pool where the underlying disks should spin down." Soft ping to @Team-Storage and @Team-Hypervisor-Kernel: could one of you weigh in on whether other-config:auto-scan=false on the SR is the supported way to reduce scan pressure, or if there's a better lever? I don't want to send anyone down a path that breaks an SR. Apologies if this has already been answered somewhere I haven't seen.
  • rvreugdeR

    XOA vulnerabilty to "copy fail" and "dirty frag" bug

    8
    0 Votes
    8 Posts
    2k Views
    R
    Quick update now that Vates has published their official advisory. First, kudos to the Vates security team for the thorough and timely response. VSA-2026-014 is well-documented and covers the full picture, including a third CVE I had not covered in my earlier posts. VSA-2026-014 confirms what I outlined above: XCP-ng is affected by CVE-2026-43284 (XFRM-ESP) and is NOT affected by CVE-2026-43500 (no RxRPC support). The CVE I had missed: CVE-2026-46300 ("Fragnesia") also affects XCP-ng via the XFRM ESP-in-TCP subsystem. The same esp4/esp6 blacklist mitigation applies, with the same caveat @semarie raised: it will break encrypted private networks on XCP-ng. Now that the VSA and official mitigation guidance are public, I'm releasing the diagnostic script I built. It's Python 3.6, no external dependencies, safe to run on production dom0. It tests whether an unprivileged process can engage the esp4 engine via the XFRM interface inside a user namespace — without touching any exploit code. Since both CVE-2026-43284 and CVE-2026-46300 (Fragnesia) require esp4 or esp6 to be reachable from an unprivileged namespace, and share the same mitigation, a positive result confirms exposure to both. Blacklist esp4/esp6, then run the script again — ACCESS DENIED means both CVEs are mitigated. One important note before running it: please read the code before executing it on any of your systems. This is good practice with any script from the internet, regardless of the source. The code is intentionally short and straightforward so you can review it quickly and satisfy yourself that it does exactly what it says. VSA-2026-014: https://docs.vates.tech/security/advisories/2026/vates-sa-2026-014/ Diagnostic tool: https://github.com/grabesec/XCP_ng_CVE-2026-43284_tester A kernel patch from Vates is in progress. Apply as soon as it lands.
  • P

    Windows Xen Guest Agent (Rust-based) - Not reporting the IP address to Xen Orchestra

    8
    0 Votes
    8 Posts
    2k Views
    I
    @yomeyo I had this also, but problem disappeared itself. https://github.com/xcp-ng/xcp/issues/793 [image: a3dcbb0b-fe7a-4389-addc-247190039a18]