-
@olivierlambert It is a pleasure to help. I highly appreciate your teams work on making XCP-ng better and more secure as well as the support you give.
-
@stormi Only updated my test host so far, but all looks good to me.... no passthrough issues!!!
Will try and update my pool over the weekend and run some FreeBSD speed tests before and after (been waiting for that patch to make it out into the world).
-
@stormi said in Updates announcements and testing:
yum update bugtool-conn-tests kernel xcp-ng-release xcp-ng-release-config xcp-ng-release-presets xcp-python-libs xen-dom0-libs xen-dom0-tools xen-hypervisor xen-libs xen-tools xenserver-status-report --enablerepo=xcp-ng-testing
Updated both host in the pool (xcp-ng 8.2 fully patched), did my usual stuff and found no anomalities.
Looking good for me! -
Many thanks to all testers. The updates have been published on Friday, along with the blog post: https://xcp-ng.org/blog/2021/02/26/february-2021-security-updates/
-
Updating my pool now.... quite a substantial speed increase on FreeBSD
root@FILE001:~ # iperf -s ------------------------------------------------------------ Server listening on TCP port 5001 TCP window size: 64.0 KByte (default) ------------------------------------------------------------ [ 4] local 10.10.1.125 port 5001 connected with 10.10.1.126 port 42952 [ ID] Interval Transfer Bandwidth [ 4] 0.0-10.1 sec 694 MBytes 576 Mbits/sec ^Croot@FILE001:~ # iperf -c 10.10.1.126 ------------------------------------------------------------ Client connecting to 10.10.1.126, TCP port 5001 TCP window size: 105 KByte (default) ------------------------------------------------------------ [ 3] local 10.10.1.125 port 50605 connected with 10.10.1.126 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-10.0 sec 202 MBytes 169 Mbits/sec root@FILE001:~ # iperf -c 10.10.1.126 ------------------------------------------------------------ Client connecting to 10.10.1.126, TCP port 5001 TCP window size: 80.8 KByte (default) ------------------------------------------------------------ [ 3] local 10.10.1.125 port 45072 connected with 10.10.1.126 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-10.0 sec 4.06 GBytes 3.49 Gbits/sec root@FILE001:~ # iperf -s ------------------------------------------------------------ Server listening on TCP port 5001 TCP window size: 64.0 KByte (default) ------------------------------------------------------------ [ 4] local 10.10.1.125 port 5001 connected with 10.10.1.126 port 47101 [ ID] Interval Transfer Bandwidth [ 4] 0.0-10.0 sec 2.17 GBytes 1.86 Gbits/sec ^Croot@FILE001:~ # -
It's testing time again!
We changed the way we build the guest tools ISO and so we need as much feedback as we can get regarding the new guest tools. The main goal is to look for regressions. Details and feedback on https://xcp-ng.org/forum/topic/4378/new-guest-tools-iso-for-linux-and-freebsd-can-you-help-with-the-tests.
-
New security updates to test for 8.1 and 8.2
New update candidates are available for testing and due to be released as official updates very soon, as is usually the case for security updates.
- kernel security and bugfix update, prevents DoS attacks from the guests and brings fixes to event handling.
- openvswitch security update, prevents malicious network traffic to cause packets to be dropped.
- Fixed
ixgbedriver to avoid the memory leaks discussed at https://xcp-ng.org/forum/topic/2507/alert-control-domain-memory-usage
Test on XCP-ng 8.2
yum clean metadata --enablerepo=xcp-ng-testing yum update kernel openvswitch openvswitch-ipsec intel-ixgbe --enablerepo=xcp-ng-testing rebootNote: this won't update
openvswitch-ipsecif not present on the system, that is, unless you're using XO's private networks.Test on XCP-ng 8.1
This will be the last security update for XCP-ng 8.1, whose end of life is officially today, March 31st.
yum clean metadata --enablerepo=xcp-ng-testing yum update kernel openvswitch openvswitch-ipsec intel-ixgbe --enablerepo=xcp-ng-testing rebootWhat to test
The main goal is to avoid obvious regressions, so test whatever you want. The closer to your actual use of XCP-ng, the better.
Note: as the the code for event handling was changed, pay special attention to network performance in VMs, especially FreeBSD VMs since they are outside the scope of Citrix testing.
Test window before official release of the updates
Between 24h and 48h.
-
@stormi Successfully updated my two host playlab (8.2.0 full patched, but with the new guest tools ISO). Rebooted both hosts and ran my usual test program (create, live migrate (without (only Debian) and with guest-tools installed (Debian 10 and Windows 10) avoiding the
VM_LACKS_FEATUREerror on Windows 10 - more sleep this time
), copy and delete as well as create / revert to snapshot (with/without ram) and (live/halted=shutdown) storage migration remote to local SR and back). Also restored a Debian 10 VM from a pre-update backup with no problem. Looks good 
. Will see how backup runs tonight, but I am confident that this will work as well.Edit #1: typos
Edit #2: Thanks to Xen Orchestra, out-of-band management even for Optiplex 9010s, a notebook and a very nice evening on the balcony, I extended my tests to Ubuntu 20 LTS. And you might guess it - works as well
Edit #3: Deleted a subsequent post on an
asyncMap is not definederror because it is not related to the security update. -
This post is deleted! -
Tested new security patches on 8.2.
Network performance seems just fine. Have 4 Windows server 2019 and 2 Fedora Server VMs recording video feed. Haven't observed any difference in performance.
Supermicro SYS-1029U-TR4 with 768gig ram.
Network usage: about 400mbps constant.
ZFS -
Only updated one host in my pool so far, but it has my TrueNAS VM and network performance looks comparable
edit:
Actually quite an improvement in comparison to my results above
root@FILE001:~ # iperf -c 10.10.1.126 ------------------------------------------------------------ Client connecting to 10.10.1.126, TCP port 5001 TCP window size: 80.8 KByte (default) ------------------------------------------------------------ [ 3] local 10.10.1.125 port 35576 connected with 10.10.1.126 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-10.1 sec 6.30 GBytes 5.36 Gbits/sec root@FILE001:~ # iperf -s ------------------------------------------------------------ Server listening on TCP port 5001 TCP window size: 64.0 KByte (default) ------------------------------------------------------------ [ 4] local 10.10.1.125 port 5001 connected with 10.10.1.126 port 54773 [ ID] Interval Transfer Bandwidth [ 4] 0.0-10.0 sec 3.57 GBytes 3.06 Gbits/secAlso done a VM reboot now and no passthrough issues
-
Just in time
Updates now published: https://xcp-ng.org/blog/2021/04/01/april-2021-1st-security-bugfixe-update/
-
@stormi Security updates on April 1st
-
@jmccoy555 Yeah. Install them today and they'll turn your hosts into VMware.
-
@stormi Isn't that a virus, not a bug fix????
-
-
New xsconsole fix to test for 8.2
New update candidate are available for testing and due to be released as official updates.
Original topic:
yum clean metadata --enablerepo=xcp-ng-testing yum update xsconsole --enablerepo=xcp-ng-testing systemctl restart xsconsole.serviceWhat to test
Changing the DNS settings from the XSConsole and the change is retain after a reboot.
-
@benjireis said in Updates announcements and testing:
What to test
Changing the DNS settings from the XSConsole and the change is retain after a reboot.
And, of course, as usual, that you don't notice any obvious regression in XSConsole.
-
@stormi Did not even know the problem existed
. Anyway, added a new (second) DNS server (9.9.9.9) to the DNS server list via xsconsoleand rebooted the host (XCP-ng 8.2.0 fully patched).Before update: DNS 9.9.9.9 did not persist, only the previous settings are shown
After update: DNS 9.9.9.9 did persist the reboot and is listed together with the previous settingsDeleting DNS 9.9.9.9 worked as well, so the
xsconsoleupdate worked for me. -
IIRC, it's on old problem reported a long time ago to Citrix. But they never fixed it.
edit: and thanks again @gskger for your tests, it matters a lot!
