@wtdrisco said in Hosts compatibility:

As I am starting to build an environment for testing to replace VMWare, I had a question related to hardware.

When setting up multiple hosts, do these need to match the same specs (like VMWare?) for HA (moving VMs from host to host)?

I have several DELL R series servers, and some do not have the exact same CPU model or one has less memory than the other.

When setting up (HOST POOLS??) if I needed to migrate VMs, will this support different host configurations?

If the the hosts don't match by close enough, especially if their capabilities (e.g. instruction sets) and specifications. Then in the case of capabilities then the non-matching ones will be suppressed by XCP-ng so that they all match. Also when migrating the specifications, of hosts really need to match so that when VMs are placed on the hosts. There's no issues when live migrating between the each of the pool member hosts.

As the VMs expect at least a certain number of cores dependent on the hosts, and the number specified per each VM. If this number isn't met then that VM can't migrate to a specific host, which don't meet or exceed it.

@ThierryC01 said in XCP-ng 8.3 betas and RCs feedback :

@bleader Update successful, no issue so far. There is just a message appearing when starting the update: "Delta RPMs disabled because /usr/bin/applydeltarpm not installed."

All VM working for now.

That's harmless. It's just notifying that the system doesn't have deltarpm package installed. This package reduces the size of updates based on what's already installed.

@still_at_work said in First SMAPIv3 driver is available in preview:

Hello @olivierlambert ,

I am joining this topic as I have a few questions about SMAPIv3:

• Will it allow provisioning of VDIs larger than 2TB?

• Will it enable thin provisioning on iSCSI SRs?

Currently, the blockers I encounter are related to my iSCSI storage. This is a major differentiating factor compared to other vendors, and resolving these blockers would significantly increase your market share.

Thanks !

@still_at_work The size limit of the VDI is due to the file format used for these, which is VHD (https://en.wikipedia.org/wiki/VHD_(file_format)). This format can't support more than 2TB, it's known about and are dealing with the issue. It will likely result in a change or addition of a new VDI format likely to be qcow2 unless necessary software for VHDX format is fully open sourced and software for Xen is created which enables create, read, write and use of this format.

It's not a limitation of iSCSI as it also emerges with both NFS and SMB based connections.

@jasonnix The Linux distribution operating system restricts certain commands, operations and/or path (location) to the root account, as well as the location owner.

The path your trying to write to is just one such location as the location is read only to non-root users. If you really wish to write to /usr/local/src then root account is required.

If you use the root account to install then the directory and the Xen Orchestra files will be owner by root. You would need to create a non-root user for the xen orchestra server process. As well as change ownership of the Xen Orchestra files and folders to that non-root account. Though at least the ones which Xen Orchestra should be able to modify as required, when needed.

As well as provide the necessary sudo permissions for the necessary commands to that account.

Using root account to run exposes any vulnerabilities present to the capacity of being exploited as root (aka Administrator) privileges.

Also how good is your internet connection and your connection to GitHub? Cause you could be experiencing a time out packet loss connection issue.

@olivierlambert I created the issue on GithHub. https://github.com/vatesfr/xen-orchestra/issues/7884

MrGrymReaper created this issue in vatesfr/xen-orchestra

open xo-server fix: Update acme-client npm and introduce support for External Account Binding (EAB) #7884

@peb2 said in XOA letsencrpyt module not setting acmeDomain:

Hello,

I'm new to Xen and XOA (migrating from Vmware) and I was wondering if anyone could help me with a problem.

I'm trying to use the Letsencrypt module as specified in:

https://github.com/vatesfr/xen-orchestra/blob/master/%40xen-orchestra/mixins/docs/SslCertificate.md?ref=xen-orchestra.com

However, the XOA doesn't seem to be passing the variable for 'acmeDomain' so I get a certificate without a CN.

Has anyone else seen this problem or know what my mistake may be?

Here's my /etc/xo-server/config.toml:

#=====================================================================

# HTTP proxy configuration used by xo-server to fetch resources on the
# Internet.
#
# See: https://github.com/TooTallNate/node-proxy-agent#maps-proxy-protocols-to-httpagent-implementations
#httpProxy = 'http://jsmith:qwerty@proxy.lan:3128'

# Configuration of the embedded HTTP server.
[http]
# If set to true, all HTTP traffic will be redirected to the first
# HTTPs configuration.

redirectToHttps = true

# Basic HTTP.
[[http.listen]]
# Port on which the server is listening on.
port = 80


# Basic HTTPS.
[https]
#
# You can find the list of possible options there https://nodejs.org/docs/latest/api/tls.html#tls.createServer
#
# The only difference is the presence of the certificate and the
# key.

hostname = '0.0.0.0'

[[http.listen]]
port = 443

# Whether to autogenerate a self signed certificate if the `cert` and `file`
# entries could not be found.
#
# Default: true
#autoCert = false
autoCert = true

# File containing the certificate (PEM format).
#
# If a chain of certificates authorities is needed, you may bundle
# them directly in the certificate.
#
# Note: the order of certificates does matter, your certificate
# should come first followed by the certificate of the above
# certificate authority up to the root.
#cert = '/etc/ssl/cert.pem'
cert = '/etc/ssl/xoa.cert.pem'

# File containing the private key (PEM format).
#
# If the key is encrypted, the passphrase will be asked at
# server startup.
#key = '/etc/ssl/key.pem'
key = '/etc/ssl/xoa.key.pem'

# ACME (e.g. Let's Encrypt, ZeroSSL) CA directory
#
# Specifies the URL to the ACME CA's directory.
#
# A identifier `provider/directory` can be passed instead of a URL, see the
# list of supported directories here: https://www.npmjs.com/package/acme-client#directory-urls
#
# Note that the application cannot detect that this value has changed.
#
# In that case delete the certificate and the key files, and restart the
# application to generate new ones.
#
# Default is 'letsencrypt/production'
acmeCa = 'zerossl/production'

# Domain for which the certificate should be created.
#
# This entry is required.
acmeDomain = 'xoa.mydomain.com'

# Optional email address which will be used for the certificate creation.
#
# It will be notified of any issues.
acmeEmail = 'myemail@mydomain.com'

The acmeDomain needs to be the actual Fully Qualified Domain Name (FQDN) which XOA uses. Also some verification and/or validation will need to be added either as a text file to the XOA appliance (in a web accessible directory) or as a DNS text record for XOA FQDN.

Also update the acmeEmail so its the actual email to be used for receiving the notification of issues. These don't look valid to me this is critical for them to be real, active and valid as the ACME Client uses these to send the certificate requests and renewals to the certificate authority!!

@andsmith said in 8.3 USB Passthrough - Win Server 2019 BSOD:

@dinhngtu Sorry, I failed to mention this is a Windows Server 2019 VM, it appears that Windbg is a Windows 10/11 application. I've googled installing on Server 2019, but haven't had any luck getting it installed.

Update the AppX Package Deployment software via Microsoft Store or its equivalent in Windows Server 2019. Then once winget is updated (or installed) run the following command:

winget install Microsoft.WinDbg

@olivierlambert If this works for andsmith then it may be worth documenting this, for future users of Windows Server 2019, 2022 and possibly if required the upcoming Windows Server 2025.

@lritinfra Are there any entries in the logs on the HPE iLO as its health monitoring may give you some clues?

Depending on maintenance for those problematic servers is it possible to run Intelligent Provisioning then have it perform the in depth tests of Insight Diagnostics tools?

The Insight Diagnostics tools will test all parts of the system hardware including, drives, memory, storage etc. Letting you know about any parts which fail these tests.

As well as more thoroughly than the non-in depth tests so is more likely to ferret out any hardware issues, as long as its up to date so it can notice any issues if and when firmware on hardware is tested.

@rfx77 said in Backup / Migration Performance:

@nikade the probmem wit XO is that you cannot use it if you have multi TB Fileservers or large Mail-Servers and you need Agents to backup Eg.: Oracle, SQL-Server,... . You have to have a backup-solution which integrates with your storage system so that you can attach iscsi volumes directly in the vm.

@rfx77 said in Backup / Migration Performance:

@nikade the probmem wit XO is that you cannot use it if you have multi TB Fileservers or large Mail-Servers and you need Agents to backup Eg.: Oracle, SQL-Server,... . You have to have a backup-solution which integrates with your storage system so that you can attach iscsi volumes directly in the vm.

The issue with the multi terabyte virtual disks is due to a limitation of the Xen hypervisor (along with the software stack) and its use of VHD format disk images. Which are limited to 2 TB per disk image, which can be bypassed by adding more VHD disk images to a VM. Then combining it with a pool storage system such as Storage Spaces on Windows, LVM on Linux or ZPool on FreeBSD, OpenBSD, NetBSD etc.

Though sorting this issue is being discussed and worked on along with a new storage SMAPI namely transitioning from SMAPI v1 to SMAPI v3 as part of software development.

@lawrencesystems Maybe get behind and help with code and/or sponsorship of this feature request.

https://xcp-ng.org/forum/topic/8252/tag-based-selection-for-multiple-vdi-storages/8

Cause this is a part required for what you are looking for as it will increase tag functionality. Specifically enabling tags to specify the affinity for where VDIs are stored (which SR they go to). There's already this feature present for VMs to ensure that they go to the correct hosts.

@webminster said in Windows10 boot: SYSTEM THREAD EXCEPTION:

@john-c No. It's a basic no-frills standalone machine.

Have you made sure it's not a hidden file as Windows hides files by default! So if the "%SystemRoot%\Memory.dmp" has the Hidden and/or System bit set it will be not visible on default settings.

One sure fire way to tell is to enable Windows to show the hidden files, then have a look or using the command line terminal to run a listing and/or search in the %SystemRoot% directory for the file.

Linux is case sensitive don't forget, but Windows isn't so if the case for the file name doesn't match then it won't be found.

Also if the system crashes too early and/or quickly when doing BSOD it may not have the filesystem components and drivers, loaded yet for the "%SystemRoot%\Memory.dmp" file creation.

@webminster said in Windows10 boot: SYSTEM THREAD EXCEPTION:

@john-c It's not something I set explicitly. The Windows 10 Pro install was a clean install from ISO, I did not change settings beyond enabling RDP and patching.

Not GP or such. The machine on boot looped between a restart after the BSOD (restarted itself) and a self-triggered automatic repair and reboot (which BSOD'd after).

Definitely not interrupting the boot cycle.
-Alan

Is the VM part of a Domain Login (via Windows Server or Samba) if it is did you define it in the GPO when setting up the Domain's Group policy?

Cause this is propagated to all domain member computers.

@webminster You may have jumped in with the reboot and boot disk before Windows had the opportunity to generate the file, or may have the memory dump functionality disabled via Group Policy or in the System Properties. You could have had the file erased with "Disk Clean-up" or as part of "Storage Sense".

Thus you will likely not be able to find that file your looking for.

@stormi said in XCP-NG 8.3 xsconsole backup, restore pool metadata:

@Prilly said in XCP-NG 8.3 xsconsole backup, restore pool metadata:

Snicky this one from vates

If you mean sneaky, I'm not sure I appreciate what this word implies.

This is absolutely something to write about in the release note of 8.3.

Agreed, this should be in the release notes. I'll add it.

when is it expected back?

I had a look, and it was fixed on XenServer side. So it will be back in XCP-ng 8.3 once we rebase on their latest updates. Hopefully before the end of the year.

How do you restore this metadata backup in xcp-ng 8.3 without the use of XO?

If you really can't use XO, you can use the same API that XO uses to implement the feature in its UI: XAPI. I don't know myself the exact end points that must be used for this back-up feature.

I think they may have actually meant to say sticky this one from Vates, they may have been hit by autocorrect, or are using sliding typing and didn't notice the mistake.

@manilx said in Epyc VM to VM networking slow:

@john-c Hi. Ordered from Amazon that day and after more than 2 weeks order was cancelled without notice from supplier. Reordered from another one and I'm still waiting....
Not easy to get one.

Thanks for your reply. I hope it goes well this time, anyway if it still proves difficult then you can go for another quad port 10Gbe NIC which is compatible to do the LACP 2 bond with.

If the selected quad port 10Gbe NIC is available on general sale, then you can get it through the supplier who provided you with your HPE Care Packs.

@manilx I've been waiting for your ping back with the report. Following you saying the first week in November 2024, now in the beginning of the 2nd week in November 2024.

I'm wondering how's it going please, anything holding it up?

@TheNorthernLight said in XO Lite: building an embedded UI in XCP-ng:

Just upgraded my home network to 8.3.0 and I must say, it went flawlessly. Also my first time taking a look at XO-Lite. Also fantastic! Kudo's to the whole vates dev and testing team. This is a huge milestone.

The only real feature for me that is missing from XO-Lite is the ability to shutdown/restart the host itself from the menu (I'm assuming this is still being added).

Currently, I cant see a way to restart the host from XO-Lite. My XCPNG host runs headless, so when I needed to restart the host, I loaded XCPNG Center and shutdown the XOA VM, and then rebooted the host (only needed when applying host patches). This method wont work now with 8.3. I was forced to use the "force reboot" from XOA to complete the final patch/reboot steps.

Without the control to restart/shutdown the host itself, the only other option is to enable SSH (when the host is headless). I would think that XO-Lite would "in theory" be more secure then leaving SSH open only for this scenario.

Separately, I also run XCPNG/XOA at work (licensed), and currently we are waiting for XOSTOR to come out of beta before we upgrade/test it in our environment. Any ETA on XOSTOR going full version in 8.3 ?

Looking forward to the future of this version and product.

Leaving SSH open won't work as eventually its port will be found, then exploited (used maliciously to gain access to host). Also it would bypass the lock down feature, modelled after VMware ESXi lockdown.

Anyway there's RPU & RPR both of which are available in the appropriate edition of XOA (Xen Orchestra Appliance) and also Xen Orchestra from Sources. The RPU will reboot each host in the pool after updating them. The RPR will reboot each host in the pool in sequence, before moving onto the next.

@m-mirzayev said in ISCSI mount - SR_BACKEND_FAILURE_432:

@john-c
Would you mind to post your custom.conf so i have a reference?

@m-mirzayev I don’t use multipath personally however, though managed to get Microsoft Copilot to put what you gave above into a valid structure. I also remember people in the past having trouble with multipath, so Vates employees implemented this /etc/multipath/conf.d/custom.conf to fix these issues.

# /etc/multipath/conf.d/custom.conf
defaults {
    user_friendly_names yes
}

multipaths {
    multipath {
        wwid                    "your_device_wwid_here"
        alias                   "truenas_iscsi"
        path_selector           "round-robin 0"
        path_grouping_policy    multibus
        path_checker            tur
        prio                    const
        failback                immediate
    }
}

devices {
    device {
        vendor                  "TrueNAS"
        product                 "iSCSI"
        path_selector           "round-robin 0"
        path_grouping_policy    multibus
        hardware_handler        "0"
        prio                    const
        failback                immediate
    }
}

Please replace "your_device_wwid_here" with the WWID of the device on your network.

@m-mirzayev said in ISCSI mount - SR_BACKEND_FAILURE_432:

@john-c
As i mentioned i am not a pro in regard of iscsi and multipath.conf. If you are, can you just look over the settings and give your opinion on it?

And do i just put this into the custom.conf:

        device {
                vendor                  "TrueNAS"
                product                 "iSCSI"
                path_selector           "round-robin 0"
                path_grouping_policy    multibus
                hardware_handler        "0"
                prio                    "const"
                failback                immediate
        }

without the outer devices {}

The structure of custom.conf must be a valid structure configuration file for multipath. As even though its overriding the multipath.conf file it still needs to be valid so that the software, can parse it correctly.

@m-mirzayev said in ISCSI mount - SR_BACKEND_FAILURE_432:

@john-c
Thanks for this information. I will put it into the custom.conf

Having it in this file will also enable it to be placed as part of automated installation processes and infrastructure as code.