Getting Started with KVM on SLES 11 SP1

This blog post is long overdued and I apologized to those who had encouraged me to do so earlier and I procrastinated.

With SLES 11 SP1, officially available earlier in June 2010, KVM (Kernel-based Virtual Machine) is officially supported in addition to the more mature Xen virtualization (since 2006). You can install both hypervisors on the same installation of SLES 11 SP1 but you can only choose to use one or the other and not both at the same time (reboot required to switch).

Pre-requisites:

This is an important and usually overlooked step, I'm guilty of this... twice (Ouch!), but KVM requires x86 CPUs that supports hardware level virtualization. For Intel chips, the Intel-VT feature and for AMD chips, the equivalent AMD-V feature must be available.

Question: How do I know my CPU supports hardware level virtualization?
Answer 1: If you have your CPU model number, you can google or just visit the support pages at Intel or AMD.
Answer 2: If you already have SLES 11 SP1 installed, execute this command as root via the Terminal: cat /proc/cpuinfo and your CPU Model name will show up.

More importantly, this feature must be turned ON. I've noticed that they (Intel-VT and AMD-V) are usually disabled by default. To turn them on, you'll need to go into the BIOS and, under some CPU configuration, toggle it ON.

Question: How do I know if Intel-VT or AMD-V is available with SLES 11 SP1 already booted up?
Answer: Execute egrep "vmx|svm" /proc/cpuinfo and if this command returns empty, you're out of luck. For Intel-VT, vmx is present under the CPU flag. For AMD-V, svm is present.

The consequence of not checking, while not catastrophic, does cause disappointments especially when that particular CPU does not support this feature and you'll have to find other means to virtualize. On such a machine and if you're only virtualizing SLES 10 or 11, you can install Xen and it will work since Xen supports para-virtualization. However, if you intend to virtualize other Linux and Windows, you'll need to look at VMWare (eg VMWare Server coz its free) and/or any other hypervisor that provides full hardware emulation for virtualization.

Installation:

SLES 11 SP1 does not install Xen or KVM by default (if you keep clicking Next and do not modify the Software Selection during installation). Fortunately, SUSE Engineering made it real easy to install either Xen or KVM (or both) via YaST.

In YaST, under the Virtualization section, click on Install Hypervisor and Tools. You will be presented with a simple dialog with 2 checkboxes. You may checked both boxes to install both Xen and KVM or just the checkbox for KVM.



Click Accept and YaST will take care of installing all the required packages (including management tools) for KVM and/or Xen.

Its important that you know that, virt-manager, the GUI to manage virtual machines and configurations can be used to administer both Xen and KVM in SLES 11 SP1. This is a great feature because users who are already familiar with Xen on SLES can start using KVM quickly. Another great example of engineering thought put into releasing a quality Linux distribution for the enterprise.

Once installation is complete, you are ready to use KVM (without rebooting). Just to be sure that KVM is ready for action, you can execute (as root) lsmod | grep kvm and see if the kvm module has been loaded. You can find the KVM release notes/support statements under the /usr/share/doc/packages/kvm directory.

Using KVM for the first time:

Bring up the Virtual Machine Manager (aka virt-manager) either via YaST -> Virtualization -> Virtual Machine Manager OR the command (as root) virt-manager.



For the Virtual Machine Manager (VMM) GUI screenshot above, you should have an empty list of virtual machines under localhost(QEMU) since you're using KVM for the first time.

At this point, before you create your first virtual machine, I would advise you define the virtual network settings. By default, there is a "default" virtual network (it may not be activated however) that is configured to NAT (Network Address Translation). This means that your virtual machine will pick up, via DHCP, an IP address that is local to your machine but capable of accessing the Internet via your host network card (or WiFi). If this setting works for you, great. Otherwise, you have the option of creating other virtual network (host-only or bridged) via the VMM GUI.

To administer these virtual networks, double-click on localhost (QEMU) in the VMM. Alternatively, you can click on Edit -> Host Details on the VMM menubar. Click on the Virtual Networks Tab when another window appears. I won't bother going into details here because the GUI is rather straight-forward. Only thing that is worth pointing out is NOT to forget clicking on the "play" button to start your virtual network.



Good, you are all set to create your first virtual machine with KVM. If you are familiar with the virtual machine creation wizard for Xen since SLES 10 SP2, it will be plain sailing for you since SLES re-use the same GUI interfaces. For those who are not familiar, well, its really not that tough clicking Next, modifying preferences and clicking Finish to create a virtual machine and start it up.

Finally, for the more hardcore users reading this blog, here are the directories that will be of interests to you:

VM disk images - /var/lib/kvm/images/
VM meta-data - /etc/kvm/vm/
Logs - /var/log/kvm/ and /var/log/libvirt/
Configurations - /etc/libvirt/ and /etc/libvirt/qemu/networks/

Enjoy!

The winding road to a straight-forward solution

Update(26 Oct 2010): Please read comments section for this entry for more useful information. My gratitude & Thanks to all who contributed. Cheers!

This is a rant... and I will admit to not thoroughly investigating this topic... but really, why does it have to be this hard to install SUSE on a Laptop? Curious? Read on...

First, the scenario, I was on the road 3 weeks ago and needed to install SUSE Linux Enterprise Desktop 11 SP1 onto a Thinkpad X61. This model does not have a DVD drive and while there's a docking station somewhere that has a DVD drive, that docking station cannot be found, Oops. Not a big deal, next idea was to do a network install where I setup my machine with DHCP & HTTP server to provision the X61 via PXE-boot. Unfortunately, I do not have sufficient time and the network setup at that place was new to me so I thought the risk is rather high.

Next idea was to use my 8GB USB thumbdrive and make it into a SUSE install stick. Yes, this might work (it did eventually) and I recall seeing some documentation on opensuse.org before. I backed up the existing data on my thumbdrive and ensured that I've installed syslinux onto my system so as to make the USB stick bootable... that's all that I can recall off hand.

Now comes my rant:

I cannot find that document on how to make a USB stick into a bootable SUSE installer. First, opensuse.org has gone through a facelife (and its a truly nice visual upgrade). While the structure of the site has improved in terms of content organization, that particular document did not survive the website upgrade. After spending more time with Google, I realize that the older opensuse.org site is still accessible by prepending "old-" to the URL = http://old-en.opensuse.org

Eventually, I found the documentation/article at http://old-en.opensuse.org/SuSE_install_from_USB_drive

Finally, the steps are pretty straightforward except for the little bump in the road where I have to download a script called mksusebootdisk from here. Murphy's law kicked into high gear and I had trouble downloading this little file. Aargh!

From the documentation, it states that the mkbootdisk script that ships with SUSE does not really work in this scenario as it doesn't work with FAT32 on USB stick (and you can't use Fat16 as SUSE DVD image is greater than 2GB). Therefore, you'll need the modified version mentioned above. Great!

This document has been around for about 2 years and in that time, this little script is still not shipped with the latest SUSE. I'm sure there is a good engineering reason to this but I was too upset to even consider it. LOL! :)

Anyway, after clicking on the link one last time (hoping the same action will yield a different result), I was able to download that mksusebootdisk script. Ha! Everything was smooth sailing thereafter and I installed SLED 11 SP1 on the Thinkpad X61 from my 8GB USB Stick.

Onwards and upwards... keeping on carrying on... :)

Mummy dearest and my SLED 11 SP1

My 62 year old and Chinese educated mother used my Thinkpad T61p running SUSE Linux Enterprise Desktop 11 SP1 the other day. Her trusty (ie old) PC running Windows & MS Office opted for early retirement while she was half-way through creating a powerpoint presentation for her Chinese Poetry Club.

Desperate to complete her presentation, she asked if she could use the computers at my place... I told her I do not have Windows but if she was open, she could still get her presentation done on a slightly different program and interface.

I powered up SLED 11 SP1, plugged in her USB thumbdrive and opened up her Chinese poetry presentation in OpenOffice v3.2.1. Next, I showed her how to use SCIM for Chinese character input (toggle via Ctrl-Space & HanYu PinYin input). Left her to it for an hour and she successfully completed her assignment, saved it in PPT format and went home. I did warn her that her presentation may not be 100% WYSIWYG when opened on a Windows PC at her club meeting. *fingers crossed*

My mum came back the next evening to add a few more slides and told me (not surprisingly) that the slides did not turn out 100% as planned but she was resourceful enough to copy-n-paste (what a wonderful invention) the characters from the PPT created in OpenOffice and merge it with a PPT created in MS Office. She even managed to get me off my lazy bum and help create transparency effect (using GIMP) for one of her mid-autumn backgrounds used in the presentation.

Wishing her all the best for that final presentation this evening. I'm so proud of her because:

1. She only picked up basic English and basic Windows & MS Office usage a few years ago at around 50+ years of age.
   
2. She is fearless... there are many people half her age who wouldn't even touch a keyboard with a non-Windows screen in front of them.
3. She is adaptable... man, how many people can use cut-n-paste effectively?

Maybe... just maybe... there is still a glimmer of hope for that elusive "Year of the Linux Desktop"... nah!

Windows Virus/Trojan busting with SUSE and ClamAV

Not once but on two separate occasions over the course of last week, I was called upon to help do some virus & trojan busting on badly infected laptops. It was so bad that traditional anti-virus software just could not seem to completely eradicate them. It would appear that these viruses and trojans could hide and re-create/spawn instances upon shutdown and reboot of Windows XP.

Honestly, I'm "new" to this as this is not my day job or something I do on a regular basis. Since using the installed anti-virus program route did not work, I opted to physically remove the infected 2.5" hard disk drive from these laptops and put them in my secondary hard disk bay of my Thinkpad running SUSE Linux Enterprise Desktop 11 SP1 (SLED 11 SP1 for short).

Tip: If you do not have nor want to spend money on a secondary hard disk bay for your laptop, there are many more affordable adapters in the market where you can connect a SATA or IDE 2.5" hard disk drive and connect them to your laptop via USB. SUSE Linux Enterprise (Desktop/Server) and openSUSE will automatically mount them under the /media directory.

My idea/solution was simple, boot up my Thinkpad with SLED 11 SP1 with the infected hard disk mounted as a secondary drive (ie no programs are executed on boot). Further, its unlikely these nasty viruses/trojans will execute since I'm using a different operating system. Next, use ClamAV (anti-virus scanner that comes with SLED 11 SP1) to scan for known Windows viruses & trojans on the mounted secondary drive (which is the Windows hard disk from the infected laptops).

Note, if you are using clamscan for the first time, ensure that your virus database is up-to-date or it will not work. To do that, ensure you've got Internet access and execute freshclam. Thereafter, you can execute clamscan -ri . The "r" flag means recursively through the directories and "i" flag is to only print infected files detected to the screen. In my case, I mounted the infected disk via mount -t ntfs /dev/sdb1 /mnt/temp and so I executed clamscan -ri /mnt/temp/ for my virus/trojan busting.

Its IMPORTANT to note that clamscan does not have virus/trojan quarantine or disinfecting capabilities. To remove the virus, it would delete the infected file. Hence, I did not specify the --remove=yes parameter as I wanted clamscan to detect the infected files first and leave it to me to decide if these files should be removed permanently.

Using this method, I managed to detect and selectively remove infected files (some of them made to look like Windows system files). The first instance, I detected and removed over 25 trojans. In the second instance, I detected and removed 2 trojans.

Finally, I believe (please correct me if I'm mistaken) the original intent of packaging ClamAV with SUSE Linux Enterprise is to have the ClamAV daemon work with email server software in scanning emails that may contain Windows viruses and actively block or remove them before it reaches end user machines running Windows.