It takes long time to start kvm virtual machine with nwfilter in docker container.

["John Y." <wjseven1707@xxxxxxxxx>]

1.  It takes minutes to start the virtual machine when I add "filterref" to libvirt.xml and run command "virsh start  vm1".
It also takes minutes to destroy the virtual machine.

<interface type="bridge">
  <mac address="fa:16:3e:fa:f7:94"/>
  <target dev="tap69e948b0-bf"/>
  <source bridge="br02"/>
  <model type="virtio"/>
  <filterref filter="no-arp-spoofing">
    <parameter name="IP" value="192.168.2.2"/>
    <parameter name="MAC" value="fa:16:3e:fa:f7:94"/>
  </filterref>
</interface>

2. I found some logs in /var/log/libvirt/libvirtd.log


2019-11-04 03:46:18.495+0000: 15257: info : virFirewallApplyRule:815 : Applying rule '/usr/sbin/ebtables --concurrent -t nat -D PREROUTING -i tap69e948b0-bf -j libvirt-J-tap69e948b0-bf'
2019-11-04 03:46:18.495+0000: 15257: debug : virCommandRunAsync:2499 : About to run /usr/sbin/ebtables --concurrent -t nat -D PREROUTING -i tap69e948b0-bf -j libvirt-J-tap69e948b0-bf
2019-11-04 03:46:18.496+0000: 15257: debug : virFileClose:111 : Closed fd 24
2019-11-04 03:46:18.496+0000: 15257: debug : virFileClose:111 : Closed fd 26
2019-11-04 03:46:18.496+0000: 15257: debug : virFileClose:111 : Closed fd 29
2019-11-04 03:46:18.496+0000: 15257: debug : virCommandRunAsync:2502 : Command result 0, with PID 16291
2019-11-04 03:46:19.242+0000: 15257: debug : virCommandRun:2350 : Result invalid value 255, stdout: '' stderr: '2019-11-04 03:46:19.239+0000: 16291: debug : virFileClose:111 : Closed fd 26
2019-11-04 03:46:19.239+0000: 16291: debug : virFileClose:111 : Closed fd 29
2019-11-04 03:46:19.239+0000: 16291: debug : virFileClose:111 : Closed fd 24
Illegal target name 'libvirt-J-tap69e948b0-bf'.
'
2019-11-04 03:46:19.242+0000: 15257: debug : virFirewallApplyRuleDirect:704 : Ignoring error running command
2019-11-04 03:46:19.242+0000: 15257: debug : virFileClose:111 : Closed fd 25
2019-11-04 03:46:19.243+0000: 15257: debug : virFileClose:111 : Closed fd 28
2019-11-04 03:46:19.243+0000: 15257: info : virFirewallApplyRule:815 : Applying rule '/usr/sbin/ebtables --concurrent -t nat -D POSTROUTING -o tap69e948b0-bf -j libvirt-P-tap69e948b0-bf'
2019-11-04 03:46:19.243+0000: 15257: debug : virCommandRunAsync:2499 : About to run /usr/sbin/ebtables --concurrent -t nat -D POSTROUTING -o tap69e948b0-bf -j libvirt-P-tap69e948b0-bf
2019-11-04 03:46:19.243+0000: 15257: debug : virFileClose:111 : Closed fd 24
2019-11-04 03:46:19.243+0000: 15257: debug : virFileClose:111 : Closed fd 26
2019-11-04 03:46:19.244+0000: 15257: debug : virFileClose:111 : Closed fd 29
2019-11-04 03:46:19.244+0000: 15257: debug : virCommandRunAsync:2502 : Command result 0, with PID 16292
2019-11-04 03:46:19.990+0000: 15257: debug : virCommandRun:2350 : Result invalid value 255, stdout: '' stderr: '2019-11-04 03:46:19.986+0000: 16292: debug : virFileClose:111 : Closed fd 26
2019-11-04 03:46:19.986+0000: 16292: debug : virFileClose:111 : Closed fd 29
2019-11-04 03:46:19.986+0000: 16292: debug : virFileClose:111 : Closed fd 24
Illegal target name 'libvirt-P-tap69e948b0-bf'.
'
2019-11-04 03:46:19.990+0000: 15257: debug : virFirewallApplyRuleDirect:704 : Ignoring error running command
2019-11-04 03:46:19.990+0000: 15257: debug : virFileClose:111 : Closed fd 25
2019-11-04 03:46:19.990+0000: 15257: debug : virFileClose:111 : Closed fd 28

3. It works fine on hosts.
4. It works fine in other host's libvirt container.


How can I solve this problem?

Best regards,
John

_______________________________________________
libvirt-users mailing list
libvirt-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvirt-users