=head1 NAME

virt-v2v - Convert a guest to use KVM

=head1 SYNOPSIS

 virt-v2v -ic vpx://vcenter.example.com/Datacenter/esxi vmware_guest

 virt-v2v -i libvirtxml guest-domain.xml -o local -os /var/tmp

 virt-v2v -i disk disk.img -o local -os /var/tmp

 virt-v2v -i disk disk.img -o glance

 virt-v2v -ic vpx://vcenter.example.com/Datacenter/esxi vmware_guest \
   -o rhv-upload -oc https://ovirt-engine.example.com/ovirt-engine/api \
   -os ovirt-data -op /tmp/ovirt-admin-password -of raw \
   -oo rhv-cafile=/tmp/ca.pem -oo rhv-direct \
   --bridge ovirtmgmt

=head1 DESCRIPTION

Virt-v2v converts guests from a foreign hypervisor to run on KVM.  It
can read Linux and Windows guests running on VMware, Xen, Hyper-V and
some other hypervisors, and convert them to KVM managed by libvirt,
OpenStack, oVirt, Red Hat Virtualisation (RHV) or several other
targets.

There is also a companion front-end called L<virt-p2v(1)> which comes
as an ISO, CD or PXE image that can be booted on physical machines to
virtualize those machines (physical to virtual, or p2v).

This manual page documents the rewritten virt-v2v included in
libguestfs E<ge> 1.28.

=head1 EXAMPLES

=head2 Convert from VMware vCenter server to local libvirt

You have a VMware vCenter server called C<vcenter.example.com>, a
datacenter called C<Datacenter>, and an ESXi hypervisor called
C<esxi>.  You want to convert a guest called C<vmware_guest> to run
locally under libvirt.

 virt-v2v -ic vpx://vcenter.example.com/Datacenter/esxi vmware_guest

In this case you will most likely have to run virt-v2v as C<root>,
since it needs to talk to the system libvirt daemon and copy the guest
disks to F</var/lib/libvirt/images>.

For more information see L</INPUT FROM VMWARE VCENTER SERVER> below.

=head2 Convert from VMware to RHV/oVirt

This is the same as the previous example, except you want to send the
guest to a RHV Data Domain using the RHV REST API.  Guest network
interface(s) are connected to the target network called C<ovirtmgmt>.

 virt-v2v -ic vpx://vcenter.example.com/Datacenter/esxi vmware_guest \
   -o rhv-upload -oc https://ovirt-engine.example.com/ovirt-engine/api \
   -os ovirt-data -op /tmp/ovirt-admin-password -of raw \
   -oo rhv-cafile=/tmp/ca.pem -oo rhv-direct \
   --bridge ovirtmgmt

In this case the host running virt-v2v acts as a B<conversion server>.

For more information see L</OUTPUT TO RHV> below.

=head2 Convert from ESXi hypervisor over SSH to local libvirt

You have an ESXi hypervisor called C<esxi.example.com> with SSH access
enabled.  You want to convert from VMFS storage on that server to
a local file.

 virt-v2v \
   -i vmx -it ssh \
   "ssh://root@esxi.example.com/vmfs/volumes/datastore1/guest/guest.vmx" \
   -o local -os /var/tmp

The guest must not be running.  Virt-v2v would I<not> need to be run
as root in this case.

For more information about converting from VMX files see
L</INPUT FROM VMWARE VMX> below.

=head2 Convert disk image to OpenStack glance

Given a disk image from another hypervisor that you want to convert to
run on OpenStack (only KVM-based OpenStack is supported), you can do:

 virt-v2v -i disk disk.img -o glance

See L</OUTPUT TO GLANCE> below.

=head2 Convert disk image to disk image

Given a disk image from another hypervisor that you want to convert to
run on KVM, you have two options.  The simplest way is to try:

 virt-v2v -i disk disk.img -o local -os /var/tmp

where virt-v2v guesses everything about the input F<disk.img> and (in
this case) writes the converted result to F</var/tmp>.

A more complex method is to write some
L<libvirt XML|http://libvirt.org/formatdomain.html> describing the
input guest (if you can get the source hypervisor to provide you with
libvirt XML, then so much the better).  You can then do:

 virt-v2v -i libvirtxml guest-domain.xml -o local -os /var/tmp

Since F<guest-domain.xml> contains the path(s) to the guest disk
image(s) you do not need to specify the name of the disk image on the
command line.

=head1 INPUT AND OUTPUT MODES

                          ┌────────────┐  ┌─────────▶ -o null
 -i disk ────────────┐    │            │ ─┘┌───────▶ -o local
 -i ova  ──────────┐ └──▶ │ virt-v2v   │ ──┘┌───────▶ -o qemu
                   └────▶ │ conversion │ ───┘┌────────────┐
 VMware─▶┌────────────┐   │ server     │ ────▶ -o libvirt │─▶ KVM
 Xen ───▶│ -i libvirt ──▶ │            │     │  (default) │
 ... ───▶│  (default) │   │            │ ──┐ └────────────┘
         └────────────┘   │            │ ─┐└──────▶ -o glance
 -i libvirtxml ─────────▶ │            │ ┐├─────────▶ -o rhv
 -i vmx ────────────────▶ │            │ │└─────────▶ -o vdsm
                          └────────────┘ └──────────▶ -o rhv-upload

Virt-v2v has a number of possible input and output modes, selected
using the I<-i> and I<-o> options.  Only one input and output mode can
be selected for each run of virt-v2v.

I<-i disk> is used for reading from local disk images (mainly for
testing).

I<-i libvirt> is used for reading from any libvirt source.  Since
libvirt can connect to many different hypervisors, it is used for
reading guests from VMware, RHEL 5 Xen and more.  The I<-ic>
option selects the precise libvirt source.

I<-i libvirtxml> is used to read from libvirt XML files.  This is the
method used by L<virt-p2v(1)> behind the scenes.

I<-i ova> is used for reading from a VMware ova source file.

I<-i vmx> is used for reading from a VMware vmx file.

I<-o glance> is used for writing to OpenStack Glance.

I<-o libvirt> is used for writing to any libvirt target.  Libvirt can
connect to local or remote KVM hypervisors.  The I<-oc> option selects
the precise libvirt target.

I<-o local> is used to write to a local disk image with a local
libvirt configuration file (mainly for testing).

I<-o qemu> writes to a local disk image with a shell script for
booting the guest directly in qemu (mainly for testing).

I<-o rhv-upload> is used to write to a RHV / oVirt target.  I<-o rhv>
is a legacy method to write to RHV / oVirt E<lt> 4.2.  I<-o vdsm> is
only used when virt-v2v runs under VDSM control.

=head1 OPTIONS

=over 4

=item B<--help>

Display help.

=item B<-b> ...

=item B<--bridge> ...

See I<--network> below.

=item B<--colors>

=item B<--colours>

Use ANSI colour sequences to colourize messages.  This is the default
when the output is a tty.  If the output of the program is redirected
to a file, ANSI colour sequences are disabled unless you use this
option.

=item B<--compressed>

Write a compressed output file.  This is only allowed if the output
format is qcow2 (see I<-of> below), and is equivalent to the I<-c>
option of L<qemu-img(1)>.

=item B<--debug-overlays>

Save the overlay file(s) created during conversion.  This option is
only used for debugging virt-v2v and may be removed in a future
version.

=item B<--echo-keys>

When prompting for keys and passphrases, virt-v2v normally turns
echoing off so you cannot see what you are typing.  If you are not
worried about Tempest attacks and there is no one else in the room you
can specify this flag to see what you are typing.

Note this options only applies to keys and passphrases for encrypted
devices and partitions, not for passwords used to connect to remote
servers.

=item B<-i> B<disk>

Set the input method to I<disk>.

In this mode you can read a virtual machine disk image with no
metadata.  virt-v2v tries to guess the best default metadata.  This is
usually adequate but you can get finer control (eg. of memory and
vCPUs) by using I<-i libvirtxml> instead.  Only guests that use a single
disk can be imported this way.

=item B<-i> B<libvirt>

Set the input method to I<libvirt>.  This is the default.

In this mode you have to specify a libvirt guest name or UUID on the
command line.  You may also specify a libvirt connection URI (see
I<-ic>).

=item B<-i> B<libvirtxml>

Set the input method to I<libvirtxml>.

In this mode you have to pass a libvirt XML file on the command line.
This file is read in order to get metadata about the source guest
(such as its name, amount of memory), and also to locate the input
disks.  See L</MINIMAL XML FOR -i libvirtxml OPTION> below.

=item B<-i> B<local>

This is the same as I<-i disk>.

=item B<-i> B<ova>

Set the input method to I<ova>.

In this mode you can read a VMware ova file.  Virt-v2v will read the
ova manifest file and check the vmdk volumes for validity (checksums)
as well as analyzing the ovf file, and then convert the guest.  See
L</INPUT FROM VMWARE OVA> below

=item B<-i> B<vmx>

Set the input method to I<vmx>.

In this mode you can read a VMware vmx file directly or over SSH.
This is useful when VMware VMs are stored on an NFS server which you
can mount directly, or where you have access by SSH to an ESXi
hypervisor.  See L</INPUT FROM VMWARE VMX> below

=item B<-ic> libvirtURI

Specify a libvirt connection URI to use when reading the guest.  This
is only used when S<I<-i libvirt>>.

Only local libvirt connections, VMware vCenter connections, or RHEL 5
Xen remote connections can be used.  Other remote libvirt connections
will not work in general.

See also L</INPUT FROM VMWARE VCENTER SERVER>,
L</INPUT FROM XEN> below.

=item B<-if> format

For I<-i disk> only, this specifies the format of the input disk
image.  For other input methods you should specify the input
format in the metadata.

=item B<-io> OPTION=VALUE

Set input option(s) related to the current input mode or transport.
To display short help on what options are available you can use:

 virt-v2v -it vddk -io "?"

=item B<-io vddk-libdir=>LIBDIR

Set the VDDK library directory.  This directory should I<contain>
subdirectories called F<include>, F<lib64> etc., but do not include
F<lib64> actually in the parameter.

In most cases this parameter is required when using the I<-it vddk>
(VDDK) transport.  See L</INPUT FROM VDDK> below for details.

=item B<-io vddk-thumbprint=>xx:xx:xx:...

Set the thumbprint of the remote VMware server.

This parameter is required when using the I<-it vddk> (VDDK) transport.
See L</INPUT FROM VDDK> below for details.

=item B<-io vddk-config=>FILENAME

=item B<-io vddk-cookie=>COOKIE

=item B<-io vddk-nfchostport=>PORT

=item B<-io vddk-port=>PORT

=item B<-io vddk-snapshot=>SNAPSHOT-MOREF

=item B<-io vddk-transports=>MODE:MODE:...

=item B<-io vddk-vimapiver=>APIVER

When using VDDK mode, these options are passed unmodified to the
L<nbdkit(1)> VDDK plugin.  Please refer to L<nbdkit-vddk-plugin(1)>.
These are all optional.

=item B<-it> B<ssh>

When using I<-i vmx>, this enables the ssh transport.
See L</INPUT FROM VMWARE VMX> below.

=item B<-it> B<vddk>

Use VMware VDDK as a transport to copy the input disks.  See
L</INPUT FROM VDDK> below.  If you use this parameter then you may
need to use other I<-io vddk*> options to specify how to connect through
VDDK.

=item B<--keys-from-stdin>

Read key or passphrase parameters from stdin.  The default is
to try to read passphrases from the user by opening F</dev/tty>.

Note this options only applies to keys and passphrases for encrypted
devices and partitions, not for passwords used to connect to remote
servers.

=item B<--machine-readable>

This option is used to make the output more machine friendly
when being parsed by other programs.  See
L</MACHINE READABLE OUTPUT> below.

=item B<-n> in:out

=item B<-n> out

=item B<--network> in:out

=item B<--network> out

=item B<-b> in:out

=item B<-b> out

=item B<--bridge> in:out

=item B<--bridge> out

Map network (or bridge) called C<in> to network (or bridge) called
C<out>.  If no C<in:> prefix is given, all other networks (or bridges)
are mapped to C<out>.

See L</NETWORKS AND BRIDGES> below.

=item B<--no-copy>

Don’t copy the disks.  Instead, conversion is performed (and thrown
away), and metadata is written, but no disks are created.  See
also discussion of S<I<-o null>> below.

This is useful in two cases: Either you want to test if conversion is
likely to succeed, without the long copying process.  Or you are only
interested in looking at the metadata.

This option is not compatible with I<-o libvirt> since it would create
a faulty guest (one with no disks).

This option is not compatible with I<-o glance> for technical reasons.

=item B<-o> B<disk>

This is the same as I<-o local>.

=item B<-o> B<glance>

Set the output method to OpenStack Glance.  In this mode the converted
guest is uploaded to Glance.  See L</OUTPUT TO GLANCE> below.

=item B<-o> B<libvirt>

Set the output method to I<libvirt>.  This is the default.

In this mode, the converted guest is created as a libvirt guest.  You
may also specify a libvirt connection URI (see I<-oc>).

See L</OUTPUT TO LIBVIRT> below.

=item B<-o> B<local>

Set the output method to I<local>.

In this mode, the converted guest is written to a local directory
specified by I<-os /dir> (the directory must exist).  The converted
guest’s disks are written as:

 /dir/name-sda
 /dir/name-sdb
 [etc]

and a libvirt XML file is created containing guest metadata:

 /dir/name.xml

where C<name> is the guest name.

=item B<-o> B<null>

Set the output method to I<null>.

The guest is converted and copied (unless you also specify
I<--no-copy>), but the results are thrown away and no metadata is
written.

=item B<-o> B<ovirt>

This is the same as I<-o rhv>.

=item B<-o> B<ovirt-upload>

This is the same as I<-o rhv-upload>.

=item B<-o> B<qemu>

Set the output method to I<qemu>.

This is similar to I<-o local>, except that a shell script is written
which you can use to boot the guest in qemu.  The converted disks and
shell script are written to the directory specified by I<-os>.

=item B<-o> B<rhev>

This is the same as I<-o rhv>.

=item B<-o> B<rhv>

Set the output method to I<rhv>.

The converted guest is written to a RHV Export Storage Domain.  The
I<-os> parameter must also be used to specify the location of the
Export Storage Domain.  Note this does not actually import the guest
into RHV.  You have to do that manually later using the UI.

See L</OUTPUT TO RHV (OLD METHOD)> below.

=item B<-o> B<rhv-upload>

Set the output method to I<rhv-upload>.

The converted guest is written directly to a RHV Data Domain.
This is a faster method than I<-o rhv>, but requires oVirt
or RHV E<ge> 4.2.

See L</OUTPUT TO RHV> below.

=item B<-o> B<vdsm>

Set the output method to I<vdsm>.

This mode is similar to I<-o rhv>, but the full path to the
data domain must be given:
F</rhv/data-center/E<lt>data-center-uuidE<gt>/E<lt>data-domain-uuidE<gt>>.
This mode is only used when virt-v2v runs under VDSM control.

=item B<-oa> B<sparse>

=item B<-oa> B<preallocated>

Set the output file allocation mode.  The default is C<sparse>.

=item B<-oc> URI

Specify a connection URI to use when writing the converted guest.

For S<I<-o libvirt>> this is the libvirt URI.  Only local libvirt
connections can be used.  Remote libvirt connections will not work.
See L</OUTPUT TO LIBVIRT> below for further information.

=item B<-of> format

When converting the guest, convert the disks to the given format.

If not specified, then the input format is used.

=item B<-on> name

Rename the guest when converting it.  If this option is not used then
the output name is the same as the input name.

=item B<-oo> OPTION=VALUE

Set output option(s) related to the current output mode.
To display short help on what options are available you can use:

 virt-v2v -o rhv-upload -oo "?"

=item B<-oo rhv-cafile=>F<ca.pem>

For I<-o rhv-upload> (L</OUTPUT TO RHV>) only, the F<ca.pem> file
(Certificate Authority), copied from F</etc/pki/ovirt-engine/ca.pem>
on the oVirt engine.

=item B<-oo rhv-cluster=>C<CLUSTERNAME>

For I<-o rhv-upload> (L</OUTPUT TO RHV>) only, set the RHV Cluster
Name.  If not given it uses C<Default>.

=item B<-oo rhv-direct>

For I<-o rhv-upload> (L</OUTPUT TO RHV>) only, if this option is given
then virt-v2v will attempt to directly upload the disk to the oVirt
node, otherwise it will proxy the upload through the oVirt engine.
Direct upload requires that you have network access to the oVirt
nodes.  Non-direct upload is slightly slower but should work in all
situations.

=item B<-oo rhv-verifypeer>

For I<-o rhv-upload> (L</OUTPUT TO RHV>) only, verify the oVirt/RHV
server’s identity by checking the server‘s certificate against the
Certificate Authority.

=item B<-oo vdsm-compat=0.10>

=item B<-oo vdsm-compat=1.1>

If I<-o vdsm> and the output format is qcow2, then we add the qcow2
I<compat=0.10> option to the output file for compatibility with RHEL 6
(see L<https://bugzilla.redhat.com/1145582>).

If I<-oo vdsm-compat=1.1> is used then modern qcow2 (I<compat=1.1>)
files are generated instead.

Currently I<-oo vdsm-compat=0.10> is the default, but this will change
to I<-oo vdsm-compat=1.1> in a future version of virt-v2v (when we can
assume that everyone is using a modern version of qemu).

B<Note this option only affects I<-o vdsm> output>.  All other output
modes (including I<-o rhv>) generate modern qcow2 I<compat=1.1>
files, always.

If this option is available, then C<vdsm-compat-option> will appear in
the I<--machine-readable> output.

=item B<-oo vdsm-image-uuid=>UUID

=item B<-oo vdsm-vol-uuid=>UUID

=item B<-oo vdsm-vm-uuid=>UUID

=item B<-oo vdsm-ovf-output=>DIR

Normally the RHV output mode chooses random UUIDs for the target
guest.  However VDSM needs to control the UUIDs and passes these
parameters when virt-v2v runs under VDSM control.  The parameters
control:

=over 4

=item *

the image directory of each guest disk (I<-oo vdsm-image-uuid>) (this
option is passed once for each guest disk)

=item *

UUIDs for each guest disk (I<-oo vdsm-vol-uuid>) (this option
is passed once for each guest disk)

=item *

the OVF file name (I<-oo vdsm-vm-uuid>).

=item *

the OVF output directory (default current directory) (I<-oo vdsm-ovf-output>).

=back

The format of UUIDs is: C<12345678-1234-1234-1234-123456789abc> (each
hex digit can be C<0-9> or C<a-f>), conforming to S<OSF DCE 1.1>.

These options can only be used with I<-o vdsm>.

=item B<-oo vdsm-ovf-flavour=>flavour

This option controls the format of the OVF generated at the end of conversion.
Currently there are two possible flavours:

=over 4

=item rhvexp

The OVF format used in RHV export storage domain.

=item ovirt

The OVF format understood by oVirt REST API.

=back

For backward compatibility the default is I<rhvexp>, but this may change in
the future.

=item B<-op> file

Supply a file containing a password to be used when connecting to the
target hypervisor.  Note the file should contain the whole password,
B<without any trailing newline>, and for security the file should have
mode C<0600> so that others cannot read it.

=item B<-os> storage

The location of the storage for the converted guest.

For I<-o libvirt>, this is a libvirt directory pool
(see S<C<virsh pool-list>>) or pool UUID.

For I<-o local> and I<-o qemu>, this is a directory name.  The
directory must exist.

For I<-o rhv-upload>, this is the name of the destination Storage
Domain.

For I<-o rhv>, this can be an NFS path of the Export Storage Domain
of the form C<E<lt>hostE<gt>:E<lt>pathE<gt>>, eg:

 rhv-storage.example.com:/rhv/export

The NFS export must be mountable and writable by the user and host
running virt-v2v, since the virt-v2v program has to actually mount it
when it runs.  So you probably have to run virt-v2v as C<root>.

B<Or:> You can mount the Export Storage Domain yourself, and point
I<-os> to the mountpoint.  Note that virt-v2v will still need to write
to this remote directory, so virt-v2v will still need to run as
C<root>.

You will get an error if virt-v2v is unable to mount/write to the
Export Storage Domain.

=item B<--password-file> file

Instead of asking for password(s) interactively, pass the password
through a file.  Note the file should contain the whole password,
B<without any trailing newline>, and for security the file should have
mode C<0600> so that others cannot read it.

=item B<--print-source>

Print information about the source guest and stop.  This option is
useful when you are setting up network and bridge maps.
See L</NETWORKS AND BRIDGES>.

=item B<-q>

=item B<--quiet>

This disables progress bars and other unnecessary output.

=item B<--root ask>

=item B<--root single>

=item B<--root first>

=item B<--root> /dev/sdX

=item B<--root> /dev/VG/LV

Choose the root filesystem to be converted.

In the case where the virtual machine is dual-boot or multi-boot, or
where the VM has other filesystems that look like operating systems,
this option can be used to select the root filesystem (a.k.a. C<C:>
drive or F</>) of the operating system that is to be converted.  The
Windows Recovery Console, certain attached DVD drives, and bugs in
libguestfs inspection heuristics, can make a guest look like a
multi-boot operating system.

The default in virt-v2v E<le> 0.7.1 was S<I<--root single>>, which
causes virt-v2v to die if a multi-boot operating system is found.

Since virt-v2v E<ge> 0.7.2 the default is now S<I<--root ask>>: If the
VM is found to be multi-boot, then virt-v2v will stop and list the
possible root filesystems and ask the user which to use.  This
requires that virt-v2v is run interactively.

S<I<--root first>> means to choose the first root device in the case
of a multi-boot operating system.  Since this is a heuristic, it may
sometimes choose the wrong one.

You can also name a specific root device, eg. S<I<--root /dev/sda2>>
would mean to use the second partition on the first hard drive.  If
the named root device does not exist or was not detected as a root
device, then virt-v2v will fail.

Note that there is a bug in grub which prevents it from successfully
booting a multiboot system if virtio is enabled.  Grub is only able to
boot an operating system from the first virtio disk.  Specifically,
F</boot> must be on the first virtio disk, and it cannot chainload an
OS which is not in the first virtio disk.

=item B<-v>

=item B<--verbose>

Enable verbose messages for debugging.

=item B<-V>

=item B<--version>

Display version number and exit.

=item B<-x>

Enable tracing of libguestfs API calls.

=back

=head1 XEN PARAVIRTUALIZED GUESTS

Older versions of virt-v2v could turn a Xen paravirtualized (PV) guest
into a KVM guest by installing a new kernel.  This version of virt-v2v
does I<not> attempt to install any new kernels.  Instead it will give
you an error if there are I<only> Xen PV kernels available.

Therefore before conversion you should check that a regular kernel is
installed.  For some older Linux distributions, this means installing
a kernel from the table below:

 RHEL 3         (Does not apply, as there was no Xen PV kernel)
 
 RHEL 4         i686 with > 10GB of RAM: install 'kernel-hugemem'
                i686 SMP: install 'kernel-smp'
                other i686: install 'kernel'
                x86-64 SMP with > 8 CPUs: install 'kernel-largesmp'
                x86-64 SMP: install 'kernel-smp'
                other x86-64: install 'kernel'
 
 RHEL 5         i686: install 'kernel-PAE'
                x86-64: install 'kernel'
 
 SLES 10        i586 with > 10GB of RAM: install 'kernel-bigsmp'
                i586 SMP: install 'kernel-smp'
                other i586: install 'kernel-default'
                x86-64 SMP: install 'kernel-smp'
                other x86-64: install 'kernel-default'
 
 SLES 11+       i586: install 'kernel-pae'
                x86-64: install 'kernel-default'

 Windows        (Does not apply, as there is no Xen PV Windows kernel)

=head1 ENABLING VIRTIO

"Virtio" is the name for a set of drivers which make disk (block
device), network and other guest operations work much faster on KVM.

Older versions of virt-v2v could install these drivers for certain
Linux guests.  This version of virt-v2v does I<not> attempt to install
new Linux kernels or drivers, but will warn you if they are not
installed already.

In order to enable virtio, and hence improve performance of the guest
after conversion, you should ensure that the B<minimum> versions of
packages are installed I<before> conversion, by consulting the table
below.

 RHEL 3         No virtio drivers are available
 
 RHEL 4         kernel >= 2.5.9-89.EL
                lvm2 >= 2.02.42-5.el4
                device-mapper >= 1.02.28-2.el4
                selinux-policy-targeted >= 1.17.30-2.152.el4
                policycoreutils >= 1.18.1-4.13
 
 RHEL 5         kernel >= 2.6.18-128.el5
                lvm2 >= 2.02.40-6.el5
                selinux-policy-targeted >= 2.4.6-203.el5
 
 RHEL 6+        All versions support virtio
 
 Fedora         All versions support virtio
 
 SLES 11+       All versions support virtio
 
 SLES 10        kernel >= 2.6.16.60-0.85.1
 
 OpenSUSE 11+   All versions support virtio
 
 OpenSUSE 10    kernel >= 2.6.25.5-1.1

 Debian 6+      All versions support virtio

 Ubuntu 10.04+  All versions support virtio

 Windows        Drivers are installed from the ISO or directory pointed
                to by "VIRTIO_WIN" environment variable if present

=head1 RHEL 4

=head2 SELinux relabel appears to hang forever

In RHEL E<le> 4.7 there was a bug which causes SELinux relabelling
to appear to hang forever at:

 *** Warning -- SELinux relabel is required. ***
 *** Disabling security enforcement.         ***
 *** Relabeling could take a very long time, ***
 *** depending on file system size.          ***

In reality it is waiting for you to press a key (but there is no
visual indication of this).  You can either hit the C<[Return]> key,
at which point the guest will finish relabelling and reboot, or you
can install policycoreutils E<ge> 1.18.1-4.13 before starting the v2v
conversion.  See also
L<https://bugzilla.redhat.com/show_bug.cgi?id=244636>

=head1 DEBIAN AND UBUNTU

=head2 "warning: could not determine a way to update the configuration of Grub2"

Currently, virt-v2v has no way to set the default kernel in Debian
and Ubuntu guests using GRUB 2 as bootloader.  This means that
virt-v2v will not change the default kernel used for booting, even
in case it is not the best kernel available on the guest.
A recommended procedure is, before using virt-v2v, to check that the
boot kernel is the best kernel available in the guest (for example
by making sure the guest is up-to-date).

=head2 "vsyscall attempted with vsyscall=none"

When run on a recent Debian host virt-v2v may fail to convert guests
which were created before 2013.  In the debugging output you will see
a crash message similar to:

 vsyscall attempted with vsyscall=none ip:...
 segfault at ...

This is caused because Debian removed support for running old binaries
which used the legacy vsyscall page to call into the kernel.

You can work around this problem by running this command before
running virt-v2v:

 export LIBGUESTFS_APPEND="vsyscall=emulate"

For more information, see L<https://bugzilla.redhat.com/1592061>

=head1 WINDOWS

=head2 Windows E<ge> 8 Fast Startup is incompatible with virt-v2v

Guests which use the Windows E<ge> 8 "Fast Startup" feature (or guests
which are hibernated) cannot be converted with virt-v2v.  You will see
an error:

 virt-v2v: error: unable to mount the disk image for writing. This has
 probably happened because Windows Hibernation or Fast Restart is being
 used in this guest. You have to disable this (in the guest) in order
 to use virt-v2v.

As the message says, you need to boot the guest and disable the "Fast
Startup" feature (Control Panel → Power Options → Choose what the
power buttons do → Change settings that are currently unavailable →
Turn on fast startup), and shut down the guest, and then you will be
able to convert it.

For more information, see:
L<guestfs(3)/WINDOWS HIBERNATION AND WINDOWS 8 FAST STARTUP>.

=head2 Boot failure: 0x0000007B

This boot failure is caused by Windows being unable to find or load
the right disk driver (eg. F<viostor.sys>).  If you experience this
error, here are some things to check:

=over 4

=item *

First ensure that the guest boots on the source hypervisor before
conversion.

=item *

Check you have the Windows virtio drivers available in
F</usr/share/virtio-win>, and that virt-v2v did not print any warning
about not being able to install virtio drivers.

On S<Red Hat Enterprise Linux 7>, you will need to install the signed
drivers available in the C<virtio-win> package.  If you do not have
access to the signed drivers, then you will probably need to disable
driver signing in the boot menus.

=item *

Check that you are presenting a virtio-blk interface (B<not>
virtio-scsi and B<not> ide) to the guest.  On the qemu/KVM command
line you should see something similar to this:

 ... -drive file=windows-sda,if=virtio ...

In libvirt XML, you should see:

 <target dev='vda' bus='virtio'/>

=item *

Check that Windows Group Policy does not prevent the driver from being
installed or used.  Try deleting Windows Group Policy before
conversion.

=item *

Check there is no anti-virus or other software which implements Group
Policy-like prohibitions on installing or using new drivers.

=item *

Enable boot debugging and check the F<viostor.sys> driver is being
loaded.

=back

=head2 OpenStack and Windows reactivation

OpenStack does not offer stable device / PCI addresses to guests.
Every time it creates or starts a guest, it regenerates the libvirt
XML for that guest from scratch.  The libvirt XML will have no
E<lt>addressE<gt> fields.  Libvirt will then assign addresses to
devices, in a predictable manner.  Addresses may change if any of the
following are true:

=over 4

=item *

A new disk or network device has been added or removed from the guest.

=item *

The version of OpenStack or (possibly) libvirt has changed.

=back

Because Windows does not like "hardware" changes of this kind, it may
trigger Windows reactivation.

This can also prevent booting with a 7B error [see previous section]
if the guest has group policy containing
C<Device Installation Restrictions>.

=head2 Support for SHA-2 certificates in Windows 7 and Windows Server 2008 R2

Later versions of the Windows virtio drivers are signed using SHA-2
certificates (instead of SHA-1).  The original shipping Windows 7 and
Windows Server 2008 R2 did not understand SHA-2 certificates and so
the Windows virtio drivers will not install properly.

To fix this you must apply SHA-2 Code Signing Support from:
L<https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2015/3033929>
before converting the guest.

For further information see:
L<https://bugzilla.redhat.com/show_bug.cgi?id=1624878>

=head1 UEFI

VMware allows you to present UEFI firmware to guests (instead of the
ordinary PC BIOS).  Virt-v2v can convert these guests, but requires
that UEFI is supported by the target hypervisor.

Currently KVM supports OVMF, an open source UEFI firmware, and can run
these guests.

Since OVMF support was only recently added to KVM (in 2014/2015), not
all target environments support UEFI guests yet:

=over 4

=item UEFI on libvirt, qemu

Supported.  Virt-v2v will generate the correct libvirt XML (metadata)
automatically, but note that the same version of OVMF must be
installed on the conversion host as is installed on the target
hypervisor, else you will have to adjust paths in the metadata.

=item UEFI on OpenStack

Not supported.

=item UEFI on RHV

Not supported.

=back

=head1 NETWORKS AND BRIDGES

Guests are usually connected to one or more networks, and when
converted to the target hypervisor you usually want to reconnect those
networks at the destination.  The options I<--network> and I<--bridge>
allow you to do that.

If you are unsure of what networks and bridges are in use on the
source hypervisor, then you can examine the source metadata (libvirt
XML, vCenter information, etc.).  Or you can run virt-v2v with the
I<--print-source> option which causes virt-v2v to print out the
information it has about the guest on the source and then exit.

In the I<--print-source> output you will see a section showing the
guest’s Network Interface Cards (NICs):

 $ virt-v2v [-i ...] --print-source name
 [...]
 NICs:
     Network "default" mac: 52:54:00:d0:cf:0e

Bridges are special classes of network devices which are attached to a
named external network on the source hypervisor, for example:

 $ virt-v2v [-i ...] --print-source name
 [...]
 NICs:
     Bridge "br0"

To map a specific bridge to a target network, for example C<br0> on
the source to C<ovirtmgmt> on the target, use:

 virt-v2v [...] --bridge br0:ovirtmgmt

To map every bridge to a target network, use:

 virt-v2v [...] --bridge ovirtmgmt

=head1 INPUT FROM VMWARE VCENTER SERVER

Virt-v2v is able to import guests from VMware vCenter Server.

vCenter E<ge> 5.0 is required.  If you don’t have vCenter, using OVA
or VMX is recommended instead (see L</INPUT FROM VMWARE OVA> and/or
L</INPUT FROM VMWARE VMX> below), or if that is not possible then see
L</INPUT FROM VMWARE ESXi HYPERVISOR>.

Virt-v2v uses libvirt for access to vCenter, and therefore the input
mode should be I<-i libvirt>.  As this is the default, you don't need
to specify it on the command line.

=head2 VCENTER: REMOVE VMWARE TOOLS FROM WINDOWS GUESTS

For Windows guests, you should remove VMware tools before conversion.
Although this is not strictly necessary, and the guest will still be
able to run, if you don't do this then the converted guest will
complain on every boot.  The tools cannot be removed after conversion
because the uninstaller checks if it is running on VMware and refuses
to start (which is also the reason that virt-v2v cannot remove them).

This is not necessary for Linux guests, as virt-v2v is able to remove
VMware tools.

=head2 VCENTER: URI

The libvirt URI of a vCenter server looks something like this:

 vpx://user@server/Datacenter/esxi

where:

=over 4

=item C<user@>

is the (optional, but recommended) user to connect as.

If the username contains a backslash (eg. C<DOMAIN\USER>) then you
will need to URI-escape that character using C<%5c>: C<DOMAIN%5cUSER>
(5c is the hexadecimal ASCII code for backslash.)  Other punctuation
may also have to be escaped.

=item C<server>

is the vCenter Server (I<not> hypervisor).

=item C<Datacenter>

is the name of the datacenter.

If the name contains a space, replace it with the URI-escape code
C<%20>.

=item C<esxi>

is the name of the ESXi hypervisor running the guest.

=back

If the VMware deployment is using folders, then these may need to be
added to the URI, eg:

 vpx://user@server/Folder/Datacenter/esxi

For full details of libvirt URIs, see: L<http://libvirt.org/drvesx.html>

Typical errors from libvirt / virsh when the URI is wrong include:

=over 4

=item *

Could not find datacenter specified in [...]

=item *

Could not find compute resource specified in [...]

=item *

Path [...] does not specify a compute resource

=item *

Path [...] does not specify a host system

=item *

Could not find host system specified in [...]

=back

=head2 VCENTER: TEST LIBVIRT CONNECTION TO VCENTER

Use the L<virsh(1)> command to list the guests on the vCenter Server
like this:

 $ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi' list --all
 Enter root's password for vcenter.example.com: ***
 
  Id    Name                           State
 ----------------------------------------------------
  -     Fedora 20                      shut off
  -     Windows 2003                   shut off

If you get an error "Peer certificate cannot be authenticated with
given CA certificates" or similar, then you can either import the
vCenter host’s certificate, or bypass signature verification by adding
the C<?no_verify=1> flag:

 $ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' list --all

You should also try dumping the metadata from any guest on your
server, like this:

 $ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi' dumpxml "Windows 2003"
 <domain type='vmware'>
   <name>Windows 2003</name>
   [...]
 </domain>

B<If the above commands do not work, then virt-v2v is not going to
work either>.  Fix your libvirt configuration and/or your VMware
vCenter Server before continuing.

=head2 VCENTER: IMPORTING A GUEST

To import a particular guest from vCenter Server, do:

 $ virt-v2v -ic 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' \
   "Windows 2003" \
   -o local -os /var/tmp

where C<Windows 2003> is the name of the guest (which must be shut
down).

Note that you may be asked for the vCenter password I<twice>.  This
happens once because libvirt needs it, and a second time because
virt-v2v itself connects directly to the server.  Use
I<--password-file> to supply a password via a file.

In this case the output flags are set to write the converted guest to
a temporary directory as this is just an example, but you can also
write to libvirt or any other supported target.

=head2 VCENTER: NON-ADMINISTRATOR ROLE

Instead of using the vCenter Administrator role, you can create a
custom non-administrator role to perform the conversion.  You will
however need to give it a minimum set of permissions as follows
(using VMware vCenter 6.5):

=over 4

=item 1.

Create a custom role in vCenter.

=item 2.

Enable (check) the following objects:

 Datastore:
  - Browse datastore
  - Low level file operations
 
 Sessions:
  - Validate session
 
 Virtual Machine:
   Interaction:
     - Guest operating system management by VIX API
   Provisioning:
     - Allow disk access
     - Allow read-only disk access

=back

=head2 VCENTER: FIREWALL AND PROXY SETTINGS

=head3 vCenter: Ports

If there is a firewall between the virt-v2v conversion server and the
vCenter server, then you will need to open port 443 (https) and port
5480.

Port 443 is used to copy the guest disk image(s).  Port 5480 is used
to query vCenter for guest metadata.

These port numbers are only the defaults.  It is possible to
reconfigure vCenter to use other port numbers.  In that case you would
need to specify those ports in the C<vpx://> URI.
See L</VCENTER: URI> above.

These ports only apply to virt-v2v conversions.  You may have to open
other ports for other vCenter functionality, for example the web user
interface.  VMware documents the required ports for vCenter in their
online documentation.

 ┌────────────┐   port 443 ┌────────────┐        ┌────────────┐
 │ virt-v2v   │────────────▶ vCenter    │────────▶ ESXi       │
 │ conversion │────────────▶ server     │        │ hypervisor │
 │ server     │  port 5480 │            │        │   ┌─────┐  │
 └────────────┘            └────────────┘        │   │guest│  │
                                                 └───┴─────┴──┘

(In the diagram above the arrows show the direction in which the TCP
connection is initiated, I<not> necessarily the direction of data
transfer.)

Virt-v2v itself does not connect directly to the ESXi hypervisor
containing the guest.  However vCenter connects to the hypervisor and
forwards the information, so if you have a firewall between vCenter
and its hypervisors you may need to open additional ports (consult
VMware documentation).

The proxy environment variables (C<https_proxy>, C<all_proxy>,
C<no_proxy>, C<HTTPS_PROXY>, C<ALL_PROXY> and C<NO_PROXY>) are
B<ignored> when doing vCenter conversions.

=head2 VCENTER: SSL/TLS CERTIFICATE PROBLEMS

You may see this error:

  CURL: Error opening file: SSL: no alternative certificate subject
  name matches target host name

(You may need to enable debugging with ‘virt-v2v -v -x’ to see this
message).

This can be caused by using an IP address instead of the
fully-qualified DNS domain name of the vCenter server, ie.  use
C<vpx://vcenter.example.com/...> instead of C<vpx://11.22.33.44/...>

Another certificate problem can be caused by the vCenter server having
a mismatching FQDN and IP address, for example if the server acquired
a new IP address from DHCP.  To fix this you need to change your DHCP
server or network configuration so that the vCenter server always gets
a stable IP address.  After that log in to the vCenter server’s admin
console at C<https://vcenter:5480/>.  Under the C<Admin> tab, select
C<Certificate regeneration enabled> and then reboot it.

=head1 INPUT FROM VMWARE OVA

Virt-v2v is able to import guests from VMware’s OVA (Open
Virtualization Appliance) files.  Only OVAs exported from VMware
vSphere will work.

=head2 OVA: REMOVE VMWARE TOOLS FROM WINDOWS GUESTS

For Windows guests, you should remove VMware tools before conversion.
Although this is not strictly necessary, and the guest will still be
able to run, if you don't do this then the converted guest will
complain on every boot.  The tools cannot be removed after conversion
because the uninstaller checks if it is running on VMware and refuses
to start (which is also the reason that virt-v2v cannot remove them).

This is not necessary for Linux guests, as virt-v2v is able to remove
VMware tools.

=head2 OVA: CREATE OVA

To create an OVA in vSphere, use the "Export OVF Template" option
(from the VM context menu, or from the File menu).  Either "Folder of
files" (OVF) or "Single file" (OVA) will work, but OVA is probably
easier to deal with.  OVA files are really just uncompressed tar
files, so you can use commands like C<tar tf VM.ova> to view their
contents.

=head3 Create OVA with ovftool

You can also use VMware’s proprietary C<ovftool>:

 ovftool --noSSLVerify \
   vi://USER:PASSWORD@esxi.example.com/VM \
   VM.ova

To connect to vCenter:

 ovftool  --noSSLVerify \
   vi://USER:PASSWORD@vcenter.example.com/DATACENTER-NAME/vm/VM \
   VM.ova

For Active Directory-aware authentication, you have to express the
C<@> character in the form of its ascii hex-code (C<%5c>):

 vi://DOMAIN%5cUSER:PASSWORD@...

=head2 OVA: IMPORTING A GUEST

To import an OVA file called F<VM.ova>, do:

 $ virt-v2v -i ova VM.ova -o local -os /var/tmp

If you exported the guest as a "Folder of files", I<or> if you
unpacked the OVA tarball yourself, then you can point virt-v2v at the
directory containing the files:

 $ virt-v2v -i ova /path/to/files -o local -os /var/tmp

=head1 INPUT FROM VMWARE VMX

Virt-v2v is able to import guests from VMware’s vmx files.

This is useful in two cases:

=over 4

=item 1.

VMware virtual machines are stored on a separate NFS server and you
are able to mount the NFS storage directly.

=item 2.

You have enabled SSH access to the VMware ESXi hypervisor and there is
a C</vmfs/volumes> folder containing the virtual machines.

=back

If you find a folder of files called F<I<guest>.vmx>,
F<I<guest>.vmxf>, F<I<guest>.nvram> and one or more F<.vmdk> disk
images, then you can use this method.

=head2 VMX: REMOVE VMWARE TOOLS FROM WINDOWS GUESTS

For Windows guests, you should remove VMware tools before conversion.
Although this is not strictly necessary, and the guest will still be
able to run, if you don't do this then the converted guest will
complain on every boot.  The tools cannot be removed after conversion
because the uninstaller checks if it is running on VMware and refuses
to start (which is also the reason that virt-v2v cannot remove them).

This is not necessary for Linux guests, as virt-v2v is able to remove
VMware tools.

=head2 VMX: GUEST MUST BE SHUT DOWN

B<The guest must be shut down before conversion starts>.  If you don't
shut it down, you will end up with a corrupted VM disk on the target.
With other methods, virt-v2v tries to prevent concurrent access, but
because the I<-i vmx> method works directly against the storage,
checking for concurrent access is not possible.

=head2 VMX: ACCESS TO THE STORAGE CONTAINING THE VMX AND VMDK FILES

If the vmx and vmdk files aren't available locally then you must
I<either> mount the NFS storage on the conversion server I<or> enable
passwordless SSH on the ESXi hypervisor.

=head3 VMX: Passwordless SSH using ssh-agent

You must also use ssh-agent, and add your ssh public key to
F</etc/ssh/keys-root/authorized_keys> (on the ESXi hypervisor).

After doing this, you should check that passwordless access works from
the virt-v2v server to the ESXi hypervisor.  For example:

 $ ssh root@esxi.example.com
 [ logs straight into the shell, no password is requested ]

Note that password-interactive and Kerberos access are B<not>
supported.  You B<have> to set up ssh access using ssh-agent and
authorized_keys.

=head3 VMX: Construct the SSH URI

When using the SSH input transport you must specify a remote
C<ssh://...> URI pointing to the VMX file.  A typical URI looks like:

 ssh://root@esxi.example.com/vmfs/volumes/datastore1/my%20guest/my%20guest.vmx

Any space must be escaped with C<%20> and other non-ASCII characters
may also need to be URI-escaped.

The username is not required if it is the same as your local username.

You may optionally supply a port number after the hostname if the SSH
server is not listening on the default port (22).

=head2 VMX: IMPORTING A GUEST

To import a vmx file from a local file or NFS, do:

 $ virt-v2v -i vmx guest.vmx -o local -os /var/tmp

To import a vmx file over SSH, add I<-it ssh> to select the SSH
transport and supply a remote SSH URI:

 $ virt-v2v \
     -i vmx -it ssh \
     "ssh://root@esxi.example.com/vmfs/volumes/datastore1/guest/guest.vmx" \
     -o local -os /var/tmp

Virt-v2v processes the vmx file and uses it to find the location of
any vmdk disks.

=head1 INPUT FROM VMWARE ESXi HYPERVISOR

You should use the OVA or VMX methods above (see L</INPUT FROM VMWARE
OVA> and/or L</INPUT FROM VMWARE VMX>) if possible, as they are much
faster and require much less disk space than the method described in
this section.

You can use the L<virt-v2v-copy-to-local(1)> tool to copy the guest
off the hypervisor into a local file, and then convert it.

=head2 ESXi: REMOVE VMWARE TOOLS FROM WINDOWS GUESTS

For Windows guests, you should remove VMware tools before conversion.
Although this is not strictly necessary, and the guest will still be
able to run, if you don't do this then the converted guest will
complain on every boot.  The tools cannot be removed after conversion
because the uninstaller checks if it is running on VMware and refuses
to start (which is also the reason that virt-v2v cannot remove them).

This is not necessary for Linux guests, as virt-v2v is able to remove
VMware tools.

=head2 ESXi: URI

The libvirt URI for VMware ESXi hypervisors will look something like this:

 esx://root@esxi.example.com?no_verify=1

The C<?no_verify=1> parameter disables TLS certificate checking.

=head2 ESXi: TEST LIBVIRT CONNECTION TO ESXi HYPERVISOR

Use the L<virsh(1)> command to test the URI and list the remote guests
available:

 $ virsh -c esx://root@esxi.example.com?no_verify=1 list --all
 Enter root's password for esxi.example.com: ***
  Id    Name                           State
 ----------------------------------------------------
  -     guest                          shut off

=head2 ESXi: COPY THE GUEST TO THE LOCAL MACHINE

Using the libvirt URI as the I<-ic> option, copy one of the guests to
the local machine:

 $ virt-v2v-copy-to-local -ic esx://root@esxi.example.com?no_verify=1 guest

This creates F<guest.xml>, F<guest-disk1>, ...

=head2 ESXi: DO THE VIRT-V2V CONVERSION

Perform the conversion of the guest using virt-v2v:

 $ virt-v2v -i libvirtxml guest.xml -o local -os /var/tmp

=head2 ESXi: CLEAN UP

Remove the F<guest.xml> and F<guest-disk*> files.

=head1 INPUT FROM VDDK

Virt-v2v is able to import guests using VMware’s proprietary VDDK
library (a.k.a. VixDiskLib).

=head2 VDDK: PREREQUISITES

=over 4

=item 1.

As the VDDK library is not open source, and the license of this
library does not permit redistribution or commercial use, you must
obtain VDDK yourself and satisfy yourself that your usage of the
library is permitted by the license.

=item 2.

nbdkit E<ge> 1.6 is recommended, as it ships with the VDDK plugin
enabled unconditionally.

=item 3.

You must find the SSL "thumbprint" of your VMware server.  How to do
this is explained in L<nbdkit-vddk-plugin(1)>, also available at the
link above.

=item 4.

VDDK imports require a feature added in libvirt E<ge> 3.7.

=back

=head2 VDDK: URI

Construct the correct C<vpx://> (for vCenter) or C<esx://> (for ESXi)
URL.  It will look something like these:

 vpx://root@vcenter.example.com/Datacenter/esxi

 esx://root@esxi.example.com

To verify that you have the correct URL, use the L<virsh(1)> command
to list the guests on the server:

 $ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi' list --all
 Enter root's password for vcenter.example.com: ***
 
  Id    Name                           State
 ----------------------------------------------------
  -     Fedora 20                      shut off
  -     Windows 2003                   shut off

If you get an error "Peer certificate cannot be authenticated with
given CA certificates" or similar, then you can either import the
vCenter host’s certificate, or bypass signature verification by adding
the C<?no_verify=1> flag:

 $ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' list --all

You should also try dumping the metadata from any guest on your
server, like this:

 $ virsh -c 'vpx://root@vcenter.example.com/Datacenter/esxi' dumpxml "Windows 2003"
 <domain type='vmware'>
   <name>Windows 2003</name>
   [...]
   <vmware:moref>vm-123</vmware:moref>
 </domain>

If C<E<lt>vmware:morefE<gt>> does not appear in the metadata, then you
need to upgrade libvirt.

B<If the above commands do not work, then virt-v2v is not going to
work either>.  Fix your URI and/or your VMware server before
continuing.

=head2 VDDK: IMPORTING A GUEST

The I<-it vddk> parameter selects VDDK as the input transport for disks.

To import a particular guest from vCenter server or ESXi hypervisor,
use a command like the following, substituting the URI, guest name and
SSL thumbprint:

 $ export PATH=/path/to/nbdkit-1.1.x:$PATH
 $ virt-v2v \
     -ic 'vpx://root@vcenter.example.com/Datacenter/esxi?no_verify=1' \
     -it vddk \
     -io vddk-libdir=/path/to/vmware-vix-disklib-distrib \
     -io vddk-thumbprint=xx:xx:xx:... \
     "Windows 2003" \
     -o local -os /var/tmp

Other options that you might need to add in rare circumstances include
I<-io vddk-config>, I<-io vddk-cookie>, I<-io vddk-nfchostport>,
I<-io vddk-port>, I<-io vddk-snapshot>, I<-io vddk-transports> and
I<-io vddk-vimapiver>, which are all explained in the
L<nbdkit-vddk-plugin(1)> documentation.

=head2 VDDK: DEBUGGING VDDK FAILURES

The VDDK library can be operated in a verbose mode where it gives
(very) verbose messages.  Use ‘virt-v2v -v -x’ as usual to enable
verbose messages.

=head1 INPUT FROM XEN

Virt-v2v is able to import Xen guests from RHEL 5 Xen hosts.

Virt-v2v uses libvirt for access to the remote Xen host, and therefore
the input mode should be I<-i libvirt>.  As this is the default, you
don't need to specify it on the command line.

=head2 XEN: SET UP SSH-AGENT ACCESS TO XEN HOST

Currently you must enable passwordless SSH access to the remote Xen host
from the virt-v2v conversion server.

You must also use ssh-agent, and add your ssh public key to
F</root/.ssh/authorized_keys> (on the Xen host).

After doing this, you should check that passwordless access works
from the virt-v2v server to the Xen host.  For example:

 $ ssh root@xen.example.com
 [ logs straight into the shell, no password is requested ]

Note that password-interactive and Kerberos access are B<not>
supported.  You B<have> to set up ssh access using ssh-agent and
authorized_keys.

With some modern ssh implementations, legacy crypto policies required
to interoperate with RHEL 5 sshd are disabled.  To enable them you may
need to run this command on the conversion server (ie. ssh client),
but read L<update-crypto-policies(8)> first:

 # update-crypto-policies LEGACY

=head2 XEN: TEST LIBVIRT CONNECTION TO REMOTE XEN HOST

Use the L<virsh(1)> command to list the guests on the remote Xen host:

 $ virsh -c xen+ssh://root@xen.example.com list --all
  Id    Name                           State
 ----------------------------------------------------
  0     Domain-0                       running
  -     rhel49-x86_64-pv               shut off

You should also try dumping the metadata from any guest on your
server, like this:

 $ virsh -c xen+ssh://root@xen.example.com dumpxml rhel49-x86_64-pv
 <domain type='xen'>
   <name>rhel49-x86_64-pv</name>
   [...]
 </domain>

B<If the above commands do not work, then virt-v2v is not going to
work either>.  Fix your libvirt configuration or the remote server
before continuing.

B<If the guest disks are located on a host block device>, then the
conversion will fail.  See L</XEN OR SSH CONVERSIONS FROM BLOCK DEVICES>
below for a workaround.

=head2 XEN: IMPORTING A GUEST

To import a particular guest from a Xen server, do:

 $ LIBGUESTFS_BACKEND=direct \
       virt-v2v -ic 'xen+ssh://root@xen.example.com' \
           rhel49-x86_64-pv \
           -o local -os /var/tmp

where C<rhel49-x86_64-pv> is the name of the guest (which must be shut
down).

In this case the output flags are set to write the converted guest to
a temporary directory as this is just an example, but you can also
write to libvirt or any other supported target.

Setting the L<backend|guestfs(3)/BACKEND> to C<direct> is a temporary
workaround until
L<libvirt bug 1140166|https://bugzilla.redhat.com/1140166> is fixed.

=head2 XEN OR SSH CONVERSIONS FROM BLOCK DEVICES

Currently virt-v2v cannot directly access a Xen guest (or any guest
located remotely over ssh) if that guest’s disks are located on host
block devices.

To tell if a Xen guest uses host block devices, look at the guest XML.
You will see:

  <disk type='block' device='disk'>
    ...
    <source dev='/dev/VG/guest'/>

where C<type='block'>, C<source dev=> and C</dev/...> are all
indications that the disk is located on a host block device.

This happens because the qemu ssh block driver that we use to access
remote disks uses the ssh sftp protocol, and this protocol cannot
correctly detect the size of host block devices.

The workaround is to copy the guest over to the conversion server,
using the separate L<virt-v2v-copy-to-local(1)> tool, followed by
running virt-v2v.  You will need sufficient space on the conversion
server to store a full copy of the guest.

 virt-v2v-copy-to-local -ic xen+ssh://root@xen.example.com guest
 virt-v2v -i libvirtxml guest.xml -o local -os /var/tmp
 rm guest.xml guest-disk*

=head1 OUTPUT TO LIBVIRT

The I<-o libvirt> option lets you upload the converted guest to
a libvirt-managed host.  There are several limitations:

=over 4

=item *

You can only use a local libvirt connection [see below for how to
workaround this].

=item *

The I<-os pool> option must specify a directory pool, not anything
more exotic such as iSCSI [but see below].

=item *

You can only upload to a KVM hypervisor.

=back

B<To output to a remote libvirt instance and/or a non-directory storage pool>
you have to use the following workaround:

=over 4

=item 1.

Use virt-v2v in I<-o local> mode to convert the guest disks and
metadata into a local temporary directory:

 virt-v2v [...] -o local -os /var/tmp

This creates two (or more) files in F</var/tmp> called:

 /var/tmp/NAME.xml     # the libvirt XML (metadata)
 /var/tmp/NAME-sda     # the guest’s first disk

(for C<NAME> substitute the guest’s name).

=item 2.

Upload the converted disk(s) into the storage pool called C<POOL>:

 size=$(stat -c%s /var/tmp/NAME-sda)
 virsh vol-create-as POOL NAME-sda $size --format raw
 virsh vol-upload --pool POOL NAME-sda /var/tmp/NAME-sda

=item 3.

Edit F</var/tmp/NAME.xml> to change F</var/tmp/NAME-sda> to the pool
name.  In other words, locate the following bit of XML:

 <disk type='file' device='disk'>
   <driver name='qemu' type='raw' cache='none' />
   <source file='/var/tmp/NAME-sda' />
   <target dev='hda' bus='ide' />
 </disk>

and change two things: The C<type='file'> attribute must be changed to
C<type='volume'>, and the C<E<lt>sourceE<gt>> element must be changed
to include C<pool> and C<volume> attributes:

 <disk type='volume' device='disk'>
   ...
   <source pool='POOL' volume='NAME-sda' />
   ...
 </disk>

=item 4.

Define the final guest in libvirt:

 virsh define /var/tmp/NAME.xml

=back

=head1 OUTPUT TO RHV

This new method to upload guests to oVirt or RHV directly via the REST
API requires oVirt/RHV E<ge> 4.2.

You need to specify I<-o rhv-upload> as well as the following extra
parameters:

=over 4

=item I<-oc> C<https://ovirt-engine.example.com/ovirt-engine/api>

The URL of the REST API which is usually the server name with
C</ovirt-engine/api> appended, but might be different if you installed
oVirt Engine on a different path.

You can optionally add a username and port number to the URL.  If the
username is not specified then virt-v2v defaults to using
C<admin@internal> which is the typical superuser account for oVirt
instances.

=item I<-op> F<password-file>

A file containing a password to be used when connecting to the oVirt
engine.  Note the file should contain the whole password, B<without
any trailing newline>, and for security the file should have mode
C<0600> so that others cannot read it.

=item I<-os> C<ovirt-data>

The storage domain.

=item I<-oo rhv-cafile=>F<ca.pem>

The F<ca.pem> file (Certificate Authority), copied from
F</etc/pki/ovirt-engine/ca.pem> on the oVirt engine.

=item I<-oo rhv-cluster=>C<CLUSTERNAME>

Set the RHV Cluster Name.  If not given it uses C<Default>.

=item I<-oo rhv-direct>

If this option is given then virt-v2v will attempt to directly upload
the disk to the oVirt node, otherwise it will proxy the upload through
the oVirt engine.  Direct upload requires that you have network access
to the oVirt nodes.  Non-direct upload is slightly slower but should
work in all situations.

=item I<-oo rhv-verifypeer>

Verify the oVirt/RHV server’s identity by checking the server‘s
certificate against the Certificate Authority.

=back

=head1 OUTPUT TO RHV (OLD METHOD)

This section only applies to the I<-o rhv> output mode.  If you use
virt-v2v from the RHV-M user interface, then behind the scenes the
import is managed by VDSM using the I<-o vdsm> output mode (which end
users should not try to use directly).

You have to specify I<-o rhv> and an I<-os> option that points to the
RHV-M Export Storage Domain.  You can either specify the NFS server
and mountpoint, eg. S<C<-os rhv-storage:/rhv/export>>, or you can
mount that first and point to the directory where it is mounted,
eg. S<C<-os /tmp/mnt>>.  Be careful not to point to the Data Storage
Domain by accident as that will not work.

On successful completion virt-v2v will have written the new guest to
the Export Storage Domain, but it will not yet be ready to run.  It
must be imported into RHV using the UI before it can be used.

In RHV E<ge> 2.2 this is done from the Storage tab.  Select the
export domain the guest was written to.  A pane will appear underneath
the storage domain list displaying several tabs, one of which is "VM
Import".  The converted guest will be listed here.  Select the
appropriate guest an click "Import".  See the RHV documentation for
additional details.

If you export several guests, then you can import them all at the same
time through the UI.

=head2 RHV: TESTING RHV CONVERSIONS

If you do not have an oVirt or RHV instance to test against, then you
can test conversions by creating a directory structure which looks
enough like a RHV-M Export Storage Domain to trick virt-v2v:

 uuid=`uuidgen`
 mkdir /tmp/rhv
 mkdir /tmp/rhv/$uuid
 mkdir /tmp/rhv/$uuid/images
 mkdir /tmp/rhv/$uuid/master
 mkdir /tmp/rhv/$uuid/master/vms
 touch /tmp/rhv/$uuid/dom_md
 virt-v2v [...] -o rhv -os /tmp/rhv

=head1 OUTPUT TO GLANCE

To output to OpenStack Glance, use the I<-o glance> option.

This runs the L<glance(1)> CLI program which must be installed on the
virt-v2v conversion host.  For authentication to work, you will need
to set C<OS_*> environment variables.  In most cases you can do this
by sourcing a file called something like F<keystonerc_admin>.

Virt-v2v adds metadata for the guest to Glance, describing such things
as the guest operating system and what drivers it requires.  The
command C<glance image-show> will display the metadata as "Property"
fields such as C<os_type> and C<hw_disk_bus>.

=head2 Glance and sparseness

Glance image upload doesn't appear to correctly handle sparseness.
For this reason, using qcow2 will be faster and use less space on the
Glance server.  Use the virt-v2v S<I<-of qcow2>> option.

=head2 Glance and multiple disks

If the guest has a single disk, then the name of the disk in Glance
will be the name of the guest.  You can control this using the I<-on>
option.

Glance doesn't have a concept of associating multiple disks with a
single guest, and Nova doesn't allow you to boot a guest from multiple
Glance disks either.  If the guest has multiple disks, then the first
(assumed to be the system disk) will have the name of the guest, and
the second and subsequent data disks will be called
C<I<guestname>-disk2>, C<I<guestname>-disk3> etc.  It may be best to
leave the system disk in Glance, and import the data disks to Cinder
(see next section).

=head2 Importing disks into Cinder

Since most virt-v2v guests are "pets", Glance is perhaps not the best
place to store them.  There is no way for virt-v2v to upload directly
to Cinder (L<https://bugzilla.redhat.com/1155229>).  There are two
ways to upload to Cinder:

=over 4

=item 1.

Import the image to Glance first (ie. I<-o glance>) and then copy it
to Cinder:

 cinder create --image-id <GLANCE-IMAGE-UUID> <SIZE>

=item 2.

Create (through some other means) a new volume / LUN in your Cinder
backing store.  Migrate the guest to this volume (using I<-o local>).
Then ask Cinder to take over management of the volume using:

 cinder manage <VOLUMEREF>

=back

=head1 RESOURCE REQUIREMENTS

=head2 Network

The most important resource for virt-v2v appears to be network
bandwidth.  Virt-v2v should be able to copy guest data at gigabit
ethernet speeds or greater.

Ensure that the network connections between servers (conversion
server, NFS server, vCenter, Xen) are as fast and as low latency as
possible.

=head2 Disk space

Virt-v2v places potentially large temporary files in C<$TMPDIR> (which
is F</var/tmp> if you don't set it).  Using tmpfs is a bad idea.

For each guest disk, an overlay is stored temporarily.  This stores
the changes made during conversion, and is used as a cache.  The
overlays are not particularly large - tens or low hundreds of
megabytes per disk is typical.  In addition to the overlay(s), input
and output methods may use disk space, as outlined in the table below.

=over 4

=item I<-i ova>

This temporarily places a full copy of the uncompressed source disks
in C<$TMPDIR>.

=item I<-o glance>

This temporarily places a full copy of the output disks in C<$TMPDIR>.

=item I<-o local>

=item I<-o qemu>

You must ensure there is sufficient space in the output directory for
the converted guest.

=back

See also L</Minimum free space check in the host> below.

=head2 VMware vCenter resources

Copying from VMware vCenter is currently quite slow, but we believe
this to be an issue with VMware.  Ensuring the VMware ESXi hypervisor
and vCenter are running on fast hardware with plenty of memory should
alleviate this.

=head2 Compute power and RAM

Virt-v2v is not especially compute or RAM intensive.  If you are
running many parallel conversions, then you may consider allocating
one CPU core and 2 GB of RAM per running instance.

Virt-v2v can be run in a virtual machine.

=head2 Trimming

Virt-v2v attempts to optimize the speed of conversion by ignoring
guest filesystem data which is not used.  This would include unused
filesystem blocks, blocks containing zeroes, and deleted files.

To do this, virt-v2v issues a non-destructive L<fstrim(8)> operation.
As this happens to an overlay placed over the guest data, it does
B<not> affect the source in any way.

If this fstrim operation fails, you will see a warning, but virt-v2v
will continue anyway.  It may run more slowly (in some cases much more
slowly), because it is copying the unused parts of the disk.

Unfortunately support for fstrim is not universal, and it also depends
on specific details of the filesystem, partition alignment, and
backing storage.  As an example, NTFS filesystems cannot be fstrimmed
if they occupy a partition which is not aligned to the underlying
storage.  That was the default on Windows before Vista.  As another
example, VFAT filesystems (used by UEFI guests) cannot be trimmed at
all.

fstrim support in the Linux kernel is improving gradually, so over
time some of these restrictions will be lifted and virt-v2v will work
faster.

=head1 POST-CONVERSION TASKS

=head2 Guest network configuration

Virt-v2v cannot currently reconfigure a guest’s network configuration.
If the converted guest is not connected to the same subnet as the
source, its network configuration may have to be updated.  See also
L<virt-customize(1)>.

=head2 Converting a Windows guest

When converting a Windows guests, the conversion process is split into
two stages:

=over

=item 1

Offline conversion.

=item 2

First boot.

=back

The guest will be bootable after the offline conversion stage, but
will not yet have all necessary drivers installed to work correctly.
These will be installed automatically the first time the guest boots.

B<N.B.> Take care not to interrupt the automatic driver installation
process when logging in to the guest for the first time, as this may
prevent the guest from subsequently booting correctly.

=head1 FREE SPACE FOR CONVERSION

=head2 Free space in the guest

Virt-v2v checks there is sufficient free space in the guest filesystem
to perform the conversion.  Currently it checks:

=over 4

=item Linux root filesystem or Windows C<C:> drive

Minimum free space: 20 MB

=item Linux F</boot>

Minimum free space: 50 MB

This is because we need to build a new initramfs for some Enterprise
Linux conversions.

=item Any other mountable filesystem

Minimum free space: 10 MB

=back

=head2 Minimum free space check in the host

You must have sufficient free space in the host directory used to
store temporary overlays.  To find out
which directory this is, use:

 $ df -h "`guestfish get-cachedir`"
 Filesystem        Size  Used Avail Use% Mounted on
 /dev/mapper/root   50G   40G  6.8G  86% /

and look under the C<Avail> column.  Virt-v2v will refuse to do the
conversion at all unless at least 1GB is available there.

See also L</RESOURCE REQUIREMENTS> above.

=head1 RUNNING VIRT-V2V AS ROOT OR NON-ROOT

Nothing in virt-v2v inherently needs root access, and it will run just
fine as a non-root user.  However, certain external features may
require either root or a special user:

=over 4

=item Mounting the Export Storage Domain

When using I<-o rhv -os server:/esd> virt-v2v has to have sufficient
privileges to NFS mount the Export Storage Domain from C<server>.

You can avoid needing root here by mounting it yourself before running
virt-v2v, and passing I<-os /mountpoint> instead, but first of all
read the next S<section ...>

=item Writing to the Export Storage Domain as 36:36

RHV-M cannot read files and directories from the Export Storage
Domain unless they have UID:GID 36:36.  You will see VM import
problems if the UID:GID is not correct.

When you run virt-v2v I<-o rhv> as root, virt-v2v attempts to create
files and directories with the correct ownership.  If you run virt-v2v
as non-root, it will probably still work, but you will need to
manually change ownership after virt-v2v has finished.

=item Writing to libvirt

When using I<-o libvirt>, you may need to run virt-v2v as root so that
it can write to the libvirt system instance (ie. C<qemu:///system>)
and to the default location for disk images (usually
F</var/lib/libvirt/images>).

You can avoid this by setting up libvirt connection authentication,
see L<http://libvirt.org/auth.html>.  Alternatively, use
I<-oc qemu:///session>, which will write to your per-user libvirt
instance.

=item Writing to Glance

This does I<not> need root (in fact it probably won’t work), but may
require either a special user and/or for you to source a script that
sets authentication environment variables.  Consult the Glance
documentation.

=back

=head1 DEBUGGING RHV-M IMPORT FAILURES

When you export to the RHV-M Export Storage Domain, and then import
that guest through the RHV-M UI, you may encounter an import failure.
Diagnosing these failures is infuriatingly difficult as the UI
generally hides the true reason for the failure.

There are several log files of interest:

=over 4

=item F</var/log/vdsm/import/>

In oVirt E<ge> 4.1.0, VDSM preserves the virt-v2v log file for
30 days in this directory.

This directory is found on the host which performed the conversion.
The host can be selected in the import dialog, or can be found under
the C<Events> tab in oVirt administration.

=item F</var/log/vdsm/vdsm.log>

As above, this file is present on the host which performed the
conversion.  It contains detailed error messages from low-level
operations executed by VDSM, and is useful if the error was not caused
by virt-v2v, but by VDSM.

=item F</var/log/ovirt-engine/engine.log>

This log file is stored on the RHV-M server.  It contains more detail
for any errors caused by the oVirt GUI.

=back

=head1 MINIMAL XML FOR -i libvirtxml OPTION

When using the I<-i libvirtxml> option, you have to supply some
libvirt XML.  Writing this from scratch is hard, so the template below
is helpful.

B<Note this should only be used for testing and/or where you know what
you're doing!>  If you have libvirt metadata for the guest, always use
that instead.

 <domain type='kvm'>
   <name> NAME </name>
   <memory>1048576</memory>
   <vcpu>2</vcpu>
   <os>
     <type>hvm</type>
     <boot dev='hd'/>
   </os>
   <features>
     <acpi/>
     <apic/>
     <pae/>
   </features>
   <devices>
     <disk type='file' device='disk'>
       <driver name='qemu' type='raw'/>
       <source file='/path/to/disk/image'/>
       <target dev='hda' bus='ide'/>
     </disk>
     <interface type='network'>
       <mac address='52:54:00:01:02:03'/>
       <source network='default'/>
       <model type='rtl8139'/>
     </interface>
   </devices>
 </domain>

=head1 MACHINE READABLE OUTPUT

The I<--machine-readable> option can be used to make the output more
machine friendly, which is useful when calling virt-v2v from
other programs, GUIs etc.

There are two ways to use this option.

Firstly use the option on its own to query the capabilities of the
virt-v2v binary.  Typical output looks like this:

 $ virt-v2v --machine-readable
 virt-v2v
 libguestfs-rewrite
 colours-option
 vdsm-compat-option
 input:disk
 [...]
 output:local
 [...]
 convert:linux
 convert:windows

A list of features is printed, one per line, and the program exits
with status 0.

The C<input:> and C<output:> features refer to I<-i> and I<-o> (input
and output mode) options supported by this binary.  The C<convert:>
features refer to guest types that this binary knows how to convert.

Secondly use the option in conjunction with other options to make the
regular program output more machine friendly.

At the moment this means:

=over 4

=item 1.

Progress bar messages can be parsed from stdout by looking for this
regular expression:

 ^[0-9]+/[0-9]+$

=item 2.

The calling program should treat messages sent to stdout (except for
progress bar messages) as status messages.  They can be logged and/or
displayed to the user.

=item 3.

The calling program should treat messages sent to stderr as error
messages.  In addition, virt-v2v exits with a non-zero status
code if there was a fatal error.

=back

Virt-v2v E<le> 0.9.1 did not support the I<--machine-readable>
option at all.  The option was added when virt-v2v was rewritten in 2014.

=head1 FILES

=over 4

=item F</usr/share/virtio-win>

(Optional)

If this directory is present, then virtio drivers for Windows guests
will be found from this directory and installed in the guest during
conversion.

=back

=head1 ENVIRONMENT VARIABLES

=over 4

=item C<TMPDIR>

Location of the temporary directory used for the potentially large
temporary overlay file.

See the L</Disk space> section above.

=item C<VIRT_TOOLS_DATA_DIR>

This can point to the directory containing data files used for Windows
conversion.

Normally you do not need to set this.  If not set, a compiled-in
default will be used (something like F</usr/share/virt-tools>).

This directory may contain the following files:

=over 4

=item F<rhsrvany.exe>

(Required when doing conversions of Windows guests)

This is the RHSrvAny Windows binary, used to install a "firstboot"
script in the guest during conversion of Windows guests.

See also: C<https://github.com/rwmjones/rhsrvany>

=item F<pvvxsvc.exe>

This is a Windows binary shipped with SUSE VMDP, used to install a "firstboot"
script in Windows guests.  It is required if you intend to use the
I<--firstboot> or I<--firstboot-command> options with Windows guests.

=item F<rhev-apt.exe>

(Optional)

The RHV Application Provisioning Tool (RHEV APT).  If this file is
present, then RHEV APT will be installed in the Windows guest during
conversion.  This tool is a guest agent which ensures that the virtio
drivers remain up to date when the guest is running on Red Hat
Virtualization (RHV).

This file comes from Red Hat Virtualization (RHV), and is not
distributed with virt-v2v.

=back

=item C<VIRTIO_WIN>

This is where virtio drivers for Windows are searched for.

If unset, then we look for drivers in whichever of these paths
is found first:

=over 4

=item F</usr/share/virtio-win/virtio-win.iso>

The ISO containing virtio drivers for Windows.

=item F</usr/share/virtio-win>

The exploded tree of virtio drivers for Windows.  This is
usually incomplete, hence the ISO is preferred.

=back

(F<> if unset).  It can be a directory I<or>
point to F<virtio-win.iso> (CD ROM image containing drivers).

See L<ENABLING VIRTIO>.

=back

For other environment variables, see L<guestfs(3)/ENVIRONMENT VARIABLES>.

=head1 OTHER TOOLS

=over 4

=item L<virt-v2v-copy-to-local(1)>

There are some special cases where virt-v2v cannot directly access the
remote hypervisor.  In that case you have to use
L<virt-v2v-copy-to-local(1)> to make a local copy of the guest first,
followed by running C<virt-v2v -i libvirtxml> to perform the
conversion.

=item L<engine-image-uploader(8)>

Variously called C<engine-image-uploader>, C<ovirt-image-uploader> or
C<rhevm-image-uploader>, this tool allows you to copy a guest from one
oVirt or RHV Export Storage Domain to another.  It only permits
importing a guest that was previously exported from another oVirt/RHV
instance.

=item L<import-to-ovirt.pl|http://git.annexia.org/?p=import-to-ovirt.git>

This script can be used to import guests that already run on KVM to
oVirt or RHV.  For more information, see this blog posting by the
author of virt-v2v:

L<https://rwmj.wordpress.com/2015/09/18/importing-kvm-guests-to-ovirt-or-rhev/#content>

=back

=head1 SEE ALSO

L<virt-p2v(1)>,
L<virt-customize(1)>,
L<virt-df(1)>,
L<virt-filesystems(1)>,
L<virt-sparsify(1)>,
L<virt-sysprep(1)>,
L<guestfs(3)>,
L<guestfish(1)>,
L<qemu-img(1)>,
L<virt-v2v-copy-to-local(1)>,
L<virt-v2v-test-harness(1)>,
L<engine-image-uploader(8)>,
L<import-to-ovirt.pl|http://git.annexia.org/?p=import-to-ovirt.git>,
L<nbdkit(1)>,
L<nbdkit-vddk-plugin(1)>,
L<http://libguestfs.org/>.

=head1 AUTHORS

Richard W.M. Jones L<http://people.redhat.com/~rjones/>

Matthew Booth

Mike Latimer

Pino Toscano

Shahar Havivi

Tingting Zheng

=head1 COPYRIGHT

Copyright (C) 2009-2018 Red Hat Inc.
