qvm-trim-template fails (Qubes 3.2)

[Fabrizio Romano Genovese]

Hello all, I'm basically having the same error described here:
https://github.com/QubesOS/qubes-issues/issues/1910

When I try to perform qvm-trim-template on any template, the error

'libvirterror operation failed: domain 'fedora-23-fstrim' already exists with uuid ....'
pops up. As in the linked thread, rebooting doesn't help. I don't understand the proposed solution. I tried to remove the temporary vm (that in my case it has name trim-template-name) giving

'qvm-remove trim-template-name'

but I get the error

'A VM with the name 'trim-template-name' does not exist in the system.'

Can you help me? My Template VM are becoming a bit too big now...

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

When you started to have this problem? Was previous trim operation
interrupted?

Anyway, try this:

virsh -c xen:/// undefine fedora-23-fstrim



- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYNBerAAoJENuP0xzK19cs7+QH/AlIugr9MjRTSRrG0TuD4HUv
D/7GgKZXd82VjrFPCn/HSCXFGORD/AUJMQuqdq/D0Wt1BmbOPaEbYOmllOHlPggP
FOmoEsGvAB0eV2boF8z9eVxyDT/FfWJx2OG4ioNR9wqRXv6mMER/Hn+GiRh2v9+b
9a88ZSHaINRJfGz6FSjY4tLgZSUCJrsoPAh5JkTJEu+ndAt7EcJVcyjDSSgR3NNX
ErWMwjurAuEspAnATuUNJGU5tPI5aX8+mAKO0tl9PF6B/H4o5eMu11eELX8+Hbn4
hYv+af+0hSi2hDWvbMqjOQcrJEvwlANggywq97uJD4NgDvOirqiBjAxgQ+++cNE=
=053l
-----END PGP SIGNATURE-----

[Fabrizio Romano Genovese]

Thank you very much, your solution worked (actually I had to give
virsh -c xen:/// undefine trim-fedora-23
and not

virsh -c xen:/// undefine fedora-23-fstrim

and then I had to manually remove the trim-fedora-23 files in /var/lib/qubes/appvm).

The problem started when I decided to make a little script to automatize the trim process for all my templates at once, but it is evident that I must have made some mistake while doing it :D

Anyway, a "global trim function", as well as a "global update function" would be very helpful, updating/trimming of templates can be quite time consuming!

Cheers,
Fab.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Global update is possible using salt management stack. See here:
https://groups.google.com/d/msg/qubes-users/UG1OiPXWrhs/LqYoSC2WBgAJ

I think it should be even possible using one-liner like this:

qubesctl --templates state.single pkg.uptodate '' refresh=True

Uhm, actually it will not work right now, because qubesctl tool have an
"optimization" to not call into VMs when no states are defined in top
file for it (the configuration mentioned in link above). But it should
be easy to fix:
https://github.com/QubesOS/qubes-issues/issues/2451

Currently there is no similarly easy option "global trim", but on the
other hand, it will not be needed anymore in Qubes 4.0 when using LVM
storage.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYNDWtAAoJENuP0xzK19cs/hYH+gO6XvdfQ972blKzqE1NycpH
+a1fi99x6bltpECVRA+FP1+qvtjckfAcjMbSxxh5Dl7of9NLGkvKACHNnwvt0y3Z
DqcEBhphJ0pLYTpaZeChwVWh2lvsEFPp41gcUr/Ucq1O2P9g9wOR4jE+fDDbkFZU
RB7/i5zj3l7qABy5YEU5yMxoY4uR/4g+n1f+HdJFolaxdaJA8udbv8Wn71iih3XS
EGtJ0TaKrUmWQ7MkEDt/vlLwHwFomyk2jfqgCrh0m01xJZZvNyeFBLPwTU/nPUvQ
2E/UwCI+u2Wz4rTWUAwMsbqRhbMPclA6QmQowtuiGcjhqQX/lIMPokUl+sYtsGg=
=0Ezp
-----END PGP SIGNATURE-----

[Fabrizio Romano Genovese]

Dear Marek,

I've tried the solution you proposed in that post. I've managed to make that little script to work (strangely enough, it looks like salt minds about indenting in the code. I'm mainly used to latex that doesn't care and this left me a bit surprised.

I created a file /srv/salt/update-templates.sls and wrote

uptodate:
pkg.uptodate: []

into it. Then I created /srv/salt/update-templates.top and wrote

base:
qubes:type:template:
- match: pillar
- update-templates

into it. Then I gave ' sudo qubesctl top.enalbe update-templates ' and tested it with ' sudo qubesctl --all state.highstate ' (these commands don't work for me if I'm not superuser). unfortunately, this doesn't work for me. There is some green stuff going on (like qvm.exists and other things that I don't really understand). Then, it runs through the templates returning errors (it basically says, as an instance, 'fedora-23: ERROR'). On the app vm it just skips saying that there is nothing to do (and this is what it is supposed to do, so at least it recognizes that it has to run only on templates).

My feeling (that may be wrong, obviously) is that the command pkg.uptodate: [] does not work for god only knows what reason. Any idea?

Cheers,
Fab.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You can find details in /var/log/qubes/mgmt-fedora-23.log. Or add
"--show-output" option to qubesctl to have it on stdout.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYNvI/AAoJENuP0xzK19cseHgH/jJi8AxLulTdA2vqvecMQFJi
mDu5JLnB29QRDc3mEU59UeK/04Up+Gwp3NYhqMA7/+bSV2oIFYQcDuUGTqlO2Kbn
zXaSi0Yj/S9O/yz6vTjY+a7OxCa16cn8gO56jKuNFZudwWtIx2qkhZmD5tEYydGM
XUq3e+3Q4P3/ye9PKXCPu9z1q+TGAK3uQgSbAvJLshK8/z38tUuWaSJOsVfd2xL9
pPsChoxJLBJTO9EInhbz2DxQO4nYg3dN9CVc0vUE+d+w4nx84C6/gPlFMCE6LCW0
f6vlO4V6iPDCQgQEet1zFYHawMOmVFxX5kMdmw7IVyu9OzgeexM5XK3Q8HCN+tw=
=h+Pw
-----END PGP SIGNATURE-----

[Fabrizio Romano Genovese]

The error I get is 127, that should be "command not found" if I got it right...

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Thu, Nov 24, 2016 at 08:19:22AM -0800, Fabrizio Romano Genovese wrote:
> The error I get is 127, that should be "command not found" if I got it right...

Have you installed qubes-mgmt-salt-vm-connector in your default template
during upgrade to Qubes 3.2?

https://www.qubes-os.org/doc/upgrade-to-r3.2/

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYNxVeAAoJENuP0xzK19csCaMH/3VWe8Scqq0yhXjt7U6PHz9H
dUDWzhA1AA5yQTNJadzDPBYiFyNcyZDUxdv9B6/5F1u/M33tq3UMEC8qxuTFp/EA
KqPES8Rgh1TT29jEZrVW0/WcNoKnfnti8LUH+ilRmvU+xw/6w9H9oJxlzGNjLXlX
sVR1szS5PsPx7K8MHVH8fH9QGd+cBvdKi/hbDDKKd/mAxV1v+qrjdsLTojP0ZGK2
Uj/KOrmx64SR2XMc7FJBpI65T/Udo0rgP3bYJH8Wel5ozDAwDubH3Bkg6/pVFgER
kVEMrD8Pdwjaw7+/n3fOEbP9yEuKGsfrdZShVd+LmHRXEc6YNfaFHBk4Ul6LetI=
=TmVB
-----END PGP SIGNATURE-----

[Fabrizio Romano Genovese]

Looks like qubes-mgmt-salt-vm-connector is already installed in my templates. Are you sure the command is

pkg.uptodate: []

? This looks right in the salt documentation, but there is nothing else I can think about...

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Thu, Nov 24, 2016 at 08:46:19AM -0800, Fabrizio Romano Genovese wrote:
> Looks like qubes-mgmt-salt-vm-connector is already installed in my templates. Are you sure the command is

This needs to be installed in your _default_ template (which may be
different from the one you're trying to update).

> pkg.uptodate: []
>
> ? This looks right in the salt documentation, but there is nothing else I can think about...

Yes, looks ok.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYOYHnAAoJENuP0xzK19csTh4H/j+MXULwA3t4WHm4e3wVATQu
x2WOkNyS9KUKtSCZQbpxZmAq/8urjsfTd7FMp+EoXd1P/yllaIVFjnS/BeERMpap
3rXY93bTKsL54zDzOqQEKfcAqcT61nFfCcZtB3l5W2givSlH16Q6aWrsIr5W43NB
ONvl/WOSjfnfwwN7ppnXRcWUJHHgdbEISDIjaUEPURnJaICkDvSXTdiDLg2RjV6Y
15oGPL7FvBVkp6AvS6ZfAidt00ViRwldjS0xQYZA1AkWxNFiPTU2vYtwPHEIj0QP
QeopTKK12DIGQJ5UFsdyMOA/uxH+VH4Tc+4Mg0ZcYwIHj+66+Us94phZ70fr1F8=
=l1Fw
-----END PGP SIGNATURE-----