Article ID: 120120, created on Feb 13, 2014, last review on Jun 17, 2016

  • Applies to:
  • Virtuozzo
  • Virtuozzo containers for Linux
  • Virtuozzo hypervisor

Symptoms

Container migration fails with the following errors:

Actual result that you got : 1392199064: 1392216715: /usr/sbin/vzctl --skiplock --skipowner --ignore-ha-cluster restore 2737 --undump --skip_arpdetect --dumpfile /vz/dump/dumpfile.MCxGOk
1392199066: 1392216717: vzctl : Cannot undump the file: Invalid argument
1392199066: 1392216717: vzctl : Error: iptables-restore exited with 2
1392199066: 1392216717: vzctl : Error: Most probably some iptables modules are not loaded
1392199066: 1392216717: vzctl : Error: or CT's iptables utilities are incompatible with this kernel (version is older than 1.4.0)
1392199066: 1392216717: vzctl : Error: (Offline migration and iptools upgrade might help).
1392199066: 1392216717: vzctl : Error: rst_restore_net: -22
1392199066: 1392216717: vzctl : Failed to start the Container
1392199066: 1392216717: vzctl : Container is not running
1392199066: 1392216717: vzctl : Failed to start the Container
1392199066: 1392216717: /usr/sbin/vzctl exited with code 17
1392199069: 1392216720: /usr/sbin/vzctl exited with code 17
1392199069: 1392216720: error [-52] : /usr/sbin/vzctl exited with code 17
1392199069: /usr/sbin/vzctl exited with code 17
1392199069: can not undump CT#2737 : /usr/sbin/vzctl exited with code 17

Iptables configuration has been synced between the nodes.

What is the problem?

Cause

The issue may arise from complex iptables configuration on the source node: it may contain a lot of rules that imply a big variety of iptables modules. As a result, all these modules are loaded on the source, and the container may freely use these modules inside of it, unless it's restricted to a certain set of modules.

Resolution

  1. Get the list of modules, loaded on the source:

    [root@vz ~]# lsmod | awk '/^ip|^nf|^xt/{print$1}' | sort | uniq > file1
    
  2. Copy file1 to the destination server.

  3. Get the list of modules, loaded on the destination:

    [root@vz ~]# lsmod | awk '/^ip|^nf|^xt/{print$1}' | sort | uniq > file2
    
  4. Check the difference:

    [root@vz ~]# diff -pruN file1 file2 | grep ^-
    -ipmi_devintf
    -iptable_raw
    -ipt_addrtype
    -ipt_ah
    -ipt_ecn
    -ipt_ECN
    -ipt_MASQUERADE
    -ipt_NETMAP
    -ipt_REDIRECT
    -ipt_ULOG
    -nfnetlink_log
    -xt_CLASSIFY
    -xt_comment
    -xt_dccp
    -xt_hashlimit
    -xt_iprange
    -xt_mac
    -xt_mark
    -xt_MARK
    -xt_NFLOG
    -xt_NFQUEUE
    -xt_owner
    -xt_physdev
    -xt_pkttype
    -xt_policy
    -xt_recent
    

    This is the list of modules to be loaded.

  5. Load these modules:

    [root@vz ~]# diff -pruN file1 file2 | grep ^- | tail -n+3 | sed 's~-~~' | while read mod ; do modprobe $mod ; done
    
  6. Retry the migration.

a26b38f94253cdfbf1028d72cf3a498b 2897d76d56d2010f4e3a28f864d69223 d02f9caf3e11b191a38179103495106f e8e50b42231236b82df27684e7ec0beb 0dd5b9380c7d4884d77587f3eb0fa8ef

Email subscription for changes to this article
Save as PDF