Description of problem: Unless this is the default of downstream QEMU, we should have the VM pause upon IO errors to prevent data loss. Version-Release number of selected component (if applicable): Essex How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
What would be the recovery action / alert to the user?
Dan, stop is the qemu default, right, so there's nothing needed here, is there?
Yeah, but the bigger question is what todo when this situation occurs. Just marking the VM as paused in libvirt is not a full soltion
What needs to happen?
I don't know - that's what someone needs to figure out.
According to the official qemu documentation (http://qemu.weilnetz.de/qemu-doc.html, linked from qemu.org), the default flags are werror=enospc and rerror=report, meaning report read errors to guest and on write errors pause qemu if host disk is full, otherwise report them to the guest.. HOWEVER: This is supported via libvirt's error_policy (for both, override read error policy with rerror_policy) on the driver tag for the disk specification. According to the libvirt doc, the default setting for libvirt is REPORT (I'm guessing that libvirt actually passes these to qemu, so the qemu defaults are moot). So, injecting it in to the configuration should be pretty easy, but we probably also want to provide a configuration option. As for state, perhaps we could use the metadata tag (http://libvirt.org/formatdomain.html#elementsMetadata) and have to store a flag, but we'd need to figure out how to detect if the stopping of the VM was intentional or accidental (we could manually set the flag to "on_purpose" whenever we intentionally shut down the vm, then look and see if the vm is shut down but on_purpose is not set).
(ping -- see above)
Bug added upstream: https://bugs.launchpad.net/nova/+bug/1189543 (no review id yet, though)
Polled upstream, consensus was WORKS AS INTENDED -- The thought was that this would be confusing for people running software in VMs (why is my VM suddenly stopped when I have code inside to handle IO errors) and that much existing software would rather just have the default (REPORT), and have the guest software (OS, database, etc) deal with the IO errors instead.