Migrating with Conntrack doesn't work after Updating to 9.0.5

[Dennigma]

After todays update something seems to destroy conntrack.
When I try to migrate a VM I get a message saying "Cannot migrate conntrack state, target node is lacking support. Active network connections might get dropped"
Which is weird, because it worked fine until yesterday. (pve 9.0.4)

Anyone here able to help or confirm its a bug of this version of pve?

 

[cheiss]

Hi,

can you please provide the output of pveversion -v for both nodes, the source and target node?

In any case, this has already been identified and fixed in git: https://git.proxmox.com/?p=qemu-server.git;a=commit;h=4ce7b7dfced8838a49f3dd797c96159ee3355854
It should thus be fixed with the next update of the qemu-server package, i.e. qemu-server 9.0.18.

 

[Dennigma]

Sure, the results are:

Host 1:
proxmox-ve: 9.0.0 (running kernel: 6.14.8-2-pve)
pve-manager: 9.0.5 (running version: 9.0.5/9c5600b249dbfd2f)
proxmox-kernel-helper: 9.0.3
proxmox-kernel-6.14.8-2-pve-signed: 6.14.8-2
proxmox-kernel-6.14: 6.14.8-2
ceph-fuse: 19.2.3-pve1
corosync: 3.1.9-pve2
criu: 4.1.1-1
frr-pythontools: 10.3.1-1+pve4
ifupdown2: 3.3.0-1+pmx9
intel-microcode: 3.20250512.1
ksm-control-daemon: 1.5-1
libjs-extjs: 7.0.0-5
libproxmox-acme-perl: 1.7.0
libproxmox-backup-qemu0: 2.0.1
libproxmox-rs-perl: 0.4.1
libpve-access-control: 9.0.3
libpve-apiclient-perl: 3.4.0
libpve-cluster-api-perl: 9.0.6
libpve-cluster-perl: 9.0.6
libpve-common-perl: 9.0.9
libpve-guest-common-perl: 6.0.2
libpve-http-server-perl: 6.0.4
libpve-network-perl: 1.1.6
libpve-rs-perl: 0.10.10
libpve-storage-perl: 9.0.13
libspice-server1: 0.15.2-1+b1
lvm2: 2.03.31-2+pmx1
lxc-pve: 6.0.4-2
lxcfs: 6.0.4-pve1
novnc-pve: 1.6.0-3
proxmox-backup-client: 4.0.14-1
proxmox-backup-file-restore: 4.0.14-1
proxmox-backup-restore-image: 1.0.0
proxmox-firewall: 1.1.1
proxmox-kernel-helper: 9.0.3
proxmox-mail-forward: 1.0.2
proxmox-mini-journalreader: 1.6
proxmox-offline-mirror-helper: 0.7.0
proxmox-widget-toolkit: 5.0.5
pve-cluster: 9.0.6
pve-container: 6.0.9
pve-docs: 9.0.8
pve-edk2-firmware: 4.2025.02-4
pve-esxi-import-tools: 1.0.1
pve-firewall: 6.0.3
pve-firmware: 3.16-3
pve-ha-manager: 5.0.4
pve-i18n: 3.5.2
pve-qemu-kvm: 10.0.2-4
pve-xtermjs: 5.5.0-2
qemu-server: 9.0.17
smartmontools: 7.4-pve1
spiceterm: 3.4.0
swtpm: 0.8.0+pve2
vncterm: 1.9.0
zfsutils-linux: 2.3.3-pve1

Host 2:
proxmox-ve: 9.0.0 (running kernel: 6.14.8-2-pve)
pve-manager: 9.0.5 (running version: 9.0.5/9c5600b249dbfd2f)
proxmox-kernel-helper: 9.0.3
proxmox-kernel-6.14.8-2-pve-signed: 6.14.8-2
proxmox-kernel-6.14: 6.14.8-2
ceph-fuse: 19.2.3-pve1
corosync: 3.1.9-pve2
criu: 4.1.1-1
frr-pythontools: 10.3.1-1+pve4
ifupdown2: 3.3.0-1+pmx9
intel-microcode: 3.20250512.1
ksm-control-daemon: 1.5-1
libjs-extjs: 7.0.0-5
libproxmox-acme-perl: 1.7.0
libproxmox-backup-qemu0: 2.0.1
libproxmox-rs-perl: 0.4.1
libpve-access-control: 9.0.3
libpve-apiclient-perl: 3.4.0
libpve-cluster-api-perl: 9.0.6
libpve-cluster-perl: 9.0.6
libpve-common-perl: 9.0.9
libpve-guest-common-perl: 6.0.2
libpve-http-server-perl: 6.0.4
libpve-network-perl: 1.1.6
libpve-rs-perl: 0.10.10
libpve-storage-perl: 9.0.13
libspice-server1: 0.15.2-1+b1
lvm2: 2.03.31-2+pmx1
lxc-pve: 6.0.4-2
lxcfs: 6.0.4-pve1
novnc-pve: 1.6.0-3
proxmox-backup-client: 4.0.14-1
proxmox-backup-file-restore: 4.0.14-1
proxmox-backup-restore-image: 1.0.0
proxmox-firewall: 1.1.1
proxmox-kernel-helper: 9.0.3
proxmox-mail-forward: 1.0.2
proxmox-mini-journalreader: 1.6
proxmox-offline-mirror-helper: 0.7.0
proxmox-widget-toolkit: 5.0.5
pve-cluster: 9.0.6
pve-container: 6.0.9
pve-docs: 9.0.8
pve-edk2-firmware: 4.2025.02-4
pve-esxi-import-tools: 1.0.1
pve-firewall: 6.0.3
pve-firmware: 3.16-3
pve-ha-manager: 5.0.4
pve-i18n: 3.5.2
pve-qemu-kvm: 10.0.2-4
pve-xtermjs: 5.5.0-2
qemu-server: 9.0.17
smartmontools: 7.4-pve1
spiceterm: 3.4.0
swtpm: 0.8.0+pve2
vncterm: 1.9.0
zfsutils-linux: 2.3.3-pve1


As I said it worked until yesterday.
I can even see the conntrack states on both servers using
"lsmod | egrep 'nf_conntrack_netlink|nfnetlink|nf_conntrack'"


This actually doesn't affect me too much, because I don't migrate often and the states seem to transfer fine while migrating anyways, but I really dislike things that just don't work anymore for no reason, even though they should.

I'm glad to hear it appears to be a bug thats already been worked on. So it wasn't something I did.

 

[fabian]

this is a bug in qemu-server 9.0.17, 9.0.16 or the incoming 9.0.18 should fix it..

 

[Dennigma]

Thank you a lot. Then I just wait and hope for the best

 

[Dennigma]

this is a bug in qemu-server 9.0.17, 9.0.16 or the incoming 9.0.18 should fix it..

The Update to 9.0.18 was just released and I installed it, everything seems to be fine now. Thank you again.

 

[klx]

Just updated and yes the bug is gone.

 

[michauko]

Hi there, just googled here.
I upgraded 2 days ago to latest PVE 9 and discovered this problem too.
Both nodes have the same releases for all modules in pveversion -v ; qemu-server 9.1.1 here.

# pveversion -v
proxmox-ve: 9.1.0 (running kernel: 6.17.2-2-pve)
pve-manager: 9.1.2 (running version: 9.1.2/9d436f37a0ac4172)
proxmox-kernel-helper: 9.0.4
proxmox-kernel-6.17.2-2-pve-signed: 6.17.2-2
proxmox-kernel-6.17: 6.17.2-2
proxmox-kernel-6.8: 6.8.12-17
proxmox-kernel-6.8.12-17-pve-signed: 6.8.12-17
proxmox-kernel-6.8.12-9-pve-signed: 6.8.12-9
ceph-fuse: 19.2.3-pve2
corosync: 3.1.9-pve2
criu: 4.1.1-1
frr-pythontools: 10.4.1-1+pve1
ifupdown2: 3.3.0-1+pmx11
ksm-control-daemon: 1.5-1
libjs-extjs: 7.0.0-5
libproxmox-acme-perl: 1.7.0
libproxmox-backup-qemu0: 2.0.1
libproxmox-rs-perl: 0.4.1
libpve-access-control: 9.0.4
libpve-apiclient-perl: 3.4.2
libpve-cluster-api-perl: 9.0.7
libpve-cluster-perl: 9.0.7
libpve-common-perl: 9.1.0
libpve-guest-common-perl: 6.0.2
libpve-http-server-perl: 6.0.5
libpve-network-perl: 1.2.3
libpve-rs-perl: 0.11.3
libpve-storage-perl: 9.1.0
libspice-server1: 0.15.2-1+b1
lvm2: 2.03.31-2+pmx1
lxc-pve: 6.0.5-3
lxcfs: 6.0.4-pve1
novnc-pve: 1.6.0-3
openvswitch-switch: 3.5.0-1+b1
proxmox-backup-client: 4.1.0-1
proxmox-backup-file-restore: 4.1.0-1
proxmox-backup-restore-image: 1.0.0
proxmox-firewall: 1.2.1
proxmox-kernel-helper: 9.0.4
proxmox-mail-forward: 1.0.2
proxmox-mini-journalreader: 1.6
proxmox-offline-mirror-helper: 0.7.3
proxmox-widget-toolkit: 5.1.2
pve-cluster: 9.0.7
pve-container: 6.0.18
pve-docs: 9.1.1
pve-edk2-firmware: 4.2025.05-2
pve-esxi-import-tools: 1.0.1
pve-firewall: 6.0.4
pve-firmware: 3.17-2
pve-ha-manager: 5.0.8
pve-i18n: 3.6.5
pve-qemu-kvm: 10.1.2-4
pve-xtermjs: 5.5.0-3
qemu-server: 9.1.1
smartmontools: 7.4-pve1
spiceterm: 3.4.1
swtpm: 0.8.0+pve3
vncterm: 1.9.1
zfsutils-linux: 2.3.4-pve1

Any idea?
Thx

 

[fabian]

Hi there, just googled here.
I upgraded 2 days ago to latest PVE 9 and discovered this problem too.
Both nodes have the same releases for all modules in pveversion -v ; qemu-server 9.1.1 here.

# pveversion -v
proxmox-ve: 9.1.0 (running kernel: 6.17.2-2-pve)
pve-manager: 9.1.2 (running version: 9.1.2/9d436f37a0ac4172)
proxmox-kernel-helper: 9.0.4
proxmox-kernel-6.17.2-2-pve-signed: 6.17.2-2
proxmox-kernel-6.17: 6.17.2-2
proxmox-kernel-6.8: 6.8.12-17
proxmox-kernel-6.8.12-17-pve-signed: 6.8.12-17
proxmox-kernel-6.8.12-9-pve-signed: 6.8.12-9
ceph-fuse: 19.2.3-pve2
corosync: 3.1.9-pve2
criu: 4.1.1-1
frr-pythontools: 10.4.1-1+pve1
ifupdown2: 3.3.0-1+pmx11
ksm-control-daemon: 1.5-1
libjs-extjs: 7.0.0-5
libproxmox-acme-perl: 1.7.0
libproxmox-backup-qemu0: 2.0.1
libproxmox-rs-perl: 0.4.1
libpve-access-control: 9.0.4
libpve-apiclient-perl: 3.4.2
libpve-cluster-api-perl: 9.0.7
libpve-cluster-perl: 9.0.7
libpve-common-perl: 9.1.0
libpve-guest-common-perl: 6.0.2
libpve-http-server-perl: 6.0.5
libpve-network-perl: 1.2.3
libpve-rs-perl: 0.11.3
libpve-storage-perl: 9.1.0
libspice-server1: 0.15.2-1+b1
lvm2: 2.03.31-2+pmx1
lxc-pve: 6.0.5-3
lxcfs: 6.0.4-pve1
novnc-pve: 1.6.0-3
openvswitch-switch: 3.5.0-1+b1
proxmox-backup-client: 4.1.0-1
proxmox-backup-file-restore: 4.1.0-1
proxmox-backup-restore-image: 1.0.0
proxmox-firewall: 1.2.1
proxmox-kernel-helper: 9.0.4
proxmox-mail-forward: 1.0.2
proxmox-mini-journalreader: 1.6
proxmox-offline-mirror-helper: 0.7.3
proxmox-widget-toolkit: 5.1.2
pve-cluster: 9.0.7
pve-container: 6.0.18
pve-docs: 9.1.1
pve-edk2-firmware: 4.2025.05-2
pve-esxi-import-tools: 1.0.1
pve-firewall: 6.0.4
pve-firmware: 3.17-2
pve-ha-manager: 5.0.8
pve-i18n: 3.6.5
pve-qemu-kvm: 10.1.2-4
pve-xtermjs: 5.5.0-3
qemu-server: 9.1.1
smartmontools: 7.4-pve1
spiceterm: 3.4.1
swtpm: 0.8.0+pve3
vncterm: 1.9.1
zfsutils-linux: 2.3.4-pve1

Any idea?
Thx

could you please post:
- VM config
- migration task log
- VM start task log on the target node (if one exists)
- journalctl for both source and target node covering the full duration of the attempted migration and 2mins before and after

 

[woma]

I updated my small no-subscription PVE cluster today to latest V9 packages.
I used "shutdown policy=migragte" and triggered a shutdown for node2 (Dec 16 12:40:30)

Expectation was that started HA VM 102 will be "online" migrated from node2 to either node1 or node3.
I got only migration errors and node2 got stuck in maintenance mode.

Failed migration task message is not the first one, just picked one of them as content is the same.

Journals and pveversion (same for all 3 nodes) are attached.

BR
Marcus

 

[fiona]

Hi @woma ,
your issue sounds a bit different. HA does not currently migrate with conntrack state. The error message you get is the same as in the following bug report: https://bugzilla.proxmox.com/show_bug.cgi?id=7092 There, the migration still finished. You get the error earlier, but it's likely the same issue, because the dbus.service is already stopped:

Dec 16 12:40:38 node2 systemd[1]: dbus.service: Deactivated successfully.
Dec 16 12:40:38 node2 systemd[1]: Stopped dbus.service - D-Bus System Message Bus.

and later

Dec 16 12:40:41 node2 pve-ha-lrm[3209]: got shutdown request with shutdown policy 'migrate'

 

[Dennigma]

Hi @woma ,
your issue sounds a bit different. HA does not currently migrate with conntrack state. The error message you get is the same as in the following bug report: https://bugzilla.proxmox.com/show_bug.cgi?id=7092 There, the migration still finished. You get the error earlier, but it's likely the same issue, because the dbus.service is already stopped:

Dec 16 12:40:38 node2 systemd[1]: dbus.service: Deactivated successfully.
Dec 16 12:40:38 node2 systemd[1]: Stopped dbus.service - D-Bus System Message Bus.

and later

Dec 16 12:40:41 node2 pve-ha-lrm[3209]: got shutdown request with shutdown policy 'migrate'

Dear Fiona,

there seems to be a new bug in the recent update pve-manager update 9.1.2.
It's not the same as my initial post, but migrating when using the reboot/shutdown button of any node inside of a cluster leads to this behaviour, when "migrate" is selected in the shutdown policy.

There are other new posts in this forum related to this problem describing this exact broken behaviour.


Manually migrating or using the maintenance mode to migrate vms still work without any problem.

 

[fiona]

Initial patches to fix the new issue and bug #7092 were proposed now: https://lore.proxmox.com/pve-devel/20251217131724.118681-1-f.ebner@proxmox.com/