At Techglimpse we frequently receive mails from our readers asking us to write a tutorial on ‘Virtualization Detection’ from a VPS or a Virtual machine. However, we were not able to respond to those emails immediately, as we didn’t have a test setup comprising of popular hypervisors (at least few) such as Xen, VmWare, KVM, VirtualBox, HyperV etc…Recently, we got to have few hypervisors running – just for the sake of our readers. So finally, this tutorial will tell you few commands and digging (I mean, reading logs) that can help you to identify the type of the Hypervisor that runs the current virtual machine.
The below commands were executed on virtual machines created on top of Xen, KVM, VirtualBox hypervisors and also on an OpenStack-KVM Icehouse.
Method 1: Reading system log
Certain hypervisor leaks information about their type (including the name of the hypervisor and type of virtualization – such as paravirtualization, full virtualization or HVM) in system log files. These informations can be obtained from /var/log/message or by grepping the output of ‘dmesg‘ command.
Note: As told, this method will work only on certain Hypervisors. For e.g., VirtualBox and Xen does not leak any information in the log files.
On Xen-VM
[root@xen-vm ~]# dmesg |grep virtual
You can’t find any information from log files on Xen Hypervisor.
On KVM-VM
[centos@KVM-vm ~]$ dmesg |grep virtual [ 0.000000] Booting paravirtualized kernel on KVM [ 1.930785] systemd[1]: Detected virtualization 'kvm'.
On VirtualBox-VM
[root@VB-vm ~]# dmesg |grep virtual
You can’t find any information from log files on VirtualBox.
On OpenStack KVM VM
[root@OS-vm ~]$ dmesg |grep virtual Booting paravirtualized kernel on KVM input: Macintosh mouse button emulation as /devices/virtual/input/input1
On KVM Host machine
[root@kvm-host ~]$ dmesg |grep virtual Booting paravirtualized kernel on bare hardware
Method 2: Using ‘dmidecode’ command
DMI (Desktop Management Interface) – dmidecode, native Linux command can be used to dump hardware and BIOS information in a human readable format.
When ‘dmidecode‘ is run :
On Xen VM
[root@xen-vm ~]# dmidecode | egrep -i 'manufacturer|product' Manufacturer: Xen Product Name: HVM domU Manufacturer: Xen Manufacturer: Intel
On KVM VM
[centos@kvm-vm ~]$ sudo dmidecode | egrep -i 'manufacturer|product' Manufacturer: Bochs Product Name: Bochs Manufacturer: Bochs Manufacturer: Bochs
Note: You can see ‘Bochs‘ as a value for Manufacturer, Product Name etc…Bochs is an X86-64 compatible emulator and debugger that helps emulation of processor, display, BIOS, memory and other hardware of PC. It means, machine is emulating some hardware hinting it’s a VM and mostly, KVM.
On VirtualBox VM
[root@VB-vm ~]# dmidecode | egrep -i 'manufacturer|product' Manufacturer: innotek GmbH Product Name: VirtualBox Manufacturer: Oracle Corporation Product Name: VirtualBox Manufacturer: Oracle Corporation
On OpenStack-KVM VM
[centos@OS-vm ~]$ sudo dmidecode | egrep -i 'manufacturer|product' Manufacturer: Red Hat Product Name: KVM
When you run ‘dmidecode‘ on a host machine, you get the hardware and BIOS information.
[root@kvm-host ~]# dmidecode | egrep -i 'manufacturer|product' Manufacturer: Supermicro Product Name: X8SIL Manufacturer: Supermicro Product Name: X8SIL Manufacturer: Supermicro Manufacturer: Intel Manufacturer: Kingston Manufacturer: Kingston Manufacturer: Kingston Manufacturer: Kingston Manufacturer: To Be Filled By O.E.M.
Method 3: Listing /dev/disk
Virtual machines should have hardware emulation from the host machine. For e.g., disk emulation from host. So if you just list the files under ”/dev/disk/by-id‘, then you can easily make out what emulator is being used by the Hypervisor.
On Xen VM
[root@xen-vm~]# ls -l /dev/disk/by-id total 0 lrwxrwxrwx 1 root root 9 Sep 29 15:14 ata-QEMU_DVD-ROM_QM00004 -> ../../hdd lrwxrwxrwx 1 root root 9 Sep 29 15:14 ata-QEMU_HARDDISK_QM00001 -> ../../hda lrwxrwxrwx 1 root root 10 Sep 29 15:14 ata-QEMU_HARDDISK_QM00001-part1 -> ../../hda1 lrwxrwxrwx 1 root root 10 Sep 29 15:14 ata-QEMU_HARDDISK_QM00001-part2 -> ../../hda2
QEMU emulates the entire hardware attached to the host onto a VM.
On KVM VM
[centos@kvm-vm ~]$ ls -l /dev/disk/by-id lrwxrwxrwx. 1 root root 9 Sep 30 10:40 ata-QEMU_HARDDISK_QM00001 -> ../../sda lrwxrwxrwx. 1 root root 10 Sep 30 10:35 ata-QEMU_HARDDISK_QM00001-part1 -> ../../sda1
On VirtualBox VM
[root@VB-vm ~]# ls -l /dev/disk/by-id total 0 lrwxrwxrwx 1 root root 9 Oct 5 21:10 ata-VBOX_CD-ROM_VB2-01700376 -> ../../hdc lrwxrwxrwx 1 root root 9 Oct 5 21:10 ata-VBOX_HARDDISK_VBc7f3f571-49b6d797 -> ../../hda lrwxrwxrwx 1 root root 10 Oct 5 21:10 ata-VBOX_HARDDISK_VBc7f3f571-49b6d797-part1 -> ../../hda1 lrwxrwxrwx 1 root root 10 Oct 5 21:10 ata-VBOX_HARDDISK_VBc7f3f571-49b6d797-part2 -> ../../hda2 lrwxrwxrwx 1 root root 10 Oct 5 21:10 ata-VBOX_HARDDISK_VBc7f3f571-49b6d797-part3 -> ../../hda3
Note: VBOX instead of QEMU on a VirtualBox VM
On OpenStack KVM VM
[centos@OS-vm ~]$ ls -l /dev/disk/by-id ls: cannot access /dev/disk/by-id: No such file or directory
I couldn’t find any information on OpenStack VM. Probably, OpenStack hides it? Not sure!
On KVM Host machine
[root@kvm-host ~]# ls -l /dev/disk/by-id/ total 0 lrwxrwxrwx 1 root root 10 Sep 28 08:45 dm-name-centos-home -> ../../dm-2 lrwxrwxrwx 1 root root 10 Sep 28 08:45 dm-name-centos-root -> ../../dm-1 lrwxrwxrwx 1 root root 10 Sep 28 08:45 dm-name-centos-swap -> ../../dm-0 lrwxrwxrwx 1 root root 10 Sep 28 08:45 dm-uuid-LVM-fQq4kAJfUvtqpELNejjkiUTcGNhMJAIGbhQF7TR1rpaLi9Z8e1OF19f0K4DKhtxg -> ../../dm-1 lrwxrwxrwx 1 root root 10 Sep 28 08:45 dm-uuid-LVM-fQq4kAJfUvtqpELNejjkiUTcGNhMJAIGcstbiCdWXv3SCKfHb8lSPbApR525PK2W -> ../../dm-0 lrwxrwxrwx 1 root root 10 Sep 28 08:45 dm-uuid-LVM-fQq4kAJfUvtqpELNejjkiUTcGNhMJAIGrt7RtF7L1qlwo2fjIIQh9FasnQoV3q9y -> ../../dm-2 lrwxrwxrwx 1 root root 10 Sep 28 08:45 lvm-pv-uuid-rZHlC1-OyIn-lpf8-NU1e-uhLB-s3At-GyR6zx -> ../../sda2 lrwxrwxrwx 1 root root 9 Sep 28 08:45 scsi-SAdaptec_ft_A8E727A8 -> ../../sda lrwxrwxrwx 1 root root 10 Sep 28 08:45 scsi-SAdaptec_ft_A8E727A8-part1 -> ../../sda1 lrwxrwxrwx 1 root root 10 Sep 28 08:45 scsi-SAdaptec_ft_A8E727A8-part2 -> ../../sda2
Method 4: Using virt-what package
Not all Linux flavor comes with ‘virt-what‘ package installed. You can install it using ‘yum‘.
[root@vm ~]# rpm -ivh virt-what-1.11-2.el5.x86_64.rpm warning: virt-what-1.11-2.el5.x86_64.rpm: Header V3 DSA signature: NOKEY, key ID e8562897 Preparing... ########################################### [100%] 1:virt-what ########################################### [100%]
On Xen VM
[root@xen-vm ~]# virt-what xen xen-hvm
On KVM VM
[centos@kvm-vm ~]$ sudo virt-what kvm
On VirtualBox VM
[root@VB-vm ~]# virt-what virtualbox
On OpenStack KVM VM
[root@OS-vm ~]# virt-what kvm
On KVM Host
[root@kvm-host ~]# virt-what
Note: You don’t get any output on a host machine.
Method 5: Using virtdetect or systemd-detect-virt
Virtdetect rpm is based on ‘Sys::Detect::Virtualization‘ perl script – Refer this tutorial for more information.
Method 6: Using ‘lshw’ command
Install ‘lshw‘ package as below:
[root@vm ]# yum install lshw Installed: lshw.x86_64 0:B.02.17-3.el6 Complete!
On Xen VM
[root@xen-vm ~]# lshw -class system description: Computer product: HVM domU vendor: Xen version: 4.1.5 width: 32 bits capabilities: smbios-2.4 dmi-2.4 smp-1.4 smp
On KVM VM
[centos@kvm-vm~]$ sudo lshw -class system description: Computer product: Bochs vendor: Bochs width: 64 bits capabilities: smbios-2.4 dmi-2.4 vsyscall32
On VirtualBox VM
[root@VB-vm ~]# lshw -class system description: Computer product: VirtualBox vendor: innotek GmbH version: 1.2 serial: 0 width: 32 bits capabilities: smbios-2.5 dmi-2.5 description: System peripheral product: VirtualBox Guest Service
On OpenStack KVM VM
[root@OS-vm ]# lshw -class system description: Computer product: KVM vendor: Red Hat version: RHEL 6.6.0 PC width: 64 bits capabilities: smbios-2.4 dmi-2.4 vsyscall64 vsyscall32
On KVM Host
[root@kvm-host ~]# lshw -class system description: Sealed-case PC product: X8SIL (To Be Filled By O.E.M.) vendor: Supermicro version: 0123456789 width: 64 bits capabilities: smbios-2.6 dmi-2.6 vsyscall32
Method 7: Using ‘ethtool’
On few Hypervisors, you can easily find out if network device is emulated using ‘ethtool’ command.
[centos@kvm-vm ]$ ethtool -i eth0 driver: virtio_net version: 1.0.0 firmware-version: bus-info: 0000:00:02.0 supports-statistics: no supports-test: no supports-eeprom-access: no supports-register-dump: no supports-priv-flags: no
Well, these are few commands that allows you to detect Virtualization on various Hypervisors. Do you know a different method? Let’s us in the comment section below.
