how to know the remote machine is Virtual machine or physical machine

pantdk · 11-14-2011, 03:24 PM

Hi All,

when i see the out put of cat /proc/cpuinfo
48bit for vm
38bit for physical

or their is any way to identify that this is a vm or physical machine

Thanks
dk

Doc CPU · 11-14-2011, 03:41 PM

Hi there,

Quote:

Originally Posted by pantdk

when i see the out put of cat /proc/cpuinfo
48bit for vm
38bit for physical

that looks like lottery numbers to me. Neither of these make sense.

Quote:

Originally Posted by pantdk

or their is any way to identify that this is a vm or physical machine

If the virtualization software is any good, you cannot tell the difference between a virtual and a physical machine by software. That's the idea, after all. There may be some subtle hints from which you can guess that you're running on or talking to a VM; but generally, the intention is that the VM is not distinguishable from a real physical machine.

[X] Doc CPU

kbscores · 11-14-2011, 04:05 PM

Usually there is a specific set of tools on a box that is a vm client. It would vary depending virtual system used. For instance VMware has a VMware-toolkit on its clients.

AND - What he/she is referring to is address sizes

which in this case really has no reference to a "virtual machine"

The virtual aspect there refers to memory.

CPU cores can be virtual as well as physical. For instance usually w/an 8 core processor 4 of them are physical and other 4 are virtual.

That just specifies how many bits can fit in each address or "memory slot"

Below is a good image on wikipedia that shows dataflow in an 8 core processor

http://upload.wikimedia.org/wikipedi..._core_CPU).PNG

pantdk · 11-14-2011, 04:06 PM

Hi
its not a lottery numbers & focus on my machine out put this could be a ESX or vm on ESX ????

I am getting the access from ssh (putty) & i need to fill some inventory sheets so that,s why i needed these information

Quote:

$ cat /proc/cpuinfo |more
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 44
model name : Intel(R) Xeon(R) CPU X5660 @ 2.80GHz
stepping : 2
cpu MHz : 2799.204
cache size : 12288 KB
fpu : yes
fpu_exception : yes
cpuid level : 11
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss syscall nx rdtscp lm constant_
tsc ida nonstop_tsc pni cx16 popcnt lahf_lm
bogomips : 5598.40
clflush size : 64
cache_alignment : 64
address sizes : 40 bits physical, 48 bits virtual
power management: [8]

processor : 1
vendor_id : GenuineIntel
cpu family : 6
model : 44
model name : Intel(R) Xeon(R) CPU X5660 @ 2.80GHz
stepping : 2
cpu MHz : 2799.204
cache size : 12288 KB
fpu : yes
fpu_exception : yes
cpuid level : 11
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss syscall nx rdtscp lm constant_
tsc ida nonstop_tsc pni cx16 popcnt lahf_lm
bogomips : 5597.70
clflush size : 64
cache_alignment : 64
address sizes : 40 bits physical, 48 bits virtual
power management: [8]

processor : 2
vendor_id : GenuineIntel
cpu family : 6
model : 44
model name : Intel(R) Xeon(R) CPU X5660 @ 2.80GHz
stepping : 2
cpu MHz : 2799.204
cache size : 12288 KB
fpu : yes
fpu_exception : yes
cpuid level : 11
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss syscall nx rdtscp lm constant_
tsc ida nonstop_tsc pni cx16 popcnt lahf_lm
bogomips : 5598.32
clflush size : 64
cache_alignment : 64
address sizes : 40 bits physical, 48 bits virtual
power management: [8]

PTrenholme · 11-14-2011, 04:15 PM

I just ran this command in one of my virtual system, and found several /proc files that contained virt inside them.

find /proc -type f -exec grep -l virt '{}' 2>/dev/null ';' 2>/dev/null

Perhaps a check for virtio_balloon.*Live in /proc/modules would do the trick.

That one is alive in my virtual systems but not in the host system. (virtio_net is live in the host and the virtuals.) If you've accessed the system over a network, I think that the virtio net access stuff needs to be running. But I'm not a virtual developer, and one of them might have a better answer.

SecretCode · 11-14-2011, 04:38 PM

That line in the output has nothing to do with running in a vm, it's part of Physical Address Extensions.

Detecting if a host is running within a virtual machine is tricky because you have to rely on specific odd behaviours in each virtualiser.

Have a look at Detect if you are Running a Virtual Machine | CodeHill or How to detect virtualization or any number of other pages for some ideas and some scripts you can examine.

johnsfine · 11-14-2011, 05:00 PM

Quote:

Originally Posted by pantdk

when i see the out put of cat /proc/cpuinfo
48bit for vm
38bit for physical

I think it would be unusual for CPU info from /proc/cpuinfo in a virtual machine to differ from the info of the underlying machine. That would mean the virtualization software has gone to extra effort to do a worse job of simulating a real CPU.

Anyway, 48bit virtual addressing should be standard across all X86_64 CPUs regardless of physical machine vs. virtual machine, while physical addressing will vary by CPU, 38bit is a reasonable amount and I can't think of any reason virtualization software might want to pretend the physical addressing is different from that of the real CPU.

The words "virtual" and "physical" in computer systems have many different meanings. Maybe you did a blind search on those words. "Virtual machine" is a specific computer concept that is quite different from the many other things that "virtual" means.

The links SecretCode provided look plausible to me. I'm not at all expert in how to detect a virtual machine. I'm only saying that /proc/cpuinfo is not likely to be a good place to try to get that answer.

pantdk · 11-15-2011, 11:38 AM

Thanks to all(johnsfine,renholme,SecretCode,kbscores,Doc CPU)

now i found the simplest command

Quote:

dmidecode |grep -i "vm"

glorsplitz · 11-16-2011, 02:38 PM

interesting

dmidecode by itself I found virtual mentioned a few times

dmidecode | grep -i "Virtual"

Version: VirtualBox
Product Name: VirtualBox
Family: Virtual Machine

PTrenholme · 11-16-2011, 06:54 PM

I don't think that dmidecode | grep -i vm is (close to) infallible.

On my host system I get

Code:

$ sudo dmidecode | grep -i vm
                VME (Virtual mode extension)
$

while, on the virtual system I get

Code:

$ sudo dmidecode | grep -i vm
$

samtoddler · 11-17-2011, 09:28 AM

Hi,

I got the same output on my VPS which is a virtual machine.

Code:

[root@localhost ~]# dmidecode  | grep -i "vm"
	Manufacturer: VMware, Inc.
	Product Name: VMware Virtual Platform
	Serial Number: VMware-56 4d d6 6c 32 aa e1 46-46 8b e8 da 78 cb 78 ef
		VME (Virtual mode extension)
	Description: VMware SVGA II
	String 1: [MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7]

but when i ran the above command this give me output

Code:

dmidecode | grep -i vm
                VME (Virtual mode extension)

Can we just believe on the same output to decide that the machine is virtual. I've tested this on near 10 machines
it works the same way.

pantdk · 11-17-2011, 06:40 PM

Hi All,

So is their is any better way to find that this is a physical or virtual machine.

When i am looking for the difference between the VM or physical machine i notice that virtual machine have all most same output

this is the output which i am getting from the vmware workstation 8 rhel5.5 & ESX Virtual machine

Quote:

[dk@localhost ~]$ sudo /usr/sbin/dmidecode |grep -i "vm"
[sudo] password for dk:
Manufacturer: VMware, Inc.
Product Name: VMware Virtual Platform
Serial Number: VMware-56 4d 88 82 d2 6b 27 d1-d6 b2 e3 9b d8 82 43 f0
Description: VMware SVGA II
String 1: [MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7]
[dk@localhost ~]$

This is the output from ESX box virtual machine rhel5.5

Quote:

Manufacturer: VMware, Inc.
Product Name: VMware Virtual Platform
Serial Number: VMware-42 24 73 1e 48 88 83 3b-bd 53 7e c8 1c d3 cc b1
VME (Virtual mode extension)
VME (Virtual mode extension)
VME (Virtual mode extension)
VME (Virtual mode extension)
Description: VMware SVGA II
String 1: [MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7]

PTrenholme · 11-17-2011, 09:08 PM

That is true because you were (obviously) using VMware as your virtual manager. Not every virtual system uses VMware.

In fact, I have my virtuals running under qemu-kvm using Fedora's virtual manager, and, as I noted above, the suggested "test" does not produce any output when run on a Fedora 17 virtual system.

The virt-what script (in the first reference of post 6 by Secret Code) returns KVM for that virtual system.

pantdk · 11-19-2011, 03:39 AM

Hi PTrenholme,

"Thanks for view"
yes that's right every virtual system doesn't uses VMware so their out put dmidecode | grep -i "vm" also not same.
but i have to differentiate between the vm & physical so that's why i do that.

PTrenholme · 11-19-2011, 11:11 AM

A thought: If you use the converse of your original question to ask "How can I tell if I'm running on a non-virtual system?" would the reply of "VME (Virtual mode extension)" be sufficient? (Assuming, of course, that anyone offing a server of which would want to ask the question would be using a modern processor.)