0 - en to zh-CN translation catalogue (298 entries)

en: RAID
zh-CN: RAID（磁盘冗余阵列)

en: LVM
zh-CN: LVM（逻辑卷管理）

en: FAI
zh-CN: 全自动安装

en: Preseeding
zh-CN: 预设值

en: Monitoring
zh-CN: 监控

en: Virtualization
zh-CN: 虚拟化

en: Advanced Administration
zh-CN: 高级管理

en: This chapter revisits some aspects we already described, with a different perspective: instead of installing one single computer, we will study mass-deployment systems; instead of creating RAID or LVM volumes at install time, we'll learn to do it by hand so we can later revise our initial choices. Finally, we will discuss monitoring tools and virtualization techniques. As a consequence, this chapter is more particularly targeting professional administrators, and focuses somewhat less on individuals responsible for their home network.
zh-CN: 本章以不同的视角回到之前已经讲过的几个方面：现在我们将学习大规模部署系统，而非仅仅安装单台计算机。我们将学习手动创建 RAID 和 LVM 卷而非在安装系统时创建，以防将来时情况有变需要修改。最后，我们将讨论监控工具与虚拟化技术。因此，本章主要面向专业管理员，而不太面向使用家庭网络的个人。

en: RAID and LVM
zh-CN: RAID 和 LVM

en: RAID and LVM are both techniques to abstract the mounted volumes from their physical counterparts (actual hard-disk drives or partitions thereof); the former ensures the security and availability of the data in case of hardware failure by introducing redundancy, the latter makes volume management more flexible and independent of the actual size of the underlying disks. In both cases, the system ends up with new block devices, which can be used to create filesystems or swap space, without necessarily having them mapped to one physical disk. RAID and LVM come from quite different backgrounds, but their functionality can overlap somewhat, which is why they are often mentioned together.
zh-CN: RAID 和 LVM 都是将已挂载的卷从它们的硬件层面对应物（实际的硬盘驱动器或分区）抽象化出来的技术。前者通过引入冗余来保证数据在硬件故障时的安全性和可用性，后者可让卷管理更加灵活而不受底层硬盘的实际大小的限制。两者实际上都是无需映射到单个物理磁盘就可以创建文件系统或交换空间的新的块设备（block device）。RAID 和 LVM 诞生的背景大相径庭，然而却有某些相同的功能，因此人们经常同时提起它们。

en: <emphasis>PERSPECTIVE</emphasis> Btrfs combines LVM and RAID
zh-CN: <emphasis>观点</emphasis> Btrfs 融合 LVM 和 RAID

en: Among the noteworthy features are the ability to take a snapshot of a filesystem tree at any point in time. This snapshot copy doesn't initially use any disk space, the data only being duplicated when one of the copies is modified. The filesystem also handles transparent compression of files, and checksums ensure the integrity of all stored data.
zh-CN: 它值得一提的特性之一是它可以在任意时间点创建文件系统树的快照。该快照一开始不会占用任何磁盘空间，而它会在副本发生更改时复制数据。该文件系统还会处理文件的透明压缩，以及保证存储数据完整性的校验和。

en: In both the RAID and LVM cases, the kernel provides a block device file, similar to the ones corresponding to a hard disk drive or a partition. When an application, or another part of the kernel, requires access to a block of such a device, the appropriate subsystem routes the block to the relevant physical layer. Depending on the configuration, this block can be stored on one or several physical disks, and its physical location may not be directly correlated to the location of the block in the logical device.
zh-CN: 在 RAID 和 LVM 的场合下，内核提供一个块设备文件，它类似于那些对应硬盘驱动器或分区的块设备文件。当应用程序或内核的另一部分请求访问该设备的一个块时，对应的子系统会把块关联到相关的硬件层面。这个块可以据配置需要存储到一个或几个实体磁盘上，它的实际位置可能不会直接反映块在逻辑设备中的位置。

en: Software RAID
zh-CN: 软 RAID

en: RAID means <emphasis>Redundant Array of Independent Disks</emphasis>. The goal of this system is to prevent data loss and ensure availability in case of hard disk failure. The general principle is quite simple: data are stored on several physical disks instead of only one, with a configurable level of redundancy. Depending on this amount of redundancy, and even in the event of an unexpected disk failure, data can be losslessly reconstructed from the remaining disks.
zh-CN: RAID 意为磁盘阵列（<emphasis>Redundant Array of Independent Disks</emphasis>）。此系统的目标是防止数据丢失，并确保硬盘故障情况下的可用性。其主要原理十分简单：把数据存储在多个而非单个物理磁盘上，而其冗余性可以调整。取决于冗余性的大小，即使发生了意外的磁盘故障，数据也可以从剩下的磁盘中无损地还原出来。

en: <emphasis>CULTURE</emphasis> <foreignphrase>Independent</foreignphrase> or <foreignphrase>inexpensive</foreignphrase>?
zh-CN: <emphasis>文化</emphasis>要<foreignphrase>independent</foreignphrase>还是要<foreignphrase>inexpensive</foreignphrase>？

en: The I in RAID initially stood for <emphasis>inexpensive</emphasis>, because RAID allowed a drastic increase in data safety without requiring investing in expensive high-end disks. Probably due to image concerns, however, it is now more customarily considered to stand for <emphasis>independent</emphasis>, which doesn't have the unsavory flavor of cheapness.
zh-CN: 一开始 RAID 中的“I”意为<emphasis>inexpensive</emphasis>（低成本），因为 RAID 不需要借助于昂贵的高端磁盘便可以大幅提升数据的安全性，然而，现在习惯上认为它指的是<emphasis>independent</emphasis>（独立性），去掉了所谓低成本的不良印象。

en: RAID can be implemented either by dedicated hardware (RAID modules integrated into SCSI or SATA controller cards) or by software abstraction (the kernel). Whether hardware or software, a RAID system with enough redundancy can transparently stay operational when a disk fails; the upper layers of the stack (applications) can even keep accessing the data in spite of the failure. Of course, this “degraded mode” can have an impact on performance, and redundancy is reduced, so a further disk failure can lead to data loss. In practice, therefore, one will strive to only stay in this degraded mode for as long as it takes to replace the failed disk. Once the new disk is in place, the RAID system can reconstruct the required data so as to return to a safe mode. The applications won't notice anything, apart from potentially reduced access speed, while the array is in degraded mode or during the reconstruction phase.
zh-CN: RAID 可以通过专用硬件（集成到 SCSI 或 SATA 控制器卡中的 RAID 模块）或通过软件抽象（内核）实现。无论是硬件还是软件，具有足够冗余的 RAID 系统都可以在磁盘发生故障时透明地保持运行状态；堆栈（应用程序）的上层甚至可以在发生错误时继续访问数据。当然，这种"降级模式"会对性能产生影响，并且冗余会降低，进一步的磁盘故障可能会导致数据丢失。因此，在实践中，只需要更换发生故障的磁盘，人们就会努力保持这种降级模式。一旦新磁盘就位，RAID 系统就可以重建所需的数据，以便返回到安全模式。当阵列处于降级模式或重建阶段时，除了可能降低访问速度之外，应用程序不会注意到任何情况。

en: When RAID is implemented by hardware, its configuration generally happens within the BIOS setup tool, and the kernel will consider a RAID array as a single disk, which will work as a standard physical disk, although the device name may be different (depending on the driver).
zh-CN: 当 RAID由硬件实现时，RAID配置通常在BIOS设置工具中进行，内核会把RAID阵列当成一个单独的磁盘对待，根据驱动的不同设备名称可能会有所不同，但其使用方式和标准物理磁盘一样。

en: We only focus on software RAID in this book.
zh-CN: 在本书里面，我们只专注于软 RAID。

en: Different RAID Levels
zh-CN: 不同的 RAID 级别

en: RAID is actually not a single system, but a range of systems identified by their levels; the levels differ by their layout and the amount of redundancy they provide. The more redundant, the more failure-proof, since the system will be able to keep working with more failed disks. The counterpart is that the usable space shrinks for a given set of disks; seen the other way, more disks will be needed to store a given amount of data.
zh-CN: RAID 实际上不是单个系统，而是由其级别标识的一系列系统；级别因布局和冗余量而有所不同。冗余的越多，防故障性越高，因为系统将能够继续处理更多故障磁盘。对应的一种是，一组给定磁盘的可用空间收减少；另一方面，需要更多的磁盘来存储给定数量的数据。

en: Linear RAID
zh-CN: 线性 RAID

en: Even though the kernel's RAID subsystem allows creating “linear RAID”, this is not proper RAID, since this setup doesn't involve any redundancy. The kernel merely aggregates several disks end-to-end and provides the resulting aggregated volume as one virtual disk (one block device). That is about its only function. This setup is rarely used by itself (see later for the exceptions), especially since the lack of redundancy means that one disk failing makes the whole aggregate, and therefore all the data, unavailable.
zh-CN: 即使内核的 RAID 子系统允许创建"线性 RAID"，但这不是正确的 RAID，因为此设置不涉及任何冗余。内核只是端到端地聚合多个磁盘，并作为一个虚拟磁盘（一个块设备）提供生成的聚合卷。这是关于它的唯一功能。此设置很少自行使用（请参阅稍后的异常），特别是因为缺少冗余意味着一个磁盘故障使整个聚合所有数据不可用。

en: This level doesn't provide any redundancy either, but disks aren't simply stuck on end one after another: they are divided in <emphasis>stripes</emphasis>, and the blocks on the virtual device are stored on stripes on alternating physical disks. In a two-disk RAID-0 setup, for instance, even-numbered blocks of the virtual device will be stored on the first physical disk, while odd-numbered blocks will end up on the second physical disk.
zh-CN: 此级别也不提供任何冗余，但磁盘不会简单一个接一个工作：它们被分成 <emphasis>stripes</emphasis>（条带），虚拟设备上的块存储在交替物理磁盘上的条带中。例如，在双磁盘 RAID-0 设置中，虚拟设备的偶数块将存储在第一个物理磁盘上，而奇数块将最终存储在第二个物理磁盘上。

en: This system doesn't aim at increasing reliability, since (as in the linear case) the availability of all the data is jeopardized as soon as one disk fails, but at increasing performance: during sequential access to large amounts of contiguous data, the kernel will be able to read from both disks (or write to them) in parallel, which increases the data transfer rate. The disks are utilized entirely by the RAID device, so they should have the same size not to lose performance.
zh-CN: 此系统的目的不是提高可靠性，因为（如线性情况下）在任一个磁盘发生故障时所有数据的可用性都会受到损害，只是提高性能：在连续访问大量连续数据期间，内核能够从两个磁盘并行读取（或写入），从而提高数据传输速率。磁盘完全由 RAID 设备使用，因此它们的大小应该相同，不会损失性能。

en: RAID-0 use is shrinking, its niche being filled by LVM (see later).
zh-CN: RAID-0 的使用正在减少，其优点由 LVM 填补（请参阅后面的内容）。

en: This level, also known as “RAID mirroring”, is both the simplest and the most widely used setup. In its standard form, it uses two physical disks of the same size, and provides a logical volume of the same size again. Data are stored identically on both disks, hence the “mirror” nickname. When one disk fails, the data is still available on the other. For really critical data, RAID-1 can of course be set up on more than two disks, with a direct impact on the ratio of hardware cost versus available payload space.
zh-CN: 此级别也称为"RAID 镜像"，是最简单和最广泛使用的设置。在其标准形式中，它使用两个大小相同的物理磁盘，并提供相同大小的逻辑卷。数据以相同方式存储在两个磁盘上，因此称为"镜像"。当一个磁盘发生故障时，仍然可使用另一个磁盘上的数据。对于真正关键的数据，RAID-1 当然可以在超过两个磁盘上设置，这直接影响到硬件成本与可用有效负载空间的比率。

en: <emphasis>NOTE</emphasis> Disks and cluster sizes
zh-CN: <emphasis>注释</emphasis> 磁盘和卷大小

en: If two disks of different sizes are set up in a mirror, the bigger one will not be fully used, since it will contain the same data as the smallest one and nothing more. The useful available space provided by a RAID-1 volume therefore matches the size of the smallest disk in the array. This still holds for RAID volumes with a higher RAID level, even though redundancy is stored differently.
zh-CN: 如果在镜像中设置了两个大小不同的磁盘，则不会完全使用较大的磁盘，因为它将包含与最小磁盘相同的数据，仅此一项。因此，RAID-1 卷提供的可用空间与阵列中最小磁盘的大小相匹配。这仍然适合具有较高 RAID 级别的 RAID 卷，即使冗余存储方式不同。

en: It is therefore important, when setting up RAID arrays (except for RAID-0 and “linear RAID”), to only assemble disks of identical, or very close, sizes, to avoid wasting resources.
zh-CN: 因此，在设置 RAID 阵列（RAID-0 和"线性 RAID"除外）时，必须使用大小相同或非常接近的磁盘，以避免浪费资源。

en: <emphasis>NOTE</emphasis> Spare disks
zh-CN: <emphasis>注释</emphasis> 备用磁盘

en: RAID levels that include redundancy allow assigning more disks than required to an array. The extra disks are used as spares when one of the main disks fails. For instance, in a mirror of two disks plus one spare, if one of the first two disks fails, the kernel will automatically (and immediately) reconstruct the mirror using the spare disk, so that redundancy stays assured after the reconstruction time. This can be used as another kind of safeguard for critical data.
zh-CN: 包含冗余的 RAID 级别允许为阵列分配比所需更多的磁盘。当其中一个主磁盘发生故障时，多余的磁盘用作备用磁盘。例如，在两个磁盘加一个备用磁盘的镜像中，如果前两个磁盘中的一个发生故障，内核将自动（并立即）使用备用磁盘重建镜像，以便冗余在重建后保持可用。这可用作关键数据的另一种保护。

en: One would be forgiven for wondering how this is better than simply mirroring on three disks to start with. The advantage of the “spare disk” configuration is that the spare disk can be shared across several RAID volumes. For instance, one can have three mirrored volumes, with redundancy assured even in the event of one disk failure, with only seven disks (three pairs, plus one shared spare), instead of the nine disks that would be required by three triplets.
zh-CN: 人们可能想知道，这怎么比简单地使用三个磁盘镜像开始更好呢。"备用磁盘"配置的优点是，备用磁盘可以在多个 RAID 卷之间共享。例如，有3个镜像卷，即使在一个磁盘发生故障时，也可以有冗余保证，只要7个磁盘（3对，外加一个共享备用磁盘），而不是3组3个共需要9个磁盘。

en: This RAID level, although expensive (since only half of the physical storage space, at best, is useful), is widely used in practice. It is simple to understand, and it allows very simple backups: since both disks have identical contents, one of them can be temporarily extracted with no impact on the working system. Read performance is often increased since the kernel can read half of the data on each disk in parallel, while write performance isn't too severely degraded. In case of a RAID-1 array of N disks, the data stays available even with N-1 disk failures.
zh-CN: 此 RAID 级别虽然昂贵（因为最多只有物理存储空间的一半可用），但在实践中被广泛使用。它易于理解，允许非常简单的备份：由于两个磁盘具有相同的内容，可以暂时提取其中一个磁盘，对工作系统没有任何影响。读取性能通常提高，因为内核可以并行读取每个磁盘上一半的数据，而写入性能不会严重下降。如果 RAID-1 阵列包含 N 个磁盘，即使 N-1 磁盘发生故障，数据也保持可用。

en: This RAID level, not widely used, uses N disks to store useful data, and an extra disk to store redundancy information. If that disk fails, the system can reconstruct its contents from the other N. If one of the N data disks fails, the remaining N-1 combined with the “parity” disk contain enough information to reconstruct the required data.
zh-CN: 此 RAID 级别未广泛使用，使用 N 个磁盘来存储有用的数据，以及额外的磁盘来存储冗余信息。如果磁盘发生故障，系统可以从其他 N 个磁盘重构数据。如果其中一个 N 数据磁盘发生故障，则剩余的 N-1 与"奇偶校验"磁盘相结合，包含足够的信息来重建所需的数据。

en: RAID-4 isn't too expensive since it only involves a one-in-N increase in costs and has no noticeable impact on read performance, but writes are slowed down. Furthermore, since a write to any of the N disks also involves a write to the parity disk, the latter sees many more writes than the former, and its lifespan can shorten dramatically as a consequence. Data on a RAID-4 array is safe only up to one failed disk (of the N+1).
zh-CN: RAID-4 并不昂贵，因为它只涉及成本的N分之一的增加，对读取性能没有明显影响，但写入速度会减慢。此外，由于写入任何 N 磁盘也涉及写入奇偶校验磁盘，因此后者的写入量比前者多，因此其寿命会大幅缩短。RAID-4 阵列上的数据仅在最多只有一个磁盘（N+1中）发生故障时保证安全。

en: RAID-5 addresses the asymmetry issue of RAID-4: parity blocks are spread over all of the N+1 disks, with no single disk having a particular role.
zh-CN: RAID-5 解决了 RAID-4 的不对称问题：奇偶校验块分布在所有 N+1 磁盘上，没有一个磁盘具有特定角色。

en: Read and write performance are identical to RAID-4. Here again, the system stays functional with up to one failed disk (of the N+1), but no more.
zh-CN: 读取和写入性能与 RAID-4 相同。同样，系统在最多一个磁盘（N+1中）发生故障时保持运行状态，但是不能有更多磁盘故障。

en: RAID-6 can be considered an extension of RAID-5, where each series of N blocks involves two redundancy blocks, and each such series of N+2 blocks is spread over N+2 disks.
zh-CN: RAID-6 可视为 RAID-5 的扩展，其中每 N 块产生2个冗余块，并且 N+2 块分布在 N+2 个磁盘上。

en: This RAID level is slightly more expensive than the previous two, but it brings some extra safety since up to two drives (of the N+2) can fail without compromising data availability. The counterpart is that write operations now involve writing one data block and two redundancy blocks, which makes them even slower.
zh-CN: 此 RAID 级别比前两个级别稍微昂贵一些，但它带来了一些额外的安全性，因为最多两个驱动器（N+2）出现故障，而不会影响数据可用性。对应的是，写入操作现在涉及写入一个数据块和两个冗余块，这使得它们更慢。

en: This isn't strictly speaking, a RAID level, but a stacking of two RAID groupings. Starting from 2×N disks, one first sets them up by pairs into N RAID-1 volumes; these N volumes are then aggregated into one, either by “linear RAID” or (increasingly) by LVM. This last case goes farther than pure RAID, but there is no problem with that.
zh-CN: 严格来说，这不是 RAID 级别，而是两个 RAID 分组的堆叠。从 2 × N 个磁盘开始，首先将它们按对将它们设置到 N 个 RAID-1 卷中；然后，将 N 个卷通过"线性 RAID"或（越来越多地）由 LVM 聚合为一个卷。最后一个案例比纯 RAID 更进一步，但没有问题。

en: RAID-1+0 can survive multiple disk failures: up to N in the 2×N array described above, provided that at least one disk keeps working in each of the RAID-1 pairs.
zh-CN: RAID-1+0 可以经受多个磁盘故障而幸存：如果每个 RAID-1 对中至少有一个磁盘继续工作，则上述 2×N 阵列中最多可以有 N 个磁盘故障。

en: <emphasis>GOING FURTHER</emphasis> RAID-10
zh-CN: <emphasis>进阶</emphasis> RAID-10

en: RAID-10 is generally considered a synonym of RAID-1+0, but a Linux specificity makes it actually a generalization. This setup allows a system where each block is stored on two different disks, even with an odd number of disks, the copies being spread out along a configurable model.
zh-CN: RAID-10 通常被认为是 RAID-1+0 的同义词，但 Linux 特异性使其实际上成为一种泛化。此设置允许将每个块存储在两个不同的磁盘上的系统，即使磁盘数为奇数，副本也可配置模型分布。

en: Performances will vary depending on the chosen repartition model and redundancy level, and of the workload of the logical volume.
zh-CN: 性能将因所选的重新分配模型、冗余级别以及逻辑卷的工作负载而异。

en: Obviously, the RAID level will be chosen according to the constraints and requirements of each application. Note that a single computer can have several distinct RAID arrays with different configurations.
zh-CN: 显然，RAID 级别将根据每个应用程序的约束和要求进行选择。请注意，一台计算机可以有多个具有不同配置的不同 RAID 阵列。

en: Setting up RAID
zh-CN: 创建 RAID

en: Setting up RAID volumes requires the <emphasis role="pkg">mdadm</emphasis> package; it provides the <command>mdadm</command> command, which allows creating and manipulating RAID arrays, as well as scripts and tools integrating it to the rest of the system, including the monitoring system.
zh-CN: 设置 RAID 卷需要 <emphasis role="pkg">mdadm</emphasis> 软件包；它提供了 <command>mdadm</command> 命令，允许创建和操作 RAID 阵列，以及将其集成到系统的其余部分（包括监控系统）的脚本和工具。

en: Our example will be a server with a number of disks, some of which are already used, the rest being available to setup RAID. We initially have the following disks and partitions:
zh-CN: 下面的示例是具有多个磁盘的服务器，其中一些磁盘已被使用，其余磁盘可用于设置 RAID。我们最初有以下磁盘和分区：

en: the <filename>sdb</filename> disk, 4 GB, is entirely available;
zh-CN: <filename>sdb</filename> 磁盘，4 GB，完全可用;

en: the <filename>sdc</filename> disk, 4 GB, is also entirely available;
zh-CN: <filename>sdc</filename> 磁盘，4 GB，也是完全可用;

en: on the <filename>sdd</filename> disk, only partition <filename>sdd2</filename> (about 4 GB) is available;
zh-CN: <filename>sdd</filename> 磁盘，只有分区 <filename>sdd2</filename>（大约4 GB）可用;

en: finally, a <filename>sde</filename> disk, still 4 GB, entirely available.
zh-CN: 最后，<filename>sde</filename> 磁盘，4 GB，完全可用。

en: <emphasis>NOTE</emphasis> Identifying existing RAID volumes
zh-CN: <emphasis>注释</emphasis> 识别现有的 RAID 卷

en: The <filename>/proc/mdstat</filename> file lists existing volumes and their states. When creating a new RAID volume, care should be taken not to name it the same as an existing volume.
zh-CN: <filename>/proc/mdstat</filename>文件列出现有卷及其状态。创建新的 RAID 卷时，应注意不要将它的名称与现有卷的名称相同。

en: We're going to use these physical elements to build two volumes, one RAID-0 and one mirror (RAID-1). Let's start with the RAID-0 volume:
zh-CN: 我们将使用这些物理元素来构建两个卷，一个 RAID-0 和一个镜像 （RAID-1）。从 RAID-0 卷开始：

en: The <command>mdadm --create</command> command requires several parameters: the name of the volume to create (<filename>/dev/md*</filename>, with MD standing for <foreignphrase>Multiple Device</foreignphrase>), the RAID level, the number of disks (which is compulsory despite being mostly meaningful only with RAID-1 and above), and the physical drives to use. Once the device is created, we can use it like we'd use a normal partition, create a filesystem on it, mount that filesystem, and so on. Note that our creation of a RAID-0 volume on <filename>md0</filename> is nothing but coincidence, and the numbering of the array doesn't need to be correlated to the chosen amount of redundancy. It is also possible to create named RAID arrays, by giving <command>mdadm</command> parameters such as <filename>/dev/md/linear</filename> instead of <filename>/dev/md0</filename>.
zh-CN: <command>mdadm --create</command> 命令需要多个参数：要创建卷的名称（<filename>/dev/md*</filename>，MD 代表 <foreignphrase>Multiple Device</foreignphrase>），RAID 级别，磁盘数量（尽管只在 RAID-1 及以上级别时才有意义），以及要使用的物理驱动器。设备创建后，可以像使用普通分区一样，创建文件系统、挂载文件系统等。请注意，我们创建 RAID-0 卷到 <filename>md0</filename> 只是巧合，阵列的编号不需要与所选的冗余量相关。还可以使用 <command>mdadm</command> 参数如 <filename>/dev/md/linear</filename> 代替 <filename>/dev/md0</filename> 来命名 RAID 阵列。

en: Creation of a RAID-1 follows a similar fashion, the differences only being noticeable after the creation:
zh-CN: 创建 RAID-1 的方式十分类似，仅在创建后有明显差异：

en: <emphasis>TIP</emphasis> RAID, disks and partitions
zh-CN: <emphasis>技巧</emphasis> RAID、磁盘和分区

en: A few remarks are in order. First, <command>mdadm</command> notices that the physical elements have different sizes; since this implies that some space will be lost on the bigger element, a confirmation is required.
zh-CN: 顺序的几个注意事项。首先，<command>mdadm</command> 提示物理磁盘具有不同的大小；这意味着在较大的磁盘上会丢失一些空间，因此需要确认。

en: More importantly, note the state of the mirror. The normal state of a RAID mirror is that both disks have exactly the same contents. However, nothing guarantees this is the case when the volume is first created. The RAID subsystem will therefore provide that guarantee itself, and there will be a synchronization phase as soon as the RAID device is created. After some time (the exact amount will depend on the actual size of the disks…), the RAID array switches to the “active” or “clean” state. Note that during this reconstruction phase, the mirror is in a degraded mode, and redundancy isn't assured. A disk failing during that risk window could lead to losing all the data. Large amounts of critical data, however, are rarely stored on a freshly created RAID array before its initial synchronization. Note that even in degraded mode, the <filename>/dev/md1</filename> is usable, and a filesystem can be created on it, as well as some data copied on it.
zh-CN: 更重要的是，注意镜像的状态。RAID 镜像的正常状态是两个磁盘的内容完全相同。但是，在首次创建卷时，不保证是这种情况。因此，RAID 子系统将提供该保证，并且一旦创建 RAID 设备，就会有一个同步阶段。一段时间后（确切的数量将取决于磁盘的实际大小...），RAID 阵列将切换到"active"或"clean"状态。请注意，在重建阶段，镜像处于降级模式，并且无法保证冗余。该风险窗口期间磁盘故障可能导致丢失所有数据。但是，在初始同步之前，大量关键数据很少存储在新创建的 RAID 阵列上。请注意，即使在降级模式下，<filename>/dev/md1</filename> 也可用，并且可以在其上创建文件系统以及复制的一些数据。

en: <emphasis>TIP</emphasis> Starting a mirror in degraded mode
zh-CN: <emphasis>提示</emphasis> 以降级模式启动镜像

en: Sometimes two disks are not immediately available when one wants to start a RAID-1 mirror, for instance because one of the disks one plans to include is already used to store the data one wants to move to the array. In such circumstances, it is possible to deliberately create a degraded RAID-1 array by passing <filename>missing</filename> instead of a device file as one of the arguments to <command>mdadm</command>. Once the data have been copied to the “mirror”, the old disk can be added to the array. A synchronization will then take place, giving us the redundancy that was wanted in the first place.
zh-CN: 有时，当想要启动 RAID-1 镜像时，两个磁盘无法立即可用，例如，因为计划包含的一个磁盘已用于存储要移动到阵列的数据。在这种情况下，可以创建降级的 RAID-1 阵列，将<filename>missing</filename> 而不是设备文件作为参数之一传递到 <command>mdadm</command>。将数据复制到"镜像"后，旧磁盘可以添加到阵列中。然后进行同步，为我们提供最初想要的冗余。

en: <emphasis>TIP</emphasis> Setting up a mirror without synchronization
zh-CN: <emphasis>提示</emphasis> 设置不同步的镜像

en: RAID-1 volumes are often created to be used as a new disk, often considered blank. The actual initial contents of the disk is therefore not very relevant, since one only needs to know that the data written after the creation of the volume, in particular the filesystem, can be accessed later.
zh-CN: RAID-1 卷通常作为新磁盘创建，通常视为空白磁盘。因此，磁盘的实际初始内容不太相关，因为用户只需要知道创建卷后写入的数据，特别是文件系统，以后可以访问。

en: One might therefore wonder about the point of synchronizing both disks at creation time. Why care whether the contents are identical on zones of the volume that we know will only be read after we have written to them?
zh-CN: 因此，人们可能会怀疑在创建时同步两个磁盘的要点。为什么要关心只有在写入信息之后才能读取卷区域的内容是否相同呢？

en: Fortunately, this synchronization phase can be avoided by passing the <literal>--assume-clean</literal> option to <command>mdadm</command>. However, this option can lead to surprises in cases where the initial data will be read (for instance if a filesystem is already present on the physical disks), which is why it isn't enabled by default.
zh-CN: 幸运的是，通过将 <literal>--assume-clean</literal> 选项传递到 <command>mdadm</command> 可以避免同步。但是，在读取初始数据的情况下（例如，如果物理磁盘上已存在文件系统），此选项可能会导致意外，这是默认情况下未启用该选项的原因。

en: Now let's see what happens when one of the elements of the RAID-1 array fails. <command>mdadm</command>, in particular its <literal>--fail</literal> option, allows simulating such a disk failure:
zh-CN: 现在，看看当 RAID-1 阵列的一个磁盘发生故障时会发生什么。<command>mdadm</command> 的 <literal>--fail</literal> 选项，可以模拟这样的磁盘故障：

en: The contents of the volume are still accessible (and, if it is mounted, the applications don't notice a thing), but the data safety isn't assured anymore: should the <filename>sdd</filename> disk fail in turn, the data would be lost. We want to avoid that risk, so we'll replace the failed disk with a new one, <filename>sdf</filename>:
zh-CN: 卷的内容仍然可以访问（如果已经挂载，应用程序不会注意到任何变化），但数据安全不再得到保证：如果接下来 <filename>sdd</filename> 磁盘发生故障，数据将丢失。我们希望避免这种风险，因此我们将用新的磁盘 <filename> sdf</filename> 替换发生故障的磁盘：

en: Here again, the kernel automatically triggers a reconstruction phase during which the volume, although still accessible, is in a degraded mode. Once the reconstruction is over, the RAID array is back to a normal state. One can then tell the system that the <filename>sde</filename> disk is about to be removed from the array, so as to end up with a classical RAID mirror on two disks:
zh-CN: 同样，内核会自动触发一个重建阶段，在此期间，卷虽然仍然可以访问，但处于降级模式。重建完成后，RAID 阵列将恢复正常状态。然后，可以告诉系统，<filename>sde</filename>磁盘即将从阵列中删除，以便最终在两个磁盘上使用经典 RAID 镜像：

en: From then on, the drive can be physically removed when the server is next switched off, or even hot-removed when the hardware configuration allows hot-swap. Such configurations include some SCSI controllers, most SATA disks, and external drives operating on USB or Firewire.
zh-CN: 从此，当服务器下次关闭时，可以物理删除驱动器，当硬件配置允许热插拔时，甚至可以热删除驱动器。此类配置包括某些 SCSI 控制器、大多数 SATA 磁盘以及使用 USB 或 Firewire 操作的外部驱动器。

en: Backing up the Configuration
zh-CN: 备份配置

en: Backing up the configuration is therefore important, if only for reference. The standard way to do it is by editing the <filename>/etc/mdadm/mdadm.conf</filename> file, an example of which is listed here:
zh-CN: 因此，备份配置非常重要，如果仅供参考的话。这样做的标准方式是编辑<filename>/etc/mdadm/mdadm.conf</filename>文件，下面列出了一个示例：

en: <command>mdadm</command> configuration file
zh-CN: <command>mdadm</command> 配置文件

en: One of the most useful details is the <literal>DEVICE</literal> option, which lists the devices where the system will automatically look for components of RAID volumes at start-up time. In our example, we replaced the default value, <literal>partitions containers</literal>, with an explicit list of device files, since we chose to use entire disks and not only partitions, for some volumes.
zh-CN: 最有用的详细信息之一是 <literal>DEVICE</literal> 选项，它列出了系统将在启动时自动查找 RAID 卷组件的设备。在我们的示例中，我们用设备文件的显式列表替换了默认值<literal>partitions containers</literal>，因为我们选择对某些卷使用整个磁盘，而不是仅使用分区。

en: The last two lines in our example are those allowing the kernel to safely pick which volume number to assign to which array. The metadata stored on the disks themselves are enough to re-assemble the volumes, but not to determine the volume number (and the matching <filename>/dev/md*</filename> device name).
zh-CN: 示例中的最后两行是允许内核安全地选择分配给哪个阵列的卷号。存储在磁盘本身的元数据足以重新组装卷，但无法确定卷号（以及匹配的 <filename>/dev/md*</filename>名称）。

en: Fortunately, these lines can be generated automatically:
zh-CN: 幸运的是，这些行可以自动生成：

en: The contents of these last two lines doesn't depend on the list of disks included in the volume. It is therefore not necessary to regenerate these lines when replacing a failed disk with a new one. On the other hand, care must be taken to update the file when creating or deleting a RAID array.
zh-CN: 最后两行的内容不依赖于卷中包含的磁盘列表。因此，在用新磁盘替换故障磁盘时，不需要重新生成这些行。另一方面，在创建或删除 RAID 阵列时，必须注意更新文件。

en: LVM, the <emphasis>Logical Volume Manager</emphasis>, is another approach to abstracting logical volumes from their physical supports, which focuses on increasing flexibility rather than increasing reliability. LVM allows changing a logical volume transparently as far as the applications are concerned; for instance, it is possible to add new disks, migrate the data to them, and remove the old disks, without unmounting the volume.
zh-CN: LVM <emphasis>Logical Volume Manager</emphasis>（逻辑卷管理器），在物理支持上实现逻辑卷的另一种方式，侧重于提高灵活性而不是提高可靠性。就应用程序而言，LVM 允许透明地更改逻辑卷；如可以添加新磁盘、将数据迁移到磁盘并删除旧磁盘，而无需卸载卷。

en: LVM Concepts
zh-CN: LVM 概念

en: This flexibility is attained by a level of abstraction involving three concepts.
zh-CN: 这种灵活性是由涉及三个概念的抽象级别实现的。

en: First, the PV (<emphasis>Physical Volume</emphasis>) is the entity closest to the hardware: it can be partitions on a disk, or a full disk, or even any other block device (including, for instance, a RAID array). Note that when a physical element is set up to be a PV for LVM, it should only be accessed via LVM, otherwise the system will get confused.
zh-CN: 首先，PV（<emphasis>Physical Volume</emphasis>，物理卷）是最接近硬件的实体：它可以是磁盘上的分区、完整磁盘，甚至任何其他块设备（包括 RAID 阵列）。请注意，当物理元素设置为 LVM 的 PV 时，应仅通过 LVM 访问它，否则系统会混淆。

en: A number of PVs can be clustered in a VG (<emphasis>Volume Group</emphasis>), which can be compared to disks both virtual and extensible. VGs are abstract, and don't appear in a device file in the <filename>/dev</filename> hierarchy, so there is no risk of using them directly.
zh-CN: 许多 PV 可以在 VG（<emphasis>Volume Group</emphasis>，卷组）中进行群集，可以与虚拟磁盘和可扩展磁盘进行比较。VG 是抽象的，不会显示在 <filename>/dev </filename>中的设备文件中，因此没有直接使用它们的风险。

en: The third kind of object is the LV (<emphasis>Logical Volume</emphasis>), which is a chunk of a VG; if we keep the VG-as-disk analogy, the LV compares to a partition. The LV appears as a block device with an entry in <filename>/dev</filename>, and it can be used as any other physical partition can be (most commonly, to host a filesystem or swap space).
zh-CN: 第三种对象是LV（<emphasis>Logical Volume</emphasis>，逻辑卷），是VG的一个区块；如果我们保持VG作为磁盘类比，LV则类比一个分区。LV 显示为具有 <filename>/dev </filename> 中条目的块设备，它可用作任何其他物理分区（通常用于托管文件系统或交换空间）。

en: The important thing is that the splitting of a VG into LVs is entirely independent of its physical components (the PVs). A VG with only a single physical component (a disk for instance) can be split into a dozen logical volumes; similarly, a VG can use several physical disks and appear as a single large logical volume. The only constraint, obviously, is that the total size allocated to LVs can't be bigger than the total capacity of the PVs in the volume group.
zh-CN: 重要的是，VG拆分为 LV 完全独立于其物理组件（PV）。只有单个物理组件（例如磁盘）的 VG 可以拆分为十几个逻辑卷；同样，VG 可以使用多个物理磁盘，并显示为单个大型逻辑卷。显然，唯一的约束是分配给 GV 的总大小不能大于卷组中 PV 的总容量。

en: It often makes sense, however, to have some kind of homogeneity among the physical components of a VG, and to split the VG into logical volumes that will have similar usage patterns. For instance, if the available hardware includes fast disks and slower disks, the fast ones could be clustered into one VG and the slower ones into another; chunks of the first one can then be assigned to applications requiring fast data access, while the second one will be kept for less demanding tasks.
zh-CN: 但是，在 VG 的物理组件之间具有某种同质性，并将 VG 拆分为具有类似使用模式的逻辑卷通常有意义。例如，如果可用硬件包括快速磁盘和较慢的磁盘，则快速磁盘可以聚类到一个 VG 中，而慢速磁盘可以聚类到另一个 VG 中；然后，第一个区块可以分配给需要快速数据访问的应用程序，而第二个块将保留为要求较低的任务。

en: In any case, keep in mind that an LV isn't particularly attached to any one PV. It is possible to influence where the data from an LV are physically stored, but this possibility isn't required for day-to-day use. On the contrary: when the set of physical components of a VG evolves, the physical storage locations corresponding to a particular LV can be migrated across disks (while staying within the PVs assigned to the VG, of course).
zh-CN: 在任何情况下，请记住，LV 不是特别附加到任何一个 PV。可以影响来自 LV 的数据的物理存储位置，但日常使用不需要这种可能性。相反：当 VG 的物理组件集发生变化时，与特定 LV 对应的物理存储位置可以跨磁盘迁移（当然，在分配给 VG 的PV 中）。

en: Setting up LVM
zh-CN: 搭建 LVM

en: Let us now follow, step by step, the process of setting up LVM for a typical use case: we want to simplify a complex storage situation. Such a situation usually happens after some long and convoluted history of accumulated temporary measures. For the purposes of illustration, we'll consider a server where the storage needs have changed over time, ending up in a maze of available partitions split over several partially used disks. In more concrete terms, the following partitions are available:
zh-CN: 现在，我们一步一步地遵循为典型用例设置 LVM 的过程：我们希望简化复杂的存储情况。这种情况通常发生在一些长期和错综复杂的临时措施的历史之后。为了便于说明，我们将考虑一个存储需求随着时间而变化的服务器，最终进入一个可用分区拆分为几个部分使用的磁盘中。更具体地而言，有以下分区可用：

en: on the <filename>sdb</filename> disk, a <filename>sdb2</filename> partition, 4 GB;
zh-CN: <filename>sdb</filename> 磁盘，<filename>sdb2</filename> 分区，4 GB;

en: on the <filename>sdc</filename> disk, a <filename>sdc3</filename> partition, 3 GB;
zh-CN: <filename>sdc</filename> 磁盘，<filename>sdc3</filename> 分区，3 GB;

en: the <filename>sdd</filename> disk, 4 GB, is fully available;
zh-CN: <filename>sdd</filename> 磁盘，4 GB，完全可用;

en: on the <filename>sdf</filename> disk, a <filename>sdf1</filename> partition, 4 GB; and a <filename>sdf2</filename> partition, 5 GB.
zh-CN: <filename>sdf</filename> 磁盘，<filename>sdf1</filename> 分区，4 GB; 以及 <filename>sdf2</filename> 分区，5 GB。

en: In addition, let's assume that disks <filename>sdb</filename> and <filename>sdf</filename> are faster than the other two.
zh-CN: 此外，假设磁盘 <filename>sdb</filename> 和 <filename>sdf</filename> 色速度比另外两个更快。

en: Our goal is to set up three logical volumes for three different applications: a file server requiring 5 GB of storage space, a database (1 GB) and some space for back-ups (12 GB). The first two need good performance, but back-ups are less critical in terms of access speed. All these constraints prevent the use of partitions on their own; using LVM can abstract the physical size of the devices, so the only limit is the total available space.
zh-CN: 我们的目标是为3个不同的应用程序设置3个逻辑卷：需要 5 GB 存储空间的文件服务器、数据库（1 GB）和一些备份空间 （12 GB）。前两个需要良好的性能，但备份在访问速度方面不太重要。所有这些限制都阻止使用分区本身；使用 LVM 可以抽象设备的物理大小，因此唯一的限制是总可用空间。

en: The required tools are in the <emphasis role="pkg">lvm2</emphasis> package and its dependencies. When they're installed, setting up LVM takes three steps, matching the three levels of concepts.
zh-CN: 所需的工具在 <emphasis role="pkg">lvm2</emphasis> 软件包及其依赖项中。安装 LVM 时，需要三个步骤，与三个级别的概念相匹配。

en: First, we prepare the physical volumes using <command>pvcreate</command>:
zh-CN: 首先，使用 <command>pvcreate</command> 准备物理卷：

en: So far, so good; note that a PV can be set up on a full disk as well as on individual partitions of it. As shown above, the <command>pvdisplay</command> command lists the existing PVs, with two possible output formats.
zh-CN: 到目前为止，都很好；请注意，可以在完整磁盘以及其各个分区上设置 PV。如上所述，<command>pvdisplay</command>列出了现有的PV，有两种输出格式。

en: Now let's assemble these physical elements into VGs using <command>vgcreate</command>. We'll gather only PVs from the fast disks into a <filename>vg_critical</filename> VG; the other VG, <filename>vg_normal</filename>, will also include slower elements.
zh-CN: 现在，使用 <command>vgcreate</command> 将这些物理元素组合。将快速磁盘放到一个VG <filename>vg_critical</filename>；其他 VG <filename>vg_normal</filename> 包含较慢的元素。

en: Here again, commands are rather straightforward (and <command>vgdisplay</command> proposes two output formats). Note that it is quite possible to use two partitions of the same physical disk into two different VGs. Note also that we used a <filename>vg_</filename> prefix to name our VGs, but it is nothing more than a convention.
zh-CN: 同样，命令相当简单（<command>vgdisplay</command> 有两种输出格式）。请注意，将同一物理磁盘的两个分区用于两个不同的 VG 是有可能的。 请注意，我们使用 <filename>vg_</filename> 前缀来命名我们的 VG，但它只不过是一个约定。

en: We now have two “virtual disks”, sized about 8 GB and 12 GB respectively. Let's now carve them up into “virtual partitions” (LVs). This involves the <command>lvcreate</command> command, and a slightly more complex syntax:
zh-CN: 我们现在有两个"虚拟磁盘"，大小分别约为 8 GB 和 12 GB。现在，让我们将它们分成"虚拟分区"（LV）。这涉及到<command>lvcreate</command>命令，以及稍微复杂的语法：

en: Two parameters are required when creating logical volumes; they must be passed to the <command>lvcreate</command> as options. The name of the LV to be created is specified with the <literal>-n</literal> option, and its size is generally given using the <literal>-L</literal> option. We also need to tell the command what VG to operate on, of course, hence the last parameter on the command line.
zh-CN: 创建逻辑卷时需要两个参数；必须传递到 <command>lvcreate</command> 作为选项。使用 <literal>-n</literal> 选项指定要创建的 LV 的名称，通常使用 <literal>-L </literal> 选项指定其大小。当然，还需要告诉命令要对哪个 VG 进行操作，作为命令行上的最后一个参数。

en: <emphasis>GOING FURTHER</emphasis> <command>lvcreate</command> options
zh-CN: <emphasis>进阶</emphasis> <command>lvcreate</command> 选项

en: The <command>lvcreate</command> command has several options to allow tweaking how the LV is created.
zh-CN: <command>lvcreate</command> 命令有几个选项，允许调整LV的创建方式。

en: Let's first describe the <literal>-l</literal> option, with which the LV's size can be given as a number of blocks (as opposed to the “human” units we used above). These blocks (called PEs, <emphasis>physical extents</emphasis>, in LVM terms) are contiguous units of storage space in PVs, and they can't be split across LVs. When one wants to define storage space for an LV with some precision, for instance to use the full available space, the <literal>-l</literal> option will probably be preferred over <literal>-L</literal>.
zh-CN: 先描述一下 <literal>-l</literal> 选项，其中 LV 的大小可以作为多个块（而不是上面使用的"人类"单位）。这些块（用 LVM 术语表示是 PE，<emphasis>physical extents</emphasis>，物理区域）是 PV 中存储空间的连续单位，它们不能跨 LV 拆分。当想要精确地定义 LV 的存储空间（例如使用完全可用空间）时，<literal>-l</literal> 选项可能比 <literal>-L</literal> 更可取。

en: It is also possible to hint at the physical location of an LV, so that its extents are stored on a particular PV (while staying within the ones assigned to the VG, of course). Since we know that <filename>sdb</filename> is faster than <filename>sdf</filename>, we may want to store the <filename>lv_base</filename> there if we want to give an advantage to the database server compared to the file server. The command line becomes: <command>lvcreate -n lv_base -L 1G vg_critical /dev/sdb2</command>. Note that this command can fail if the PV doesn't have enough free extents. In our example, we would probably have to create <filename>lv_base</filename> before <filename>lv_files</filename> to avoid this situation – or free up some space on <filename>sdb2</filename> with the <command>pvmove</command> command.
zh-CN: 也可以提示 LV 的物理位置，以便其扩展存储区到特定的 PV 上（当然，在分配给 VG 的 PV 内）。由于我们知道 <filename>sdb</filename>比 <filename>sdf</filename> 快，因此如果我们想要为数据库服务器提供与文件服务器更好的性能，可能希望将 <filename>lv_base</filename> 存储在那里。命令行为：<command>lvcreate -n lv_base -L 1G vg_critical /dev/sdb2</command>。请注意，如果 PV 没有足够的可用区域，此命令可能会失败。在上面的示例中的情况，可能需要创建 <filename>lv_base</filename> 到 <filename>lv_files</filename> 之前 – 或者使用 <command>pvmove</command> 命令在 <filename>sdb2</filename> 上释放一些空间。

en: Logical volumes, once created, end up as block device files in <filename>/dev/mapper/</filename>:
zh-CN: 逻辑卷创建成功，最终作为块设备文件 <filename>/dev/mapper/</filename>：

en: <emphasis>NOTE</emphasis> Auto-detecting LVM volumes
zh-CN: <emphasis>注释</emphasis> 自动检测 LVM 卷

en: When the computer boots, the <filename>lvm2-activation</filename> systemd service unit executes <command>vgchange -aay</command> to “activate” the volume groups: it scans the available devices; those that have been initialized as physical volumes for LVM are registered into the LVM subsystem, those that belong to volume groups are assembled, and the relevant logical volumes are started and made available. There is therefore no need to edit configuration files when creating or modifying LVM volumes.
zh-CN: 当计算机启动时，<filename>lvm2-activation</filename> 系统服务单元执行 <command>vgchange-aay</command> 以"激活"卷组：扫描可用设备；已初始化为 LVM 物理卷的卷将注册到 LVM 子系统中，那些属于卷组的数据将组装，相关逻辑卷将启动并可用。因此，在创建或修改 LVM 卷时无需编辑配置文件。

en: Note, however, that the layout of the LVM elements (physical and logical volumes, and volume groups) is backed up in <filename>/etc/lvm/backup</filename>, which can be useful in case of a problem (or just to sneak a peek under the hood).
zh-CN: 但是请注意，LVM 元素（物理和逻辑卷以及卷组）的布局备份到 <filename>/etc/lvm/backup</filename>，这对于出现问题（或只是看一下）非常有用。

en: To make things easier, convenience symbolic links are also created in directories matching the VGs:
zh-CN: 为了使事情变得更容易，在与 VG 匹配的目录中还创建了方便的符号链接：

en: The LVs can then be used exactly like standard partitions:
zh-CN: 然后，LV 可以与标准分区完全一样使用：

en: From the applications' point of view, the myriad small partitions have now been abstracted into one large 12 GB volume, with a friendlier name.
zh-CN: 从应用程序的角度来看，多个小分区现在已经抽象成一个大的 12 GB 卷，具有更友好的名称。

en: LVM Over Time
zh-CN: LVM 的发展

en: Even though the ability to aggregate partitions or physical disks is convenient, this is not the main advantage brought by LVM. The flexibility it brings is especially noticed as time passes, when needs evolve. In our example, let's assume that new large files must be stored, and that the LV dedicated to the file server is too small to contain them. Since we haven't used the whole space available in <filename>vg_critical</filename>, we can grow <filename>lv_files</filename>. For that purpose, we'll use the <command>lvresize</command> command, then <command>resize2fs</command> to adapt the filesystem accordingly:
zh-CN: 尽管聚合分区或物理磁盘的能力很方便，但这不是 LVM 带来的主要优势。随着时间推移，当需求发生变化时，它带来的灵活性尤其值得注意。在以上示例中，我们假设必须存储新的大型文件，并且专用于文件服务器的 LV 太小，无法包含它们。由于我们尚未使用整个 <filename>vg_critical</filename> 的可用空间，我们可以扩展 <filename>lv_files</filename>。为此，将使用命令 <command>lvresize</command>，然后使用 <command>resize2fs</command> 相应地调整文件系统：

en: <emphasis>CAUTION</emphasis> Resizing filesystems
zh-CN: <emphasis>注意</emphasis> 调整文件系统的大小

en: Not all filesystems can be resized online; resizing a volume can therefore require unmounting the filesystem first and remounting it afterwards. Of course, if one wants to shrink the space allocated to an LV, the filesystem must be shrunk first; the order is reversed when the resizing goes in the other direction: the logical volume must be grown before the filesystem on it. It is rather straightforward, since at no time must the filesystem size be larger than the block device where it resides (whether that device is a physical partition or a logical volume).
zh-CN: 并非所有文件系统都可以在线调整大小；因此，调整卷的大小可能需要先卸载文件系统，然后重新挂载文件系统。当然，如果想要缩小分配给 LV 的空间，则必须先缩小文件系统；当要增加大小则顺序将相反：逻辑卷必须在其上的文件系统之前增大。这相当简单，因为文件系统的大小绝不能大于它所在的块设备（无论该设备是物理分区还是逻辑卷）。

en: The ext3, ext4 and xfs filesystems can be grown online, without unmounting; shrinking requires an unmount. The reiserfs filesystem allows online resizing in both directions. The venerable ext2 allows neither, and always requires unmounting.
zh-CN: ext3、ext4 和 xfs 文件系统可以在线扩展，无需卸载；缩小则需要卸载。reiserfs 文件系统允许在线调整大小。较旧的 ext2 文件系统不允许在线调整大小，始终需要卸载。

en: We could proceed in a similar fashion to extend the volume hosting the database, only we've reached the VG's available space limit:
zh-CN: 我们可以用类似的方式扩展托管数据库的卷，除非已达到 VG 的可用空间限制：

en: <emphasis>GOING FURTHER</emphasis> Advanced LVM
zh-CN: <emphasis>进阶</emphasis>高级 LVM

en: LVM also caters for more advanced uses, where many details can be specified by hand. For instance, an administrator can tweak the size of the blocks that make up physical and logical volumes, as well as their physical layout. It is also possible to move blocks across PVs, for instance, to fine-tune performance or, in a more mundane way, to free a PV when one needs to extract the corresponding physical disk from the VG (whether to affect it to another VG or to remove it from LVM altogether). The manual pages describing the commands are generally clear and detailed. A good entry point is the <citerefentry><refentrytitle>lvm</refentrytitle> <manvolnum>8</manvolnum></citerefentry> manual page.
zh-CN: LVM 还有更高级的用途，其中许多细节可以手动指定。例如，管理员可以调整组成物理卷和逻辑卷的块的大小，以及它们的物理布局。也可以跨 PV 移动块，例如，调整性能，或者在需要从 VG 中提取相应的物理磁盘（将其转移到另一个 VG 或将其从 LVM 中完全删除）时释放 PV。描述这些命令的手册页通常清晰而详细。较好的入口是 <citerefentry><refentrytitle>lvm</refentrytitle> <manvolnum>8</manvolnum></citerefentry> 手册页。

en: RAID or LVM?
zh-CN: RAID 还是 LVM？

en: RAID and LVM both bring indisputable advantages as soon as one leaves the simple case of a desktop computer with a single hard disk where the usage pattern doesn't change over time. However, RAID and LVM go in two different directions, with diverging goals, and it is legitimate to wonder which one should be adopted. The most appropriate answer will of course depend on current and foreseeable requirements.
zh-CN: RAID 和 LVM 都带来了无可争辩的优势，只要将台式计算机的一个硬盘保留，而使用模式不会随着时间而变化。然而，RAID 和 LVM 的目标不同，因此有理由怀疑应该采用哪一个。最适当的答案当然取决于当前和可预见的要求。

en: There are a few simple cases where the question doesn't really arise. If the requirement is to safeguard data against hardware failures, then obviously RAID will be set up on a redundant array of disks, since LVM doesn't really address this problem. If, on the other hand, the need is for a flexible storage scheme where the volumes are made independent of the physical layout of the disks, RAID doesn't help much and LVM will be the natural choice.
zh-CN: 有几个简单的案例，但不是真实的情况。如果要求是保护数据免受硬件故障的影响，那么很明显， 在冗余磁盘阵列上设置 RAID，因为 LVM 并没有真正解决此问题。另一方面，如果需要一种灵活的存储方案，其中卷独立于磁盘的物理布局，RAID 不会帮上什么忙，LVM 将是自然的选择。

en: <emphasis>NOTE</emphasis> If performance matters…
zh-CN: <emphasis>注释</emphasis> 如果性能很重要…

en: The third notable use case is when one just wants to aggregate two disks into one volume, either for performance reasons or to have a single filesystem that is larger than any of the available disks. This case can be addressed both by a RAID-0 (or even linear-RAID) and by an LVM volume. When in this situation, and barring extra constraints (for instance, keeping in line with the rest of the computers if they only use RAID), the configuration of choice will often be LVM. The initial set up is barely more complex, and that slight increase in complexity more than makes up for the extra flexibility that LVM brings if the requirements change or if new disks need to be added.
zh-CN: 第三个值得注意的用例是，只想将两个磁盘聚合到一个卷中，或者出于性能原因，或者有一个比任何可用磁盘都大的文件系统。可以通过 RAID-0（甚至线性 RAID）和 LVM 卷解决此情况。在这种情况下，除非存在额外的限制（例如计算机仅要与其余计算机保持一致使用 RAID，通常选择是配置 LVM。初始设置几乎要复杂得多，如果需求发生变化或需要添加新磁盘，LVM 带来的复杂性略有增加，弥补 LVM 带来的额外灵活性。

en: Then of course, there is the really interesting use case, where the storage system needs to be made both resistant to hardware failure and flexible when it comes to volume allocation. Neither RAID nor LVM can address both requirements on their own; no matter, this is where we use both at the same time — or rather, one on top of the other. The scheme that has all but become a standard since RAID and LVM have reached maturity is to ensure data redundancy first by grouping disks in a small number of large RAID arrays, and to use these RAID arrays as LVM physical volumes; logical partitions will then be carved from these LVs for filesystems. The selling point of this setup is that when a disk fails, only a small number of RAID arrays will need to be reconstructed, thereby limiting the time spent by the administrator for recovery.
zh-CN: 当然，还有非常有趣的用例，即存储系统既需要抵抗硬件故障，又需要灵活地进行卷分配。RAID 和 LVM 都无法自己满足这两个要求；不管怎样，这是我们同时使用这两个的地方 — 或者更确切地说，一个放在另一个上面。自 RAID 和 LVM 成熟以来，这一方案已完全成为标准，其方案是首先通过将磁盘分组到少量大型 RAID 阵列中，然后使用这些 RAID 阵列作为 LVM 物理卷来确保数据冗余；然后，逻辑分区将从这些 LV 中配置为文件系统。此设置的卖点是，当磁盘发生故障时，只需重建少量 RAID 阵列，从而减少管理员用于恢复的时间。

en: RAID-1 and LVM are combined to satisfy these constraints. The disks are attached to two different SATA controllers to optimize parallel access and reduce the risk of a simultaneous failure, and they therefore appear as <filename>sda</filename> and <filename>sdc</filename>. They are partitioned identically along the following scheme:
zh-CN: RAID-1 和 LVM 组合在一起以满足这些条件。磁盘连接到两个不同的 SATA 控制器，以优化并行访问并降低同时发生故障的风险，因此它们显示为 <filename>sda</filename> 和 <filename>sdc</filename>。它们沿以下方案进行分区：

en: Once the VGs are created, they can be partitioned in a very flexible way. One must keep in mind that LVs created in <filename>vg_raid</filename> will be preserved even if one of the disks fails, which will not be the case for LVs created in <filename>vg_bulk</filename>; on the other hand, the latter will be allocated in parallel on both disks, which allows higher read or write speeds for large files.
zh-CN: 创建 VG 后，可以非常灵活地对 VG 进行分区。必须记住，即使其中一个磁盘故障，<filename>vg_raid</filename> 中创建的 LV 都会保留，而在 <filename>vg_bulk</filename> 中创建的 LV 则不会保留；另一方面，后者将并行分配给两个磁盘，这允许大文件有更高的读取或写入速度。

en: We will therefore create the <filename>lv_var</filename> and <filename>lv_home</filename> LVs on <filename>vg_raid</filename>, to host the matching filesystems; another large LV, <filename>lv_movies</filename>, will be used to host the definitive versions of movies after editing. The other VG will be split into a large <filename>lv_rushes</filename>, for data straight out of the digital video cameras, and a <filename>lv_tmp</filename> for temporary files. The location of the work area is a less straightforward choice to make: while good performance is needed for that volume, is it worth risking losing work if a disk fails during an editing session? Depending on the answer to that question, the relevant LV will be created on one VG or the other.
zh-CN: 因此，我们将在 <filename>vg_raid</filename> 中创建 <filename>lv_var</filename> 和 <filename>lv_home</filename>，以存放对应的文件系统；另一个大型LV <filename>lv_movies</filename>，将用于存放编辑后的视频。另一个 VG 将拆分为 <filename>lv_rushes</filename>，用于直接保存数字摄像机中输出的数据，<filename>lv_tmp</filename> 存放临时文件。工作区的位置是一个不太简单的选择：虽然该卷需要良好的性能，但如果磁盘在编辑会话期间发生故障，是否值得冒失去工作的风险？根据该问题的答案，相关 LV 将在一个 VG 或另一个 VG 上创建。

en: We now have both some redundancy for important data and much flexibility in how the available space is split across the applications.
zh-CN: 现在，我们既对重要数据有一些冗余，又在如何跨应用程序之间拆分可用空间方面具有极大的灵活性。

en: <emphasis>NOTE</emphasis> Why three RAID-1 volumes?
zh-CN: <emphasis>注释</emphasis> 为什么选择三个 RAID-1 卷？

en: We could have set up one RAID-1 volume only, to serve as a physical volume for <filename>vg_raid</filename>. Why create three of them, then?
zh-CN: 我们本可以只设置一个 RAID-1 卷，物理卷作为 <filename>vg_raid</filename>。那么， 为什么要创建其中三个呢？

en: The rationale for the first split (<filename>md0</filename> vs. the others) is about data safety: data written to both elements of a RAID-1 mirror are exactly the same, and it is therefore possible to bypass the RAID layer and mount one of the disks directly. In case of a kernel bug, for instance, or if the LVM metadata become corrupted, it is still possible to boot a minimal system to access critical data such as the layout of disks in the RAID and LVM volumes; the metadata can then be reconstructed and the files can be accessed again, so that the system can be brought back to its nominal state.
zh-CN: 第一次拆分（<filename>md0</filename> 与其他）的基本原理是关于数据安全：写入 RAID-1 镜像的两个元素的数据完全相同，因此可以绕过 RAID 层并直接装载其中一个磁盘。例如，如果内核错误，或者 LVM 元数据已损坏，仍然可以启动最小系统来访问关键数据，例如 RAID 和 LVM 卷中的磁盘布局；然后可以重建元数据，并再次访问文件，以便系统可以恢复其正常状态。

en: <primary>virtualization</primary>
zh-CN: <primary>虚拟化</primary>

en: Virtualization is one of the most major advances in the recent years of computing. The term covers various abstractions and techniques simulating virtual computers with a variable degree of independence on the actual hardware. One physical server can then host several systems working at the same time and in isolation. Applications are many, and often derive from this isolation: test environments with varying configurations for instance, or separation of hosted services across different virtual machines for security.
zh-CN: 虚拟化是近年来计算领域最重要的进步之一。该术语涵盖模拟虚拟计算机的各种抽象和技术，虚拟计算机在实际硬件上具有不同程度的独立性。然后，一台物理服务器可以托管多个系统，同时单独工作。应用程序很多，通常派生自此隔离：例如具有不同配置的测试环境，或跨不同虚拟机分离托管服务以保障安全。

en: There are multiple virtualization solutions, each with its own pros and cons. This book will focus on Xen, LXC, and KVM, but other noteworthy implementations include the following:
zh-CN: 有多种虚拟化解决方案，每种解决方案都有自己的优缺点。本书将重点介绍 Xen、LXC 和 KVM，但其他值得注意的实现包括：

en: Bochs is another free virtual machine, but it only emulates the x86 architectures (i386 and amd64).
zh-CN: Bochs 是另一个免费的虚拟机，但它只模拟 x86 架构（i386 和 amd64）。

en: <emphasis>HARDWARE</emphasis> Virtualization support
zh-CN: <emphasis>硬件</emphasis> 虚拟化支持

en: Some computers might not have hardware virtualization support; when they do, it should be enabled in the BIOS.
zh-CN: 某些计算机可能不支持硬件虚拟化；使用时，应该在 BIOS 中启用。

en: To know if you have virtualization support enabled, you can check if the relevant flag is enabled with <command>grep</command>. If the following command for your processor returns some text, you already have virtualization support enabled:
zh-CN: 若要了解是否启用了虚拟化支持，可以使用 <command>grep</command> 检查相关标志是否启用。如果处理器的以下命令返回对应的文本，则已启用虚拟化支持：

en: Xen <indexterm><primary>Xen</primary></indexterm> is a “paravirtualization” solution. It introduces a thin abstraction layer, called a “hypervisor”, between the hardware and the upper systems; this acts as a referee that controls access to hardware from the virtual machines. However, it only handles a few of the instructions, the rest is directly executed by the hardware on behalf of the systems. The main advantage is that performances are not degraded, and systems run close to native speed; the drawback is that the kernels of the operating systems one wishes to use on a Xen hypervisor need to be adapted to run on Xen.
zh-CN: Xen <indexterm><primary>Xen</primary></indexterm> 是一种"准虚拟化"解决方案。它引入了硬件和上层系统之间的一个薄抽象层，称为"虚拟机管理程序"；这充当控制从虚拟机访问硬件的裁判。但是，它只处理一些指令，其余指令由硬件代表系统直接执行。主要优点是性能不会下降，系统运行接近本机速度；缺点是，希望在 Xen 虚拟机管理程序上使用的操作系统内核需要调整才能在 Xen 上运行。

en: Let's spend some time on terms. The hypervisor is the lowest layer, which runs directly on the hardware, even below the kernel. This hypervisor can split the rest of the software across several <emphasis>domains</emphasis>, which can be seen as so many virtual machines. One of these domains (the first one that gets started) is known as <emphasis>dom0</emphasis>, and has a special role, since only this domain can control the hypervisor and the execution of other domains. These other domains are known as <emphasis>domU</emphasis>. In other words, and from a user point of view, the <emphasis>dom0</emphasis> matches the “host” of other virtualization systems, while a <emphasis>domU</emphasis> can be seen as a “guest”.
zh-CN: 让我们花些时间在条款上。虚拟机管理程序是最低层，直接在硬件上运行，甚至低于内核。此虚拟机管理程序可以跨多个<emphasis>domains</emphasis>（域），这可视为许多虚拟机。其中一个域（第一个入门域）称为 <emphasis>dom0</emphasis>，具有特殊作用，因为只有此域可以控制虚拟机管理程序和其他域的执行。其他域称为<emphasis>domU</emphasis>。换句话说，从用户的角度来看，<emphasis>dom0</emphasis>与其他虚拟化系统的"主机"匹配，而<emphasis>domU</emphasis>可以被视为"来宾"。

en: <emphasis>CULTURE</emphasis> Xen and the various versions of Linux
zh-CN: <emphasis>文化</emphasis> Xen 和各种版本的 Linux

en: Xen was initially developed as a set of patches that lived out of the official tree, and not integrated to the Linux kernel. At the same time, several upcoming virtualization systems (including KVM) required some generic virtualization-related functions to facilitate their integration, and the Linux kernel gained this set of functions (known as the <emphasis>paravirt_ops</emphasis> or <emphasis>pv_ops</emphasis> interface). Since the Xen patches were duplicating some of the functionality of this interface, they couldn't be accepted officially.
zh-CN: Xen 最初是作为一组从 Linux 内核官方树中派生的修补程序开发的，并且没有集成到内核中。同时，几个即将推出的虚拟化系统（包括 KVM）需要一些通用虚拟化相关功能来促进它们的集成，Linux 内核获得了这组函数（称为 <emphasis>paravirt_ops</emphasis> 或 <emphasis>pv_ops</emphasis> 接口）。由于 Xen 修补程序复制了此接口的一些功能，因此无法正式接受它们。

en: Xensource, the company behind Xen, therefore had to port Xen to this new framework, so that the Xen patches could be merged into the official Linux kernel. That meant a lot of code rewrite, and although Xensource soon had a working version based on the paravirt_ops interface, the patches were only progressively merged into the official kernel. The merge was completed in Linux 3.0. <ulink type="block" url="https://wiki.xenproject.org/wiki/XenParavirtOps" />
zh-CN: 因此，Xen背后的公司 Xensource 不得不将 Xen 移植到这个新框架，以便Xen补丁可以合并到官方的Linux内核中。这意味着大量的代码重写，虽然 Xensource 很快就有一个基于paravirt_ops 接口的版本，补丁只是逐渐合并到官方内核。合并在 Linux 3.0 中完成。<ulink type="block" url="https://wiki.xenproject.org/wiki/XenParavirtOps" />

en: Since <emphasis role="distribution">Jessie</emphasis> is based on version 3.16 of the Linux kernel, the standard <emphasis role="pkg">linux-image-686-pae</emphasis> and <emphasis role="pkg">linux-image-amd64</emphasis> packages include the necessary code, and the distribution-specific patching that was required for <emphasis role="distribution">Squeeze</emphasis> and earlier versions of Debian is no more. <ulink type="block" url="https://wiki.xenproject.org/wiki/Xen_Kernel_Feature_Matrix" />
zh-CN: 由于 <emphasis role="distribution">Jessie</emphasis> 基于Linux内核的 3.16 版本，因此标准的 <emphasis role="pkg">linux-image-686-pae</emphasis> 和 <emphasis role="pkg">linux-image-amd4</emphasis> 包含了必要的代码，不再需要像 <emphasis role="distribution">Squeeze</emphasis> 和之前版本的 Debian 一样使用特定的补丁。<ulink type="block" url="https://wiki.xenproject.org/wiki/Xen_Kernel_Feature_Matrix" />

en: <emphasis>CULTURE</emphasis> Xen and non-Linux kernels
zh-CN: <emphasis>文化</emphasis> Xen 和非 Linux 内核

en: Xen requires modifications to all the operating systems one wants to run on it; not all kernels have the same level of maturity in this regard. Many are fully-functional, both as dom0 and domU: Linux 3.0 and later, NetBSD 4.0 and later, and OpenSolaris. Others only work as a domU. You can check the status of each operating system in the Xen wiki: <ulink type="block" url="https://wiki.xenproject.org/wiki/Dom0_Kernels_for_Xen" /> <ulink type="block" url="https://wiki.xenproject.org/wiki/DomU_Support_for_Xen" />
zh-CN: Xen 需要修改运行的所有操作系统；并非所有内核在这方面的成熟度都相同。许多完整功能，包括dom0和domU：Linux 3.0 及之后版本，NetBSD 4.0及之后版本，OpenSolaris。其他只能作为 domU 工作。您可以在 Xen wiki 中查询每个操作系统的状态 ：<ulink type="block" url="https://wiki.xenproject.org/wiki/Dom0_Kernels_for_Xen" /> <ulink type="block" url="https://wiki.xenproject.org/wiki/DomU_Support_for_Xen" />

en: However, if Xen can rely on the hardware functions dedicated to virtualization (which are only present in more recent processors), even non-modified operating systems can run as domU (including Windows).
zh-CN: 但是，如果 Xen 可以依赖专用于虚拟化的硬件功能（这些功能仅存在于较新的处理器中），则即使是未修改的操作系统也可以作为 domU（包括 Windows）运行。

en: <emphasis>NOTE</emphasis> Architectures compatible with Xen
zh-CN: <emphasis>注释</emphasis> Xen 架构兼容性

en: Xen is currently only available for the i386, amd64, arm64 and armhf architectures.
zh-CN: Xen 目前仅适用于 i386、amd64、arm64 和 armhf 架构。

en: Using Xen under Debian requires three components:
zh-CN: 在 Debian 下使用 Xen 需要3个组件：

en: The i386 architecture also requires a standard library with the appropriate patches taking advantage of Xen; this is in the <emphasis role="pkg">libc6-xen</emphasis> package.
zh-CN: i386 架构还需要一个标准库，包含 Xen 使用的对应补丁；在 <emphasis role="pkg">libc6-xen</emphasis> 软件包中。

en: Once these prerequisites are installed, the next step is to test the behavior of the dom0 by itself; this involves a reboot to the hypervisor and the Xen kernel. The system should boot in its standard fashion, with a few extra messages on the console during the early initialization steps.
zh-CN: 安装这些先决条件后，下一步是测试 dom0 本身的行为；这涉及到重新启动虚拟机管理程序和 Xen 内核。系统应以标准方式启动，在初始化步骤前期，控制台上会显示一些额外的消息。

en: Now is the time to actually install useful systems on the domU systems, using the tools from <emphasis role="pkg">xen-tools</emphasis>. This package provides the <command>xen-create-image</command> command, which largely automates the task. The only mandatory parameter is <literal>--hostname</literal>, giving a name to the domU; other options are important, but they can be stored in the <filename>/etc/xen-tools/xen-tools.conf</filename> configuration file, and their absence from the command line doesn't trigger an error. It is therefore important to either check the contents of this file before creating images, or to use extra parameters in the <command>xen-create-image</command> invocation. Important parameters of note include the following:
zh-CN: 现在可以使用 <emphasis role="pkg">xen-tools</emphasis> 中的工具在 domU 系统上实际安装系统。此包提供 <command>xen-create-image</command> 命令，这在很大程度上是自动执行任务的。唯一的必需参数 <literal>--hostname</literal>，指定 domU 的名称；其他选项也很重要，但它们可以存储在 <filename>/etc/xen-tools/xen-tools.conf</filename> 配置文件中，并且它们不在命令行中不会触发错误。因此，在创建映像之前检查此文件的内容，或在 <command> xen-create-image</command> 中使用额外的参数。需要注意的重要参数包括：

en: <literal>--memory</literal>, to specify the amount of RAM dedicated to the newly created system;
zh-CN: <literal>--memory</literal>，指定新创建系统的RAM大小;

en: <literal>--size</literal> and <literal>--swap</literal>, to define the size of the “virtual disks” available to the domU;
zh-CN: <literal>--size</literal> 和 <literal>--swap</literal>，指定 domU 使用的“虚拟磁盘”的大小;

en: <emphasis>GOING FURTHER</emphasis> Installing a non-Debian system in a domU
zh-CN: <emphasis>进阶</emphasis>在 domU 中安装非 Debian 系统

en: In case of a non-Linux system, care should be taken to define the kernel the domU must use, using the <literal>--kernel</literal> option.
zh-CN: 对于非 Linux 系统，应注意使用 <literal>--kernel</literal> 选项指定 domU 使用的内核。

en: <literal>--dhcp</literal> states that the domU's network configuration should be obtained by DHCP while <literal>--ip</literal> allows defining a static IP address.
zh-CN: <literal>--dhcp</literal> 指示 domU 的网络配置应该由 DHCP 获取，而 <literal>--ip</literal> 允许定义静态 IP 地址。

en: Lastly, a storage method must be chosen for the images to be created (those that will be seen as hard disk drives from the domU). The simplest method, corresponding to the <literal>--dir</literal> option, is to create one file on the dom0 for each device the domU should be provided. For systems using LVM, the alternative is to use the <literal>--lvm</literal> option, followed by the name of a volume group; <command>xen-create-image</command> will then create a new logical volume inside that group, and this logical volume will be made available to the domU as a hard disk drive.
zh-CN: 最后，必须选择存储方式才能创建映像（视为来自 domU 的硬盘驱动器） 。最简单的方式，对应 <literal>-dir</literal> 选项是为 domU 使用的每个设备在 dom0 上创建一个文件。对于使用 LVM 的系统，另一种选择是使用 <literal>--lvm</literal>选项，后跟卷组的名称；<command> xen-create-image</command> 在该组内创建新的逻辑卷，并将此逻辑卷作为硬盘提供给 domU。

en: <emphasis>NOTE</emphasis> Storage in the domU
zh-CN: <emphasis>注释</emphasis> domU 中的存储

en: Entire hard disks can also be exported to the domU, as well as partitions, RAID arrays or pre-existing LVM logical volumes. These operations are not automated by <command>xen-create-image</command>, however, so editing the Xen image's configuration file is in order after its initial creation with <command>xen-create-image</command>.
zh-CN: 整个硬盘也可以导出到 domU，以及分区、RAID 阵列或预先存在的 LVM 逻辑卷。但是，这些操作不是由 <command> xen-create-image</command> 自动执行的，因此在使用 <command> xen-create-image</command> 初始创建 Xen 映像后，需要编辑 Xen 映像的配置文件。

en: Once these choices are made, we can create the image for our future Xen domU:
zh-CN: 一旦做出这些选择，我们就可以为 Xen domU 创建映像：

en: We now have a virtual machine, but it is currently not running (and therefore only using space on the dom0's hard disk). Of course, we can create more images, possibly with different parameters.
zh-CN: 我们现在有一个虚拟机，但目前还未运行（因此只使用 dom0 硬盘上的空间）。当然，我们可以创建更多的映像，可以使用不同的参数。

en: Before turning these virtual machines on, we need to define how they'll be accessed. They can of course be considered as isolated machines, only accessed through their system console, but this rarely matches the usage pattern. Most of the time, a domU will be considered as a remote server, and accessed only through a network. However, it would be quite inconvenient to add a network card for each domU; which is why Xen allows creating virtual interfaces that each domain can see and use in a standard way. Note that these cards, even though they're virtual, will only be useful once connected to a network, even a virtual one. Xen has several network models for that:
zh-CN: 在打开这些虚拟机之前，我们需要定义如何访问它们。当然，它们可以视为隔离的计算机，只能通过其系统控制台访问，但这很少使用这种模式。在大多数情况下，domU 视为远程服务器，并且只能通过网络访问。但是，为每个 domU 添加一个网卡会非常不方便；这就是为什么 Xen 允许创建每个域都可以以标准方式查看和使用虚拟网络接口的原因。请注意，这些网卡即使是虚拟的，也只有在连接到网络（即使是虚拟网络）时才有用。Xen 具有多个网络模式：

en: The simplest model is the <emphasis>bridge</emphasis> model; all the eth0 network cards (both in the dom0 and the domU systems) behave as if they were directly plugged into an Ethernet switch.
zh-CN: 最简单的模式是 <emphasis>bridge</emphasis> 模式；所有 eth0 网卡 （在 dom0 和 domu 系统中） 的行为就像它们直接插入以太网交换机一样。

en: Then comes the <emphasis>routing</emphasis> model, where the dom0 behaves as a router that stands between the domU systems and the (physical) external network.
zh-CN: 然后是 <emphasis>routing</emphasis> 模式，其中 dom0 充当位于 domU 系统和（物理）外部网络之间的路由器。

en: Finally, in the <emphasis>NAT</emphasis> model, the dom0 is again between the domU systems and the rest of the network, but the domU systems are not directly accessible from outside, and traffic goes through some network address translation on the dom0.
zh-CN: 最后，在 <emphasis>NAT</emphasis> 模式中，dom0 也是位于 domU 系统和网络其余部分之间，但 domU 系统不能从外部直接访问，并且流量通过 dom0 上的一些网络地址转换。

en: These three networking nodes involve a number of interfaces with unusual names, such as <filename>vif*</filename>, <filename>veth*</filename>, <filename>peth*</filename> and <filename>xenbr0</filename>. The Xen hypervisor arranges them in whichever layout has been defined, under the control of the user-space tools. Since the NAT and routing models are only adapted to particular cases, we will only address the bridging model.
zh-CN: 这3种网络节点涉及许多具有特定名称的接口，例如 <filename>vif*</filename>、<filename>veth*</filename>、<filename>peth*</filename> 和 <filename>xenbr0</filename>。Xen 虚拟机管理程序在用户空间工具的控制之下，以已定义的布局排列它们。由于 NAT 和路由模式仅适合特定情况，因此我们仅说明桥接模式。

en: After rebooting to make sure the bridge is automatically created, we can now start the domU with the Xen control tools, in particular the <command>xl</command> command. This command allows different manipulations on the domains, including listing them and, starting/stopping them. You might need to increase the default memory by editing the variable memory from configuration file (in this case, <filename>/etc/xen/testxen.cfg</filename>). Here we have set it to 1024 (megabytes).
zh-CN: 重新启动以确保自动创建网桥后，我们现在可以使用 Xen 控制工具启动 domU，特别是 <command>xl</command>命令。此命令允许对域进行不同的操作，包括列出它们以及启动/停止它们。您可能需要通过从配置文件（在这种情况下是 <filename>/etc/xen/testxen.cfg</filename>）编辑内存变量来增加默认内存。在这里，我们已设置为 1024（兆字节）。

en: <emphasis>TOOL</emphasis> Choice of toolstacks to manage Xen VM
zh-CN: <emphasis>工具</emphasis>用于管理 Xen VM 工具栈的选择

en: <emphasis>CAUTION</emphasis> Only one domU per image!
zh-CN: <emphasis>注意</emphasis> 每个映像只有一个 domU！

en: While it is of course possible to have several domU systems running in parallel, they will all need to use their own image, since each domU is made to believe it runs on its own hardware (apart from the small slice of the kernel that talks to the hypervisor). In particular, it isn't possible for two domU systems running simultaneously to share storage space. If the domU systems are not run at the same time, it is, however, quite possible to reuse a single swap partition, or the partition hosting the <filename>/home</filename> filesystem.
zh-CN: 当然，几个 domU 系统可以并行运行，但它们都需要使用自己的映像，因为每个 domU 都相信自己在真实的硬件上运行（除了内核与虚拟机管理程序交互的一小部分）。特别是，两个同时运行的 domU 系统不可以共享存储空间。但是，如果 domU 系统不是同时运行，则完全可以重用单个交换分区，或者存放 <filename>/home </filename> 文件系统的分区。

en: Note that the <filename>testxen</filename> domU uses real memory taken from the RAM that would otherwise be available to the dom0, not simulated memory. Care should therefore be taken, when building a server meant to host Xen instances, to provision the physical RAM accordingly.
zh-CN: 请注意，<filename>testxen</filename> domU 使用 RAM 中的实际内存，否则该内存将提供给 dom0，而不是模拟内存。因此，在构建用于承载 Xen 实例的服务器时，应注意相应地预配物理 RAM。

en: Voilà! Our virtual machine is starting up. We can access it in one of two modes. The usual way is to connect to it “remotely” through the network, as we would connect to a real machine; this will usually require setting up either a DHCP server or some DNS configuration. The other way, which may be the only way if the network configuration was incorrect, is to use the <filename>hvc0</filename> console, with the <command>xl console</command> command:
zh-CN: Voilà！我们的虚拟机正在启动。我们可以使用两种方式访问它。通常的方式是通过网络"远程"连接到，就像连接到一台真正的机器一样；这通常需要设置 DHCP 服务器或某些 DNS 配置。另一种方式，这可能是网络配置不正确的唯一方法，是使用 <command>xl console</command> 命令使用 <filename>hvc0</filename> 控制台：

en: One can then open a session, just like one would do if sitting at the virtual machine's keyboard. Detaching from this console is achieved through the <keycombo action="simul"><keycap>Control</keycap> <keycap>]</keycap></keycombo> key combination.
zh-CN: 然后，可以打开一个会话，就像坐在虚拟机的键盘上一样。通过组合按键 <keycombo action="simul"><keycap>Control</keycap><keycap>]</keycap></keycombo> 分离控制台。

en: <emphasis>TIP</emphasis> Getting the console straight away
zh-CN: <emphasis>提示</emphasis> 立即获取控制台

en: Sometimes one wishes to start a domU system and get to its console straight away; this is why the <command>xl create</command> command takes a <literal>-c</literal> switch. Starting a domU with this switch will display all the messages as the system boots.
zh-CN: 有时，人们希望启动一个 domU 系统，并立连接其控制台；这就是为什么 <command>xl create</command> 命令采用 <literal> - c </literal> 开关的原因。使用此开关启动 domU 时，将在系统启动时显示所有消息。

en: Once the domU is up, it can be used just like any other server (since it is a GNU/Linux system after all). However, its virtual machine status allows some extra features. For instance, a domU can be temporarily paused then resumed, with the <command>xl pause</command> and <command>xl unpause</command> commands. Note that even though a paused domU does not use any processor power, its allocated memory is still in use. It may be interesting to consider the <command>xl save</command> and <command>xl restore</command> commands: saving a domU frees the resources that were previously used by this domU, including RAM. When restored (or unpaused, for that matter), a domU doesn't even notice anything beyond the passage of time. If a domU was running when the dom0 is shut down, the packaged scripts automatically save the domU, and restore it on the next boot. This will of course involve the standard inconvenience incurred when hibernating a laptop computer, for instance; in particular, if the domU is suspended for too long, network connections may expire. Note also that Xen is so far incompatible with a large part of ACPI power management, which precludes suspending the host (dom0) system.
zh-CN: 一旦 domU 启动，它可以像使用任何其他服务器一样使用（因为它是一个 GNU/Linux 系统）。但是，其虚拟机状态允许一些额外的功能。例如，domU 可以使用 <command>xl pause</command> 命令暂停，然后使用 <command>xl unpause</command> 命令恢复。请注意，即使暂停的 domU 不使用任何处理器资源，其分配的内存仍在使用中。此外，<command>xl save</command> 和 <command>xl restore</command> 命令可能很有趣：保存 domU 使用的资源，包括 RAM。当恢复（或未停止），domU 甚至没有注意到任何时间的流逝。如果在 dom0 关闭时正在运行 domU，则打包的脚本会自动保存 domU，并在下次启动时还原它。这当然会涉及在休眠笔记本电脑时产生的不变便；如果 domU 挂起的时间过长，网络连接可能会过期。另外，Xen 到目前为止与 ACPI 电源管理的主要部分不兼容，这排除了挂起主机 （dom0） 系统的可能性。

en: Halting or rebooting a domU can be done either from within the domU (with the <command>shutdown</command> command) or from the dom0, with <command>xl shutdown</command> or <command>xl reboot</command>.
zh-CN: 停止或重新启动 domU 可以从 domU 内部（使用 <command>shutdown</command> 命令）或从 dom0 执行，也可以使用 <command>xl shutdown</command> 或 <command>xl reboot</command> 命令。

en: Most of the <command>xl</command> subcommands expect one or more arguments, often a domU name. These arguments are well described in the <citerefentry><refentrytitle>xl</refentrytitle> <manvolnum>1</manvolnum></citerefentry> manual page.
zh-CN: 大多数<command>xl</command> 的子命令都需要一个或多个参数，通常是 domU 名称。这些参数在 <citerefentry><refentrytitle>xl</refentrytitle> <manvolnum>1</manvolnum></citerefentry> 手册页中有详细描述。

en: <emphasis>GOING FURTHER</emphasis> Advanced Xen
zh-CN: <emphasis>进阶</emphasis> 高级 Xen

en: Xen has many more features than we can describe in these few paragraphs. In particular, the system is very dynamic, and many parameters for one domain (such as the amount of allocated memory, the visible hard drives, the behavior of the task scheduler, and so on) can be adjusted even when that domain is running. A domU can even be migrated across servers without being shut down, and without losing its network connections! For all these advanced aspects, the primary source of information is the official Xen documentation. <ulink type="block" url="https://xenproject.org/help/documentation/" />
zh-CN: Xen 的功能比我们在这里描述的要多。特别是，系统非常动态，即使该域正在运行，也可以调整该域的许多参数（如分配的内存量、可见的硬盘驱动器、任务调度程序的行为等）。domU 甚至可以跨服务器迁移，而无需关闭，并且不会丢失其网络连接！对于所有这些高级功能，主要信息来源是官方 Xen 文档。<ulink type="block" url="https://xenproject.org/help/documentation/" />

en: Even though it is used to build “virtual machines”, LXC is not, strictly speaking, a virtualization system, but a system to isolate groups of processes from each other even though they all run on the same host. It takes advantage of a set of recent evolutions in the Linux kernel, collectively known as <emphasis>control groups</emphasis>, by which different sets of processes called “groups” have different views of certain aspects of the overall system. Most notable among these aspects are the process identifiers, the network configuration, and the mount points. Such a group of isolated processes will not have any access to the other processes in the system, and its accesses to the filesystem can be restricted to a specific subset. It can also have its own network interface and routing table, and it may be configured to only see a subset of the available devices present on the system.
zh-CN: 即使它用于构建"虚拟机"，但严格来说，LXC 不是虚拟化系统，而是一个将进程组彼此隔离的系统，即使它们都在同一主机上运行。它利用了Linux内核中一组最近的演变，统称为 <emphasis>control groups</emphasis>（控制组），根据这些过程，称为"组"的不同进程集对整个系统的某些方面有不同的看法。在这些方面中，最值得注意的是进程标识符、网络配置和挂载点。这样一组隔离进程不能对系统中的其他进程进行任何访问，并且它对文件系统的访问可以限制为特定的子集。它还可以有自己的网络接口和路由表，并且可以配置为仅看到系统上存在的可用设备的子集。

en: These features can be combined to isolate a whole process family starting from the <command>init</command> process, and the resulting set looks very much like a virtual machine. The official name for such a setup is a “container” (hence the LXC moniker: <emphasis>LinuX Containers</emphasis>), but a rather important difference with “real” virtual machines such as provided by Xen or KVM is that there is no second kernel; the container uses the very same kernel as the host system. This has both pros and cons: advantages include excellent performance due to the total lack of overhead, and the fact that the kernel has a global vision of all the processes running on the system, so the scheduling can be more efficient than it would be if two independent kernels were to schedule different task sets. Chief among the inconveniences is the impossibility to run a different kernel in a container (whether a different Linux version or a different operating system altogether).
zh-CN: 这些功能可以组合起来，以隔离从<command>init</command> 进程开始的整个过程系列，结果集看起来非常像虚拟机。此类设置的官方名称是"容器"（因此 LXC 名称：<emphasis>LinuX Containers</emphasis>），但与 Xen 或 KVM 提供的"真实"虚拟机（如 Xen 或 KVM 提供的虚拟机）的一个相当重要的区别是，没有第二个内核；容器使用与主机系统完全相同的内核。这既有优点也有缺点：优点包括由于减少开销而具有出色的性能，以及内核对系统上运行的所有进程都有全局视野，因此，如果两个独立的内核要安排不同的任务集，调度效率会更高。其中最给您带来的不便是不能在容器中运行不同的内核（无论是不同的Linux版本还是完全不同的操作系统）。

en: <emphasis>NOTE</emphasis> LXC isolation limits
zh-CN: <emphasis>注释</emphasis>LXC 隔离的限制

en: LXC containers do not provide the level of isolation achieved by heavier emulators or virtualizers. In particular:
zh-CN: LXC 容器不提供较重的仿真器或虚拟化器实现的隔离级别。特别是：

en: since the kernel is shared among the host system and the containers, processes constrained to containers can still access the kernel messages, which can lead to information leaks if messages are emitted by a container;
zh-CN: 由于内核在主机系统和容器之间共享，因此约束容器的进程仍然可以访问内核消息，如果容器发出消息，这可能会导致信息泄漏;

en: for similar reasons, if a container is compromised and a kernel vulnerability is exploited, the other containers may be affected too;
zh-CN: 出于类似原因，如果容器遭到破坏，并且内核漏洞被利用，其他容器也可能受到影响;

en: on the filesystem, the kernel checks permissions according to the numerical identifiers for users and groups; these identifiers may designate different users and groups depending on the container, which should be kept in mind if writable parts of the filesystem are shared among containers.
zh-CN: 在文件系统上，内核根据用户和组的数字标识符检查权限；这些标识符可以根据容器指定不同的用户和组，如果文件系统的可写部分在容器之间共享，应牢记这些用户和组。

en: Since we are dealing with isolation and not plain virtualization, setting up LXC containers is more complex than just running debian-installer on a virtual machine. We will describe a few prerequisites, then go on to the network configuration; we will then be able to actually create the system to be run in the container.
zh-CN: 由于我们处理的是隔离而不是普通虚拟化，因此设置 LXC 容器比在虚拟机上运行 debian 安装程序更为复杂。我们将介绍几个先决条件，然后继续进行网络配置；然后，我们将能够实际创建要在容器中运行的系统。

en: Preliminary Steps
zh-CN: 准备步骤

en: The <emphasis role="pkg">lxc</emphasis> package contains the tools required to run LXC, and must therefore be installed.
zh-CN: <emphasis role="pkg">lxc</emphasis> 软件包包含运行LXC所需的工具，因此必须安装。

en: LXC also requires the <emphasis>control groups</emphasis> configuration system, which is a virtual filesystem to be mounted on <filename>/sys/fs/cgroup</filename>. Since Debian 8 switched to systemd, which also relies on control groups, this is now done automatically at boot time without further configuration.
zh-CN: LXC 还要求 <emphasis>control groups</emphasis> 配置系统，这是一个虚拟文件系统，挂载在 <filename>/sys/fs/cgroup</filename>。由于 Debian 8 切换系统，也依赖于控制组，因此现在在启动时自动完成，无需进一步配置。

en: Network Configuration
zh-CN: 网络配置

en: The goal of installing LXC is to set up virtual machines; while we could, of course, keep them isolated from the network, and only communicate with them via the filesystem, most use cases involve giving at least minimal network access to the containers. In the typical case, each container will get a virtual network interface, connected to the real network through a bridge. This virtual interface can be plugged either directly onto the host's physical network interface (in which case the container is directly on the network), or onto another virtual interface defined on the host (and the host can then filter or route traffic). In both cases, the <emphasis role="pkg">bridge-utils</emphasis> package will be required.
zh-CN: 安装 LXC 的目的是设置虚拟机；虽然我们可以将它们与网络隔离，并且只能通过文件系统与它们通信，但大多数用例都涉及至少给予容器最小网络访问权限。在典型情况下，每个容器将得到一个虚拟网络接口，通过网桥连接到真正的网络。此虚拟接口可以直接插入主机的物理网络接口（在这种情况下，容器直接在网络上），也可以插入主机上定义的另一个虚拟接口（然后主机可以过滤或路由流量）。在这两种情况下，<emphasis role="pkg">bridge-utils</emphasis> 软件包也是必需的。

en: They should be disabled and replaced with the following:
zh-CN: 应禁用它们，并替换为以下内容：

en: The effect of this configuration will be similar to what would be obtained if the containers were machines plugged into the same physical network as the host. The “bridge” configuration manages the transit of Ethernet frames between all the bridged interfaces, which includes the physical <literal>eth0</literal> as well as the interfaces defined for the containers.
zh-CN: 此配置的效果将类似于如果容器是插入与主机相同的物理网络的计算机获得的效果。"桥接"配置管理所有桥接接口之间的以太网帧传输，包括物理 <literal>eth0</literal> 以及为容器定义的接口。

en: In cases where this configuration cannot be used (for instance, if no public IP addresses can be assigned to the containers), a virtual <emphasis>tap</emphasis> interface will be created and connected to the bridge. The equivalent network topology then becomes that of a host with a second network card plugged into a separate switch, with the containers also plugged into that switch. The host must then act as a gateway for the containers if they are meant to communicate with the outside world.
zh-CN: 如果无法使用此配置（例如，如果无法将公共 IP 地址分配给容器），将创建一个虚拟 <emphasis>tap</emphasis> 接口并连接到网桥。然后，等效的网络拓扑变为主机的拓扑，该主机将第二个网卡插入单独的交换机，容器也插入该交换机。然后，如果容器要与外部世界通信，则主机必须充当容器的网关。

en: In addition to <emphasis role="pkg">bridge-utils</emphasis>, this “rich” configuration requires the <emphasis role="pkg">vde2</emphasis> package; the <filename>/etc/network/interfaces</filename> file then becomes:
zh-CN: 除了 <emphasis role="pkg">bridge-utils</emphasis> 之外，这种"丰富"配置还需要 <emphasis role="pkg">vde2</emphasis> 软件包；然后<filename>/etc/network/interfaces</filename>文件变为：

en: The network can then be set up either statically in the containers, or dynamically with DHCP server running on the host. Such a DHCP server will need to be configured to answer queries on the <literal>br0</literal> interface.
zh-CN: 然后，可以在容器中静态地设置网络，也可以在主机上运行 DHCP 服务器时动态地设置网络。此类 DHCP 服务器需要配置为应答 <literal>br0</literal> 查询。

en: Setting Up the System
zh-CN: 搭建系统

en: Note that the filesystem is initially created in <filename>/var/cache/lxc</filename>, then moved to its destination directory. This allows creating identical containers much more quickly, since only copying is then required.
zh-CN: 请注意，文件系统最初是在 <filename>/var/cache/lxc </filename>，然后移动到目标目录。这允许更快地创建相同的容器，因为只需要复制。

en: Note that the Debian template creation script accepts an <option>--arch</option> option to specify the architecture of the system to be installed and a <option>--release</option> option if you want to install something else than the current stable release of Debian. You can also set the <literal>MIRROR</literal> environment variable to point to a local Debian mirror.
zh-CN: 请注意，Debian 模板创建脚本接受 <option>-arch</option> 选项，用于指定要安装的系统的体系结构和 <option>--release</option> 选项（如果您想要安装 Debian 的当前稳定版本以外的其他内容）。您还可以将 <literal>MIRROR</literal> 设置为指向本地 Debian 镜像。

en: Another useful entry in that file is the setting of the hostname:
zh-CN: 该文件中的另一个有用条目是主机名的设置：

en: Starting the Container
zh-CN: 启动容器

en: We are now in the container; our access to the processes is restricted to only those started from the container itself, and our access to the filesystem is similarly restricted to the dedicated subset of the full filesystem (<filename>/var/lib/lxc/testlxc/rootfs</filename>). We can exit the console with <keycombo action="simul"><keycap>Control</keycap> <keycap>a</keycap></keycombo> <keycombo><keycap>q</keycap></keycombo>.
zh-CN: 我们现在在容器里；我们对进程的访问仅限于从容器本身启动的进程，我们对文件系统的访问同样限于完整文件系统的专用子集 （<filename>/var/lib/lxc/testlxc/rootf</filename>）。我们可以用 <keycombo action="simul"><keycap>Control</keycap><keycap>a</keycap></keycombo><keycombo><keycap>q</keycap></keycombo> 退出控制台。

en: The <emphasis role="pkg">lxc</emphasis> package contains an initialization script that can automatically start one or several containers when the host boots (it relies on <command>lxc-autostart</command> which starts containers whose <literal>lxc.start.auto</literal> option is set to 1). Finer-grained control of the startup order is possible with <literal>lxc.start.order</literal> and <literal>lxc.group</literal>: by default, the initialization script first starts containers which are part of the <literal>onboot</literal> group and then the containers which are not part of any group. In both cases, the order within a group is defined by the <literal>lxc.start.order</literal> option.
zh-CN: <emphasis role="pkg">lxc</emphasis> 软件包包含一个初始化脚本，当主机启动时，该脚本可以自动启动一个或多个容器（它依赖于 <command>lxc-autostart</command>，启动 <literal>lxc.start.auto</literal> 选项设置为 1的容器）。使用 <literal>lxc.start.order</literal> 和 <literal>lxc.group</literal> 可以对启动顺序进行更细粒度的控制：默认情况下，初始化脚本首先启动 <literal>onboot</literal> 组的容器，然后启动不是任何组的容器。在这两种情况下，组中的顺序由 <literal>lxc.start.order</literal> 选项定义。

en: <emphasis>GOING FURTHER</emphasis> Mass virtualization
zh-CN: <emphasis>进阶</emphasis> 大规模虚拟化

en: Since LXC is a very lightweight isolation system, it can be particularly adapted to massive hosting of virtual servers. The network configuration will probably be a bit more advanced than what we described above, but the “rich” configuration using <literal>tap</literal> and <literal>veth</literal> interfaces should be enough in many cases.
zh-CN: 由于 LXC 是一个非常轻量级的隔离系统，因此它特别适合虚拟服务器的大规模托管。网络配置可能比我们上面描述的要高级一些，但在许多情况下，使用 <literal>tap</literal> 和 <literal>veth</literal> 接口的"丰富"配置应该足够了。

en: It may also make sense to share part of the filesystem, such as the <filename>/usr</filename> and <filename>/lib</filename> subtrees, so as to avoid duplicating the software that may need to be common to several containers. This will usually be achieved with <literal>lxc.mount.entry</literal> entries in the containers configuration file. An interesting side-effect is that the processes will then use less physical memory, since the kernel is able to detect that the programs are shared. The marginal cost of one extra container can then be reduced to the disk space dedicated to its specific data, and a few extra processes that the kernel must schedule and manage.
zh-CN: 共享文件系统的一部分（如 <filename>/usr</filename> 和 <filename>/lib</filename> 子树可能也是有意义的，以避免复制可能需要多个容器通用的软件。这通常通过容器配置文件 <literal>lxc.mount.entry</literal> 条目实现。一个有趣的副作用是，进程将使用更少的物理内存，因为内核能够检测到程序是共享的。然后，一个额外的容器的边际成本可以降低到专用于其特定数据的磁盘空间，以及内核必须计划和管理的一些额外进程。

en: We haven't described all the available options, of course; more comprehensive information can be obtained from the <citerefentry> <refentrytitle>lxc</refentrytitle> <manvolnum>7</manvolnum> </citerefentry> and <citerefentry> <refentrytitle>lxc.container.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manual pages and the ones they reference.
zh-CN: 当然，我们还没有描述所有可用的选项；从 <citerefentry><refentrytitle>lxc</refentrytitle> <manvolnum>7</manvolnum> </citerefentry> 和 <citerefentry><refentrytitle>lxc.container.conf.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 手册页及其引用的手册页获取更全面的信息。

en: Virtualization with KVM
zh-CN: KVM 虚拟化

en: KVM, which stands for <emphasis>Kernel-based Virtual Machine</emphasis>, is first and foremost a kernel module providing most of the infrastructure that can be used by a virtualizer, but it is not a virtualizer by itself. Actual control for the virtualization is handled by a QEMU-based application. Don't worry if this section mentions <command>qemu-*</command> commands: it is still about KVM.
zh-CN: KVM 代表 <emphasis>Kernel-based Virtual Machine</emphasis>（基于内核的虚拟机），它首先是一个内核模块，提供虚拟化器可以使用的基础结构，但它本身并不是虚拟机。虚拟化的实际控制由基于 QEMU 的应用程序处理。如果本节提到 <command>qemu-*</command> 命令，不要担心：它仍然是关于 KVM 的。

en: Unlike other virtualization systems, KVM was merged into the Linux kernel right from the start. Its developers chose to take advantage of the processor instruction sets dedicated to virtualization (Intel-VT and AMD-V), which keeps KVM lightweight, elegant and not resource-hungry. The counterpart, of course, is that KVM doesn't work on any computer but only on those with appropriate processors. For x86-based computers, you can verify that you have such a processor by looking for “vmx” or “svm” in the CPU flags listed in <filename>/proc/cpuinfo</filename>.
zh-CN: 与其他虚拟化系统不同，KVM 从一开始就被并入 Linux 内核。其开发人员选择利用专用于虚拟化的处理器指令集（Intel-VT 和 AMD-V），使 KVM 保持轻巧、优雅且不资源消耗。当然，对应的是 KVM 只能在那些具有合适的处理器的计算机上工作。对于基于 x86 的计算机，您可以通过在 <filename>/proc/cpuinfo </filename> 中列出的 CPU 标志中查找"vmx"或"svm"来验证是否具有此类处理器。

en: With Red Hat actively supporting its development, KVM has more or less become the reference for Linux virtualization.
zh-CN: 随着 Red Hat 积极支持开发，KVM 或多或少成为 Linux 虚拟化的参考。

en: We first install the required packages, with <command>apt-get install libvirt-clients libvirt-daemon-system qemu-kvm virtinst virt-manager virt-viewer</command>. <emphasis role="pkg">libvirt-daemon-system</emphasis> provides the <command>libvirtd</command> daemon, which allows (potentially remote) management of the virtual machines running of the host, and starts the required VMs when the host boots. <emphasis role="pkg">libvirt-clients</emphasis> provides the <command>virsh</command> command-line tool, which allows controlling the <command>libvirtd</command>-managed machines.
zh-CN: 首先安装所需的软件包，使用 <command>apt-get install libvirt-clients libvirt-daemon-system qemu-kvm virtinst virt-manager virt-viewer</command> 命令。<emphasis role="pkg">libvirt-daemon-system</emphasis> 提供 <command>libvirtd</command> 守护程序，允许（可以远程）管理主机运行的虚拟机，并在主机启动时启动所需的 VM。<emphasis role="pkg">libvirt-clients</emphasis> 提供了 <command>virsh</command> 命令行工具，允许控制 <command>libvirtd</command> 管理的计算机。

en: The <emphasis role="pkg">virtinst</emphasis> package provides <command>virt-install</command>, which allows creating virtual machines from the command line. Finally, <emphasis role="pkg">virt-viewer</emphasis> allows accessing a VM's graphical console.
zh-CN: <emphasis role="pkg">virtinst</emphasis> 软件包提供 <command>virt-install</command>，允许从命令行创建虚拟机。最后，<emphasis role="pkg">virt-viewer</emphasis> 允许访问 VM 的图形控制台。

en: Just as in Xen and LXC, the most frequent network configuration involves a bridge grouping the network interfaces of the virtual machines (see <xref linkend="sect.lxc.network" />).
zh-CN: 与 Xen 和 LXC 一样，最常见的网络配置涉及对虚拟机的网络接口进行桥接分组（参见 <xref linkend="sect.lxc.network" />）。

en: Alternatively, and in the default configuration provided by KVM, the virtual machine is assigned a private address (in the 192.168.122.0/24 range), and NAT is set up so that the VM can access the outside network.
zh-CN: 或者，在 KVM 提供的默认配置中，虚拟机被分配一个专用地址（在 192.168.122.0/24 范围内），并设置 NAT 以便 VM 可以访问外部网络。

en: The rest of this section assumes that the host has an <literal>eth0</literal> physical interface and a <literal>br0</literal> bridge, and that the former is connected to the latter.
zh-CN: 本节的其余部分假定主机具有 <literal>eth0</literal> 物理接口和 <literal>br0</literal> 网桥，而前者连接到后者。

en: Installation with <command>virt-install</command>
zh-CN: 使用 <command>virt-install</command> 安装

en: Creating a virtual machine is very similar to installing a normal system, except that the virtual machine's characteristics are described in a seemingly endless command line.
zh-CN: 创建虚拟机与安装普通系统非常相似，只不过虚拟机的特征在看似无穷无尽的命令行中描述。

en: Practically speaking, this means we will use the Debian installer, by booting the virtual machine on a virtual DVD-ROM drive that maps to a Debian DVD image stored on the host system. The VM will export its graphical console over the VNC protocol (see <xref linkend="sect.remote-desktops" /> for details), which will allow us to control the installation process.
zh-CN: 实际上，这意味着我们将使用 Debian 安装程序，在虚拟 DVD-ROM 驱动器上启动虚拟机，该驱动器映射到存储在主机上的 Debian DVD 映像。VM 将在 VNC 协议上导出其图形控制台（有关详细信息，请参阅 <xref linkend="sect.remote-desktops" />），这将使我们能够控制安装过程。

en: <emphasis>TIP</emphasis> Add your user to the libvirt group
zh-CN: <emphasis>提示</emphasis> 将用户添加到 libvirt 组

en: All samples in this section assume that you are running commands as root. Effectively, if you want to control a local libvirt daemon, you need either to be root or to be a member of the <literal>libvirt</literal> group (which is not the case by default). Thus if you want to avoid using root rights too often, you can add yourself to the <literal>libvirt</literal> group and run the various commands under your user identity.
zh-CN: 本节中的所有示例都假定您以 root 权限运行命令。实际上，如果要控制本地 libvirt 守护程序，则需要是 root 或 <literal> libvirt</literal> 组的成员（默认情况下不是这种情况）。因此，如果您希望避免过于频繁地使用 root 权限，可以把自己添加到 <literal>libvirt</literal> 组，并在用户标识下运行各种命令。

en: Let us now start the installation process for the virtual machine, and have a closer look at <command>virt-install</command>'s most important options. This command registers the virtual machine and its parameters in libvirtd, then starts it so that its installation can proceed.
zh-CN: 现在开始虚拟机的安装过程，并仔细了解 <command>virt-install</command> 最重要的选项。此命令在 libvirtd 中注册虚拟机及其参数，然后启动它，以便其安装可以继续。

en: The <literal>--connect</literal> option specifies the “hypervisor” to use. Its form is that of an URL containing a virtualization system (<literal>xen://</literal>, <literal>qemu://</literal>, <literal>lxc://</literal>, <literal>openvz://</literal>, <literal>vbox://</literal>, and so on) and the machine that should host the VM (this can be left empty in the case of the local host). In addition to that, and in the QEMU/KVM case, each user can manage virtual machines working with restricted permissions, and the URL path allows differentiating “system” machines (<literal>/system</literal>) from others (<literal>/session</literal>).
zh-CN: <literal>--connect</literal> 选项指定要使用的"虚拟机管理程序"。它的形式是包含虚拟化系统（<literal>xen://</literal>、<literal>qemu://</literal>、<literal>lxc://</literal>、<literal>openvz://</literal>、<literal>vbox://</literal> 等）和托管 VM 的计算机（对于本地主机，这一点可能为空）的 URL。除此之外，在使用 QEMU/KVM 的情况下，每个用户可以管理使用授权的虚拟机，并且 URL 路径允许将"系统"计算机 （<literal>/system</literal>） 和其他计算机 （<literal>/session</literal>） 进行区分。

en: Since KVM is managed the same way as QEMU, the <literal>--virt-type kvm</literal> allows specifying the use of KVM even though the URL looks like QEMU.
zh-CN: 由于 KVM 的管理方式与 QEMU 相同，因此 <literal>-virt type kvm</literal> 允许指定使用 KVM，使 URL 看起来像 QEMU。

en: The <literal>--name</literal> option defines a (unique) name for the virtual machine.
zh-CN: <literal>--name</literal> 选项定义虚拟机的（唯一）名称。

en: The <literal>--memory</literal> option allows specifying the amount of RAM (in MB) to allocate for the virtual machine.
zh-CN: <literal>--memory</literal> 选项指定要为虚拟机分配的 RAM（MB）量。

en: The <literal>--disk</literal> specifies the location of the image file that is to represent our virtual machine's hard disk; that file is created, unless present, with a size (in GB) specified by the <literal>size</literal> parameter. The <literal>format</literal> parameter allows choosing among several ways of storing the image file. The default format (<literal>qcow2</literal>) allows starting with a small file that only grows when the virtual machine starts actually using space.
zh-CN: <literal>--disk</literal> 指定虚拟机硬盘的映像文件的位置；除非存在，否则将创建由 <literal>size</literal> 参数指定的大小（GB）的映像。<literal>format</literal> 参数选择存储映像文件的格式。默认格式（<literal>qcow2</literal>） 的大小仅在虚拟机实际使用空间时增长。

en: When the installation process ends, the virtual machine is restarted, now ready for use.
zh-CN: 当安装过程结束，虚拟机重启后，就可以使用了。

en: Managing Machines with <command>virsh</command>
zh-CN: 使用 <command>virsh</command> 管理机器

en: Now that the installation is done, let us see how to handle the available virtual machines. The first thing to try is to ask <command>libvirtd</command> for the list of the virtual machines it manages:
zh-CN: 现在安装已经完成，让我们看看如何处理可用的虚拟机。首先要尝试的是向 <command>libvirtd</command> 索取它所管理的虚拟机列表：

en: Let's start our test virtual machine:
zh-CN: 让我们开始测试虚拟机：

en: Other available <command>virsh</command> subcommands include:
zh-CN: 其他可用的 <command>virsh</command> 子命令包括：

en: <literal>reboot</literal> to restart a virtual machine;
zh-CN: <literal>reboot</literal> 重启一个虚拟机；

en: All these subcommands take a virtual machine identifier as a parameter.
zh-CN: 所有这些子命令都以虚拟机标识符作为参数。

en: Automated Installation
zh-CN: 自动安装

en: <primary>deployment</primary>
zh-CN: <primary>部署</primary>

en: <primary>installation</primary><secondary>automated installation</secondary>
zh-CN: <primary>安装</primary><secondary>自动安装</secondary>

en: The Falcot Corp administrators, like many administrators of large IT services, need tools to install (or reinstall) quickly, and automatically if possible, their new machines.
zh-CN: Falcot Corp 的管理员和许多大型 IT 服务的管理员一样，需要工具来快速安装（或重新安装）新计算机，如果可能，自动化。

en: Fully Automatic Installer (FAI)
zh-CN: 全自动安装器 （FAI）

en: Creating all these configuration files requires some understanding of the way FAI works. A typical installation process is made of the following steps:
zh-CN: 创建所有这些配置文件需要对FAI的工作方式有一定的了解。一个典型的安装过程由以下步骤组成：

en: fetching a kernel from the network, and booting it;
zh-CN: 从网络获取内核并启动它;

en: partitioning the disks and formatting the partitions, based on information provided in <filename>/fai/disk_config/<replaceable>class</replaceable></filename>;
zh-CN: 根据 <filename>/fai/disk_config/<replaceable>class</replaceable></filename> 中提供的信息，对磁盘进行分区和格式化；

en: mounting said partitions;
zh-CN: 安装所述分区;

en: installing the base system;
zh-CN: 安装基本系统;

en: preseeding the Debconf database with <command>fai-debconf</command>;
zh-CN: 使用 <command> fai-debconf </command> 预置 Debconf 数据库;

en: fetching the list of available packages for APT;
zh-CN: 获取 APT 的可用包列表;

en: installing the packages listed in <filename>/fai/package_config/<replaceable>class</replaceable></filename>;
zh-CN: 安装 <filename>/fai/package_config/<replaceable>类</replaceable></filename>中列出的包;

en: executing the post-configuration scripts, <filename>/fai/scripts/<replaceable>class</replaceable>/[0-9][0-9]*</filename>;
zh-CN: 执行配置后脚本，<filename>/fai/scripts/<replaceable>class</replaceable>/[0-9][0-9]*</filename>;

en: recording the installation logs, unmounting the partitions, and rebooting.
zh-CN: 记录安装日志，卸载分区，并重新启动。

en: Preseeding Debian-Installer
zh-CN: 预设值 Debian 安装

en: <primary>preseed</primary>
zh-CN: <primary>预设值</primary>

en: <primary>preconfiguration</primary>
zh-CN: <primary>预配置</primary>

en: <emphasis>GOING FURTHER</emphasis> Debconf with a centralized database
zh-CN: <emphasis>进阶阅读</emphasis> 有中心数据库的 Debconf

en: Using a Preseed File
zh-CN: 使用预设值文件

en: There are several places where the installer can get a preseeding file:
zh-CN: 安装程序可以在几个位置获取预置文件：

en: Creating a Preseed File
zh-CN: 创建一个预设值文件

en: A preseed file is a plain text file, where each line contains the answer to one Debconf question. A line is split across four fields separated by whitespace (spaces or tabs), as in, for instance, <literal>d-i mirror/suite string stable</literal>:
zh-CN: 预设值配置是一个纯文本文件，每一行有一个 Debconf 问题的答案。每行用空格（多个空格或 tab 键）分为四个段，例如：<literal>d-i mirror/suite string stable</literal>:

en: the first field is the “owner” of the question; “d-i” is used for questions relevant to the installer, but it can also be a package name for questions coming from Debian packages;
zh-CN: 第一段是问题的“所有者”；“d-i”用于安装相关的问题，这个段也可以是问题来自的 Debian 包的包名；

en: third, the type of question;
zh-CN: 第三段，问题的类型；

en: the fourth and last field contains the value for the answer. Note that it must be separated from the third field with a single space; if there are more than one, the following space characters are considered part of the value.
zh-CN: 第四段和该行后续内容是答案的值。注意，第四段和第三段之间，必须是单个空格分隔；如果有多个空格，从接下来的空格字符开始，会被认为是值的一部分。

en: The simplest way to write a preseed file is to install a system by hand. Then <command>debconf-get-selections --installer</command> will provide the answers concerning the installer. Answers about other packages can be obtained with <command>debconf-get-selections</command>. However, a cleaner solution is to write the preseed file by hand, starting from an example and the reference documentation: with such an approach, only questions where the default answer needs to be overridden can be preseeded; using the <literal>priority=critical</literal> boot parameter will instruct Debconf to only ask critical questions, and use the default answer for others.
zh-CN: 为安装一个系统写一个预配置文件，最简单的方法是手写。<command>debconf-get-selections --installer</command>将提供与安装相关的问题答案。其它包的答案可以通过<command>debconf-get-selections</command>获得。然而，手写一个预设值文件，一个干净的方法，是从一个例子和参考文档开始。使用这种方案，只有那些默认答案需要被覆盖的问题被预配置；使用 <literal>priority=critical</literal> 启动参数将指示 Debconf 只询问极严重的问题，其它问题用默认答案。

en: <emphasis>DOCUMENTATION</emphasis> Installation guide appendix
zh-CN: <emphasis>文档</emphasis> 安装手册附录

en: Creating a Customized Boot Media
zh-CN: 创建自定义启动媒体

en: Booting From the Network
zh-CN: 从网络启动

en: Preparing a Bootable USB Key
zh-CN: 准备可引导 USB 密钥

en: syslinux.cfg file and preseeding parameters
zh-CN: syslinux.cfg 文件和预置参数

en: Creating a CD-ROM Image
zh-CN: 创建一个 CD-ROM 镜像

en: Creating Profiles
zh-CN: 创建配置文件

en: the <filename>.packages</filename> file lists packages that will automatically be installed if the profile is selected;
zh-CN: <filename>.packages</filename> 文件列出了如果选择了配置文件，将自动安装的包;

en: the <filename>.downloads</filename> file lists packages that will be stored onto the installation media, but not necessarily installed;
zh-CN: <filename>.downloads</filename> 文件列出了将存储在安装介质中但不一定安装的包;

en: the <filename>.preseed</filename> file contains preseeding information for Debconf questions (for the installer and/or for packages);
zh-CN: <filename>.preseed</filename> 文件包含 Debconf 问题（安装程序和/或包）的预置信息;

en: the <filename>.postinst</filename> file contains a script that will be run at the end of the installation process;
zh-CN: <filename>.postinst</filename> 文件包含将在安装过程结束时运行的脚本;

en: Note also that the commands will need to be invoked from the parent directory of the <filename>profiles</filename> directory.
zh-CN: 还需要注意的是，这些命令需要从 <filename>profile</filename>目录的父目录中调用。

en: Configuring and Using <command>build-simple-cdd</command>
zh-CN: 配置和使用 <command>build-simple-cdd</command>

en: <emphasis>QUICK LOOK</emphasis> Detailed configuration file
zh-CN: <emphasis>速览</emphasis>详细配置文件

en: the custom packages mentioned in <literal>local_packages</literal> are also integrated into this local mirror;
zh-CN: <literal>local_packages</literal> 中提到的自定义包也被集成到这个本地镜像中;

en: once debian-cd has prepared its directory, Simple-CDD applies some changes to this directory:
zh-CN: 一旦 debian-cd 准备好了它的目录，Simple-CDD 就会对这个目录进行一些修改：

en: debian-cd then generates the final ISO image.
zh-CN: debian-cd 将产生最终的 ISO 镜像。

en: Generating an ISO Image
zh-CN: 生成 ISO 镜像

en: Monitoring is a generic term, and the various involved activities have several goals: on the one hand, following usage of the resources provided by a machine allows anticipating saturation and the subsequent required upgrades; on the other hand, alerting the administrator as soon as a service is unavailable or not working properly means that the problems that do happen can be fixed sooner.
zh-CN: 监视是一个通用术语，所涉及的各种活动有几个目标：一方面，在使用机器提供的资源后，可以预测饱和度和随后的所需升级;另一方面，一旦服务不可用或无法正常工作，就提醒管理员意味着可以更快地修复所发生的问题。

en: <emphasis>ALTERNATIVE</emphasis> Zabbix, an integrated monitoring tool
zh-CN: <emphasis>替代方案</emphasis> Zabbix，集成监控工具

en: <emphasis>ALTERNATIVE</emphasis> Icinga, a Nagios fork
zh-CN: <emphasis>替代方案</emphasis>Nagios 派生出的 Icinga

en: Setting Up Munin
zh-CN: 搭建 Munin

en: Configuring Hosts To Monitor
zh-CN: 配置监控主机

en: <emphasis>GOING FURTHER</emphasis> Creating local plugins
zh-CN: <emphasis>进阶阅读</emphasis> 创建本地插件

en: Configuring the Grapher
zh-CN: 配置 Grapher

en: Setting Up Nagios
zh-CN: 搭建 Nagios

en: Installing
zh-CN: 安装

en: Configuring
zh-CN: 配置

en: <emphasis>GOING FURTHER</emphasis> Remote tests with NRPE
zh-CN: <emphasis>进阶阅读</emphasis>使用 NRPE 进行远程测试
