Here are strace outputs per process.

strace_output.22076 is the plugin's pid. (A little before forking)
strace_output.22077  runs qemu-img
strace_output.22078 is a mystery to me
strace_output.22079 is rm -rf to the overlay image and its temporary dir.

Best Regards,

On Wed, Nov 7, 2018 at 4:38 PM Richard W.M. Jones <> wrote:
On Wed, Nov 07, 2018 at 01:37:03PM +0200, Peter Dimitrov wrote:
> > That makes no sense because we are supposed to have just forked
> successfully
> I just realized libguestfs uses fork. Now we know why qemu-img worked - I
> launched it with popen.
> > So it must be something to do with collectd and how it runs programs.
> > Is it using LD_PRELOAD trickery, or replacing libc, or using seccomp?
> If I understand the question correctly - it's about how collectd loads its
> plugins? If so it uses:
> static int plugin_load_file(const char *file, _Bool global) {
>   void (*reg_handle)(void);
>   int flags = RTLD_NOW;
>     if (global)
>       flags |= RTLD_GLOBAL;
>   void *dlh = *dlopen*(file, flags);
>   //...
>   reg_handle = (void (*)(void))*dlsym*(dlh, "module_register");
>   //...
>   *(*reg_handle)();*
> }
> Does this give any clues?

Can you strace the collectd process around the point where qemu-img is
run?  It may gives some clues.


Richard Jones, Virtualization Group, Red Hat
Read my programming and virtualization blog:
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.