Troubleshooting playbook

Use the same order every time: confirm the URI, confirm the socket, identify the owning daemon, then inspect XML or policy.

First response

virsh -c qemu:///system uri
systemctl status libvirtd virtqemud virtproxyd
ss -lx | grep -E "libvirt|virtqemud|virtproxyd"
journalctl -u libvirtd -u virtqemud -u virtproxyd -n 150

Permissions and polkit

If root works and an unprivileged operator fails, check local authorization before changing daemon settings.

id
pkaction | grep -i libvirt
journalctl -b | grep -i polkit

Certificates and remote listeners

For remote access problems, validate the listener and trust chain before you touch guest definitions.

systemctl status virtproxyd-tls.socket
ss -ltnp | grep 16514
openssl s_client -connect hv-a:16514 -servername hv-a

Always read the XML

virsh dumpxml explains many failures that look like daemon bugs but are really bad paths, missing bridges, or incompatible guest settings.