Virtualization Adapted Adapting Business Processes for Virtual Infrastrcuture (and vice-versa)

2010/11/18

RISO SISO Expert

Filed under: virtualization — Tags: , — iben @ 07:32

RISO SISO Expert

To provide optimal delivery of solutions, services are provided in three main forms:

Rapid Implementation Solution Offerings

The intent of Rapid Implementation Solution Offerings (RISOs) is to install and configure a technology solution in a controlled fashion, in a tightly scoped environment, with a focus on a pre-designated Best Practices approach.

RISOs are available for major technology solutions. RISOs typically form the first phase of a Solution Implementation.

Solution Implementation Solution Offerings

The intent of Solution Implementation Solution Offerings (SISOs) is to provide additional customization, configuration and integration of technology solutions, with a focus on a more tailored approach than the RISOs.

Expert packs

Beyond the initial installation, configuration, customization and integration, Expert packs provide for smaller, incremental pieces or work, providing specialists to enhance the installed solutions to address new functions and to ensure optimal operation of the technology.

2010/11/13

VMware VAAI Certification Test Summary

Filed under: virtualization — Tags: , , , , , , , — iben @ 17:47

VMware VAAI Certification Test Summary

Based on the VMware VAAI Certification Guide Revision date: 20101011

This guide is intended for VMware partners who want to certify VAAI storage with ESX to claim compatibility in the VMware HCLs.

The vStorage API calls off load certain storage operations to the storage array and optimize the storage operation. They are the new application programming interfaces in the VMKernel. Using a small set of primitives or fundamental operations that can be issued to an array supporting these interfaces, ESX can improve the performance on certain storage operations such as cloning, snapshotting, mirroring, zeroing blocks, and replication.

You certify these offload operations with your storage arrays and use this certification to obtain a listing in the VMware compatibility guide:

  • Atomic Test and Set (ATS) also known as Hardware Assisted Locking: a mechanism to modify a disk sector to improve the performance of ESX updating metadata.
  • Full Copy: given a source range of LBAs, copies them into the given destination range of LBAs.
  • Block Zeroing or Write Same: zeroes out the given range of LBAs.

VAAI Certification Test Process List

  1. BlockZeroDiskTest
    1. This test verifies that when ESX uses the VAAI BlockZero primitive, an eager‐zeroed‐thick vmdk volume is created faster.
    2. The operation compares execution time with and without enabling the VAAI BlockZero primitive. The test passes only if the execution time with VAAI enabled is less than with VAAI disabled.
    3. The test is conducted with continuous I/O to the array under test from four virtual machines running on the ESX host.
    4. IMPORTANT Do not run any extraneous workloads on the storage array under test during the first 30 minutes of this test to avoid the possibility of non‐constant workloads skewing the test times and causing a test failure.
    5. Estimated test time: 30 minutes
  2. BlockZeroRDMTests
    1. This test verifies that zeroing a vmdk volume on an RDM disk is performed correctly when ESX uses the VAAI BlockZero primitive. The test is run on both a non‐pass‐through RDM as well as a pass‐through RDM disk.
    2. The operation is conducted with and without enabling the VAAI BlockZero primitive. The test logs note the execution times with and without the VAAI BlockZero primitive, but the time does not determine test passing or failing.
    3. The test is conducted with continuous I/O to the array under test from four virtual machines running on the ESX host.
    4. Estimated test time: 5 minutes to 3 hours
  3. BlockZeroMultiOffloadTests
    1. This test verifies that simultaneous creation of virtual disks on a shared datastore from two ESX hosts with VAAI BlockZero primitive enabled functions properly.
    2. The operation is conducted with and without enabling the VAAI BlockZero primitive. The test logs note the execution times with and without the VAAI BlockZero primitive, but the time does not determine test passing or failing.
    3. This test is conducted with no I/O to the array under test.
    4. Estimated test time: 10‐20 minutes
  4. FullCopyDiskTest
    1. This test verifies that when ESX uses the VAAI FullCopy primitive, a vmdk volume clones faster.
    2. The operation is conducted with and without enabling the VAAI FullCopy primitive. The test logs note the execution times with and without the VAAI FullCopy primitive, but the time does not determine test passing or failing.
    3. The test is conducted with continuous I/O to the array under test from four virtual machines running on the ESX host.
    4. Estimated test time: 36 hours, with a majority of the time spent verifying cloned volume contents.
  5. FullCopyRDMTests
    1. This test verifies that cloning a vmdk volume to an RDM disk is done correctly when ESX host uses the VAAI FullCopy primitive. The test is run with both a non‐pass‐through RDM as well as a pass‐through RDM disk as the destination disk.
    2. The operation is conducted with and without enabling the VAAI FullCopy primitive. The test logs note the execution times with and without the VAAI FullCopy primitive, but the time does not determine test passing or failing.
    3. The test is conducted with continuous I/O to the array under test from four virtual machines running on the ESX host.
    4. Estimated test time: 18 hours, with a majority of the time spent verifying cloned volume contents.
  6. FullCopyCloneVMTests
    1. This test verifies that virtual machine cloning operations function properly with the VAAI FullCopy primitive enabled.
    2. The test clones a virtual machine to both the same datastore as the source virtual machine as well as to a different datastore.
    3. The operation compares execution time with and without enabling the VAAI FullCopy primitive. The test passes only if the execution time with VAAI enabled is less than with VAAI disabled.
    4. The test is conducted with continuous I/O to the array under test from four virtual machines running on the ESX host.
    5. IMPORTANT Do not run any extraneous workloads on the storage array under test during the first 30 minutes of this test to avoid the possibility of non‐constant workloads skewing the test times and causing a test failure.
    6. Estimated test time: 1 hour
  7. FullCopyCloneVMRDMTests
    1. This test verifies that virtual machine cloning operation from a non‐pass‐through RDM LUN to a pass‐through RDM LUN functions properly with the VAAI FullCopy primitive enabled.
    2. The operation is conducted with and without enabling the VAAI FullCopy primitive. The test logs note the execution times with and without the VAAI FullCopy primitive, but the time does not determine test passing or failing.
    3. The test is conducted with continuous I/O to the array under test from four virtual machines running on the ESX host.
    4. Estimated test time: 32 minutes
  8. FullCopyMultiOffloadTests
    1. This test verifies that the VAAI feature improves concurrent Full Copy from two ESX hosts.
    2. The operation is conducted with and without enabling the VAAI FullCopy primitive. The test logs note the execution times, but the time does not determine test passing or failing.
    3. This test is conducted with no I/O to the array under test.
    4. Estimated test time: 20 minutes
  9. ATSFileOpTests
    1. This test verifies that when ESX enables the VAAI ATS primitive, the file create, delete, read and write operations perform faster with simultaneous access to the LUN from two ESX hosts.
    2. The operation compares execution time with and without enabling the VAAI ATS primitive. The test passes only if the execution time with VAAI enabled is less than with VAAI disabled.
    3. This test is conducted with no I/O to the array under test.
    4. IMPORTANT Do not run any extraneous workloads on the storage array under test during the first 30 minutes of this test to avoid the possibility of non‐constant workloads skewing the test times and causing a test failure.
    5. Estimated test time: 12‐20 minutes
  10. ATSMultiLengthFileTests
    1. This test verifies that when ESX hosts use the VAAI ATS primitive, simultaneous file modifications from two ESX hosts function properly.
    2. The operation compares execution time with and without enabling the VAAI ATS primitive. The operation is conducted with and without enabling the VAAI ATS primitive. The test logs note the execution times, but the time does not determine test passing or failing.
    3. This test is conducted with no I/O to the array under test.
    4. Estimated test time: 3‐10 minutes
  11. ATSReserveTests
    1. This test verifies that when ESX hosts use the VAAI ATS primitive, file locking and unlocking modifications from two ESX hosts function properly.
    2. This test is conducted with no I/O to the array under test.
    3. Estimated test time: 3‐5 minutes

2010/11/04

Storage IOPS per VM

Filed under: virtualization — iben @ 12:34

The number of VMs is directly limited by the storage capacity and performance requirements measured in GB (Gigabytes) and IOPS (Input Output Operations Per Second). For starters you need fast disks.

http://en.wikipedia.org/wiki/IOPS#Examples

  • 7200RPM SATA drives – ~90 IOPS
  • 15kRPM Serial Attached SCSI drives – ~180 IOPS
  • Simple SSD – ~400 IOPS
  • ioDrive, a PCI-Express card with Flash – >80,000 IOPS

How to “see” IOPS usage on ESX or vCenter…

http://communities.vmware.com/thread/273268

As an example, Windows XP 32 bit VM would need 10 to 20 IOPS and 10 to 20 GB Capacity.

Windows 7 – 64 bit would pretty much double that. A high performance server VM could easily need 2000 IOPS.

http://blogs.vmware.com/performance/2010/05/exchange-2010-disk-io-on-vsphere.html

And – make sure your product roadmap shows how many IOPS just ONE ESX host can drive…

VMware: VROOM!: 100,000 I/O Operations Per Second, One ESX Host

To demonstrate the scalability of the ESX I/O stack, we decided to see if ESX could sustain 100,000 IOPS.

http://blogs.vmware.com/performance/2008/05/100000-io-opera.html

2010/10/28

VAAI – Hitachi

Filed under: virtualization — iben @ 15:31

When VMware released VMware vStorage APIs for Array Integration (VAAI) on July 13, 2010, Hitachi jointly released support for these APIs on our AMS 2000 storage arrays.

The testing that has been done with Hitachi Dynamic Provisioning volumes on an AMS 2300 with VAAI has shown the following results:

  • Full copy – 18% performance improvement (speed to copy VM’s)
  • Write same – 85% performance improvement (speed to clone VM’s)
  • Hardware Assisted Locking – 25% to 35% performance improvement including the removal of SCSI reserves (powering on 1400 VM’s on 4 x Servers simultaneously)

http://blogs.hds.com/hu/2010/08/hds-at-vmworld-2010.html

Hitachi storage integration with VAAI includes:

  • Hardware-assisted Locking: Provides an alternative means to protecting the VMFS cluster file system’s meta data
  • Full Copy: Enables the storage arrays to make full copies of data within the array without the VMware vSphere host reading and writing the data
  • Block Zeroing: Enables storage arrays to zero out a large number of blocks to enhance the deployment of large-scale VMs.

Hitachi Dynamic Provisioning allows organizations to create a storage pool from which capacity can be used as-needed to improve performance and utilization. Additionally, Hitachi Load Balancing active-active symmetric controllers distribute VMware workloads across all paths to ensure optimal performance by eliminating I/O path thrashing, which leads to performance degradation. This integration significantly enhances the customer experience through:

  • Improved scalability: More VMs per data store; better storage utilization
  • Improved performance: VMware vSphere offloads storage specific tasks to the arrays, freeing up cycles on the host for other workloads
  • Improved ROI: Faster time to deployment means less coordination between VMware and storage administrators
  • Reduced OPEX and CAPEX costs

http://www.hds.com/corporate/press-analyst-center/press-releases/2010/gl100713.html

See Also: http://storagenerve.com/2010/09/30/vaai-and-automated-storagetiering-with-storage-virtualization/

VAAI – Netapp

Filed under: virtualization — Tags: , , , , , — iben @ 15:21

New NetApp Virtual Storage Console 2.0 (VSC) integrates with VMware vSphere vStorage APIs for Array Integration (VAAI). VAAI provides additional interfaces to enable advanced capabilities developed by VMware vSphere workflows to integrate advanced storage capabilities from NetApp and other vendors.

http://media.netapp.com/documents/wp-7106.pdf

VSC consists of three distinct capabilities:

  • Storage Console is the foundation capability, providing storage discovery, health monitoring, capacity management, and storage configuration according to best practices.
  • Provisioning and Cloning (formerly NetApp Rapid Cloning Utility) provides end-to-end datastore management-provisioning, resizing, and deletion-and rapid, space-efficient VM server and desktop cloning, patching, and updating utilizing NetApp FlexClone technology.
  • Backup and Recovery (formerly NetApp SnapManager for Virtual Infrastructure) automates data protection processes by enabling VMware admins to centrally manage backup and recovery of datastores and VMs without impacting guest performance, and to rapidly recover from backups at any level of granularity-datastore, VM, VMDK, or guest file.

Provisioning and Cloning

The provisioning and cloning capability of VSC 2.0 includes all the capabilities of previous versions of RCU, including the ability to efficiently clone new virtual machines from a baseline using NetApp FlexClone technology, manage and secure storage paths, configure deduplication and thin provisioining for storage efficiency, and resize datastores.

Another significant feature is the ability to redeploy existing virtual machines to bring them up to date with the latest patches and so on. Working from a baseline virtual machine that contains the same OS and applications as your deployed virtual machines plus the desired updates, this feature allows you to quickly reconstruct your existing VMDK files while keeping the unique configuration files for each VM intact. You can also choose to maintain current customization settings or apply new settings.

baselines_902x646.jpg

Figure – Redeploying your existing virtual machines from an updated baseline.

VMFS Versions – Drivers and Formats

Filed under: virtualization — Tags: , , , , — iben @ 15:14

There are no significant on-disk format changes going from version 3.33 to 3.46. However, there is a significant change between VMFS driver version 3.46 and driver version 3.33. In particular, 3.46 contains VAAI extensions, which leads VMFS to use hardware accelerated locking and the hardware accelerated data mover on VAAI compliant hardware.

So the short answer is that you do not need to upgrade to a new on-disk vmfs 3.46 but instead the new 3.46 driver on ESX 4.1 will bring you the benefit even with vmfs 3.33 on-disk filesystem, if these are on array whose firmware is upgraded that provides such VAAI extensions.

VMware ESX 3 – VMFS ver 3.21
VMware ESX 3.5 – VMFS ver 3.31
VMware vSphere 4 – VMFS ver 3.33
VMware vSphere 4.1 – VMFS ver 3.46
VMware vSphere 5 – VMFS ver 5

HyTrust Appliance 2.1 Available

Filed under: virtualization — Tags: , , , , , , , , , , , , — iben @ 14:36

HyTrust recently celebrated its 3-year birthday.  HyTrust was founded in October 2007 to bring secure access control and policy to virtual infrastructure, enabling wider adoption of virtualization throughout the enterprise — exactly the same focus that we have today.

It’s amazing to see what we have achieved in the last three years: great enterprise customers; solid partnerships with the major players in virtualization (VMware, Cisco, RSA, Intel and Symantec); numerous accolades, including Best of Show at VMworld; and, of course, several significant releases of HyTrust Appliance…

So we’re excited to let you know that HyTrust Appliance 2.1 is now generally available. It is chock-full of exciting new enterprise features, including protection for the control of Cisco Nexus 1000V, application-level high availability, and smart card support.  As always, we have also made 2.1 available in the Community Edition form, which can be downloaded for free here: 
http://info.hytrust.com/appliance.html

New HyTrust Appliance Capabilities At a Glance

  • Support for VMware vSphere 4.1
  • Integrated access control, policy and audit logging for Cisco Nexus 1000V CLI management (NX-OS command set)
  • Support for complex, multi-domain Active Directory environments
  • Single sign-on via Windows pass-through authentication with smart card integration
  • New ESX hardening templates including VMware Hardening Guide 4.0 and (Sarbanes Oxley) SOX hardening template
  • Application-level high availability (in addition to VMware HA/FT and federation)

If you would like to take a look at the new functionality, we have recorded demos of the new version available for your viewing pleasure.
http://info.hytrust.com/recorded_product_demo.html

For those of you currently evaluating HyTrust Appliance, we’d like to extend an added incentive to make your purchase in Q4: for a limited time, HyTrust is offering a free “jump-start” professional services package to help you get up and running quickly. Contact sales (sales@hytrust.com) for more information.

2010/10/23

Vyatta router upgrade procedure

Filed under: Uncategorized — Tags: , , , — iben @ 12:36

Upgrading in a Virtual Environment

Upgrading in a virtual environment involves two steps:
1 Install the new appliance to a fresh virtualized environment.
2 Migrate your configuration from old to new Vyatta appliances.

Migrate the configuration

1 In configuration mode on the old system, use the save command to save the
current configuration.
2 For all Ethernet interfaces, remove the hardware ID values using the delete
interfaces ethernet ethx hw-id command to remove the hardware ID values, then
commit and save the configuration to a name other than config.boot (for
example, save oldconfig).
3 Use the load command to return the original configuration to the old system.
4 Use the set service ssh command and then the commit command to configure the
system to allow for SCP file transfer.
5 In configuration mode on the new system, assign an IP address to an interface
residing on the same subnet as one on the old system (for example, set interfaces
ethernet eth0 address 192.168.1.99/24), and then commit the change.
6 Copy the saved configuration (the one with the hardware UDs removed) from the
old system to the new system. For example, if the old system is at 192.168.1.20,
the saved configuration file is name oldconfig, and the username vyatta is
available on the old system, issue the scp command as follows:
scp vyatta@192.168.1.20:/opt/vyatta/etc/config/oldconfig
/opt/vyatta/etc/config/oldconfig
7 Load the copied configuration using the load command (for example, load
oldconfig). At this point, the configuration on the new system should match that
on the old system (except for the hardware IDs).
8 Shut down the old system using the shutdown command.

Reference:

http://www.vrouter.net/solutions/branch_virtualization.php

2010/09/17

Hypervisor Density

Filed under: Uncategorized — Tags: , , , — iben @ 22:17

Testing using a workload that mimics real world SQL Server workloads better than ever before, suggests that ESX today has a VM density ratio well in excess of 1.5:1.

VMware’s ESXi 4.1 continues to lead the pack, delivering a density advantage of at least 2:1 and up to almost 3:1 versus Hyper-V R2 and between 1.7:1 and 2.3:1 vs. KVM.

XenServer has closed the density gap in terms of number of concurrent VMs that can be run on a given host, coming to par with ESXi, but that this comes with a significant and unacceptable performance penalty. XenServer consistently delivers far less performance across the board (penalty ranging from 25% to 69%), and in our view gives ESXi as much as a 2:1 density advantage over XenServer, once we consider the ability of the hypervisor to access the full performance of the underlying hardware.

http://www.tanejagroup.com/chkwhitepapers.aspx?lstpro=1&fname=VMware%20Hypervisor%20Density%20TVS%20August%202010.pdf

2010/09/10

vsphere security best practices

Filed under: Uncategorized — Tags: , , , , , , — iben @ 07:54

VMware ESX 4.1 and vCenter Server 4.1

Background:

Follow the security principles of:
– separation of duties
– least privilege

Harden the hypervisor: upgrade to vSphere ESXi 4.1

Give the LAN back to the Network Team

Implement the Cisco Nexus 1000v and only assign ports to active systems.

Audit and control access

Use a tool like HyTrust to eliminate configuration drift and track and control system access.

Using Roles to Assign Privileges

A role is a predefined set of privileges. Privileges define individual rights that a user requires to perform actions and read properties.
When you assign a user or group permissions, you pair the user or group with a role and associate that pairing with an inventory object. A single user might have different roles for different objects in the inventory. For example, if you have two resource pools in your inventory, Pool A and Pool B, you might assign a particular user the Virtual Machine User role on Pool A and the Read Only role on Pool B. These assignments would allow that user to turn on virtual machines in Pool A, but not those in Pool B. The user would still be able to view the status of the virtual machines in Pool B.
The roles created on an ESX/ESXi host are separate from the roles created on a vCenter Server system. When you manage a host using vCenter Server, the roles created through vCenter Server are available. If you connect directly to the host using the vSphere Client, the roles created directly on the host are available.
vCenter Server and ESX/ESXi hosts provide default roles:

  • System roles
    • System roles are permanent. You cannot edit the privileges associated with these roles.
  • Sample roles
    • VMware provides sample roles for convenience as guidelines and suggestions. You can modify or remove these roles.

You can also create roles.
All roles permit the user to schedule tasks by default. Users can schedule only tasks they have permission to perform at the time the tasks are created.
Note: Changes to permissions and roles take effect immediately, even if the users involved are logged in. The exception is searches, where permission changes take effect after the user has logged out and logged back in.

Details:

Best Practices for vCenter Roles and Permissions

Use best practices for roles and permissions to maximize the security and manageability of your vCenter Server environment.
VMware recommends the following best practices when configuring roles and permissions in your vCenter Server environment:

  • Use folders to group objects to correspond to the differing permissions you want to grant for them.
  • Grant permissions to groups rather than individual users.
  • Grant permissions only where needed. Using the minimum number of permissions makes it easier to understand and manage your permissions structure.
  • If you assign a restrictive role to a group, check that the group does not contain the Administrator user or other users with administrative privileges. Otherwise, you could unintentionally restrict administrators’ privileges in parts of the inventory hierarchy where you have assigned that group the restrictive role.
  • Use caution when granting a permission at the root vCenter Server level. Users with permissions at the root level have access to global data on vCenter Server, such as roles, custom attributes, vCenter Server settings, and licenses. Changes to licenses and roles propagate to all vCenter Server systems in a Linked Mode group, even if the user does not have permissions on all of the vCenter Server systems in the group.
  • In most cases, enable propagation on permissions. This ensures that when new objects are inserted in to the inventory hierarchy, they inherit permissions and are accessible to users.
  • Use the No Access role to masks specific areas of the hierarchy that you don’t want particular users to have access to.

Use Host Profiles to Apply Permissions to Hosts

When you join a host to an Active Directory domain, you must define roles on the host for a user or group in that domain. Otherwise, the host is not accessible to Active Directory users or groups. You can use host profiles to set a required role for a user or group and to apply the change to one or more hosts.
It is recommended that you follow this procedure for System Administrators (Admin) and Auditors (ReadOnly).

Prerequisites

You must have an existing host profile. See Creating a Host Profile.
Verify that the hosts to which you apply a profile are in maintenance mode.

Procedure

  1. Using the vSphere Client, select View > Management > Host Profiles.
  2. Right-click an existing host profile and select Edit Profile.
  3. Expand the profile tree, and then expand Security configuration.
  4. Right-click the Permission rules folder and select Add Profile.
  5. Expand Permission rules and select Permission.
  6. On the Configuration Details tab in the right pane, click the Configure a permission drop-down menu and select Require a Permission Rule.
  7. Enter the name of the group that should have the role assigned to it.
    1. Use the format DOMAIN\name, where DOMAIN is the name of the Active Directory domain and name is the user name or group name.
  8. Select the Name refers to a group of users check box.
  9. Enter the assigned role name for the user or group (usually Admin or ReadOnly).
    1. The role name is case-sensitive. If this is a system role, you must use the nonlocalized role name. For example, for the Administrator role, enter Admin. For the Read-only role, enter ReadOnly.
  10. Select the Propagate permission check box and click OK.

Reference:

vSphere Datacenter Administration Guide : Setting Up Your Virtual Infrastructure : Managing Users, Groups, Roles, and Permissions : Best Practices for Roles and Permissions
http://pubs.vmware.com/vsphere-esx-4-1/wwhelp/wwhimpl/js/html/wwhelp.htm

« Newer PostsOlder Posts »

Powered by WordPress