vSphere - 8

I think everyone knows the three admissions control policies which can be enforced on a VMware HA Cluster.  If you are using the default “Host Failures Allowed” policy, you must keep in mind that the largest virtual machine reservation will decide how big your cluster slot size is going to be. In most cases when you are using reservations that differ, I would prefer to use the “Percentage of cluster resources reserved as failover spare capacity”. But be careful, I’ve pulled two quotes which warn us for scattered resources and the need to set restart priority on large virtual machines. Duncan Epping over at Yellow-Bricks has written a real great HA-Deepdive article and says :

Basic design principle: Do the math, verify that a single host has enough resources to boot your largest VM. Also take restart priority into account for this/these VM(s). Make sure you select the highest restart priority for this VM to ensure it will be able to boot.

When looking at the slides from the VMware Design Workshop I’ve found a similar suggestion.

To avoid not being able to access a large portion of host resources in a smaller cluster, you can configure the Percentage of Cluster Resources Reserved policy. However, due to the way resources are divided across hosts, this policy cannot always guarantee that all virtual machines can be restarted.

So what does it mean? I’ve created a PowerPoint slideshow with heavy animation :-) which shows the three policies and explains the caveat of using the “Percentage of cluster resources reserved as failover spare capacity” policy.

In this article I will explain the hidden dangers when adding a resource pool with default settings to a DRS cluster, but first off all kudos to my famous virtualization friends Duncan Epping, Frank Denneman and Bouke Groenescheij. They already have written several great articles about resource pools, shares and reservations. You could ask yourself is there anymore to say about using resource pools? Well there is. I often see production environments where people have added two or three resource pools just for fun saying; there’s no reservation or limit on it so it doesn’t matter. Well they’re just plain wrong! On top of that, they even use resource pools as folders to group their virtual machines. Let’s look at an example.

In my home environment I’ve created two resource pools and one vApp. I didn’t adjust the settings and left everything default. I’ve added 8 virtual machines to recourse pool “test 1”. The two resource pools and the vApp are sibling with three virtual machines in the root resource pool. Take a close look at the ”% Shares” column in the “Resource allocation tab”. The sibling virtual machines will get 18% of the resources when there’s contention. The  vApp will get 26%, so that’s 13% for vCenter and 13% for SQL2008. The virtual machines within resource pool “test 1” will have to divide 26% among 8 virtual machines so that’s 3,25% per virtual machine. The sibling root resource pool virtual machines will get 6% each. So don’t use resource pools for cosmetic reasons, you better use virtual machine folders instead. As long as there’s no contention, there’s no problem. But as soon as you reach the max the resources might be divided in a way you didn’t expect.

This paper provides an overview of the considerations and best practices for deployment of VMware vSphere on NFS based storage. It also examines the myths that exist and will attempt to dispel confusion as to when NFS should and should not be used with vSphere. It will also provide some troubleshooting tips and tricks. It’s written by Paul Manning, a Storage Architect in the technical marketing group at VMware and is focused on virtual storage management.

The significant presence of Network Filesystem Storage (NFS) in the datacenter today, as well as the lower cost-per-port for IP based Storage, has lead to many people wanting to deploy virtualization environments with Network Attached Storage (NAS) shared storage resources. 

As virtualization increases adoption, so does the deployment of VMware ESX servers that leverage NAS. For the purpose of clarity, both NFS and NAS refer to the same type of storage protocol and will be used as terms for the same thing throughout this paper. 

The capabilities of VMware Virtual Infrastructure 3 (VI3) on NFS are very similar to the VMware vSphere™ on block-based storage. VMware offers support for almost all features and functions on NFS—as it does for vSphere on SAN. Running vSphere on NFS is a very viable option for many virtualization deployments as it offers strong performance and stability if configured correctly.

http://vmware.com/files/pdf/VMware_NFS_BestPractices_WP_EN.pdf

VMware would like to announce the availability of the final release of the vSphere 4.0 Security Hardening Guide.  This version incorporates the extensive feedback from the VMware community on the previous draft release, which was published in January.  We would like to thank all the people who took the time to go through the draft release and provide their comments.

vSphere Hardening Guide provides guidance on how to securely deploy vSphere 4.0 in a production environment. The focus is on initial configuration of the virtualization infrastructure layer, which covers the following:

• The virtualization hosts (both ESX and ESXi)
• Configuration of the virtual machine container (NOT hardening of the guest OS or any applications running within)
• Configuration of the virtual networking infrastructure, including the management and storage networks as well as the virtual switch (but NOT security of the virtual machine’s network)
• vCenter Server, its database, and client components
• VMware Update Manager (included because the regular update and patching of the ESX/ESXi hosts and the virtual machine containers is essential to maintaining the security of the environment)

http://communities.vmware.com/docs/DOC-12306

PerformanceTest is a fast, easy to use software benchmarking tool which allows everybody to quickly assess the performance of their PC and compare it to a number of standard 'baseline' computer systems. But what if we are going to use PassMark’s PerformanceTest in a virtual machine and try to find out if it is performing at its best. This way it’s easy to compare the performance of one virtual machine to other virtual machines hosted on the same or a different ESX server. You can use it to identify and measure the effect of virtual hardware configuration changes and upgrades.

I’ve installed the PerformanceTest in two Windows 2003 (32) virtual machines located on the different ESX4 hosts, besides some basic memory and CPU testing I was really interested in the performance difference between the E1000 and the VMXNET Generation 3 virtual network adapter.

The virtual machines are both connected to a virtual distributed switch configured with a community PVLAN, the servers are using dedicated physical Intel Pro PT-1000 adapters and are connected to a Cisco 2960 Catalyst switch. After running the test for 200 seconds you can see a performance benefit of 10% when using the VMXNET3 virtual adaptor compared to the E1000.

When both virtual machines are hosted on the same ESX server and only using the “left side” of the distributed virtual switch the network performance is 300% faster. I know these network graphs show details of the TCP/IP network transfer speed (in kilobits / sec) over short period of time and are not really representative, the average network speed may be limited by the LAN card, the CPU or network infrastructure such as firewalls and switches. But I’ve learned two lessons, the VMXNET3 is faster and local ESX traffic outperforms external traffic by 300%.

This week I’ve delivered another smashing VMware vSphere Design Workshop :-) During the last day there was a great discussion about IP storage. Hans Booms who attended the workshop pulled out an overview of performance measurements he did on an EqualLogic PS6000XV iSCSI SAN. It’s configured as RAID 10 with 12*15K SAS disks, the ESX 4.01 host is configured with Round Robin and uses 4 NICs and IOmeter is running in a Windows 2008 virtual machine.

Blocksize: 64 K
100 % Random access
80% write / 20% read

Blocksize: 64 K
100 % Random access
20% write / 80% read

Blocksize: 64 K
100 % sequential access
100% read / 0% write

Last week Chad Sakac over at Virtual Geek has released the news about the availability of the EMC CelerraVSA Version 5.6.48.701.

What’s new:

•New OVA packaging, configuration for latest VMware tools and pvSCSI config – note this makes it vSphere 4 only (the VMware Workstation versions are also provided)
•New dedupe/compression code (faster, better, stronger)
•New VM-level hardware-accelerated fast clone (snapshot) and full clone (clone)
•Support for the new vSphere NFS Plugin.
•Better performance with less CPU, memory constrained configs
•Fixed issue in the 5.6.47.11 version that made eth2 not work right.
•And much, much more!!!

I’ve downloaded the CelerraVSA OVA and deployed this virtual storage appliance within my vSphere 4 environment on SSD storage but it doesn’t seem to make a big difference compared to deploying it local at SATA storage. I also added an 8 GB virtual disk to one of my existing virtual machines, the 8 GB disk is hosted at the EMC CelerraVSA which is connected trough iSCSI to one of the other ESX servers so the iSCSI data flows through the dedicated iSCSI network.

I did some tests with HDtunepro to find out what this Virtual Storage Appliance is up to and it’s looks to perform reasonable well for a VSA. Compared to a local SATA disk it’s about 10 times slower so it‘s not very fast but keep in mind that this is a full Celerra Simulator and can be used to familiarize yourself with all the great features like dedupe and replication. Besides that, it’s fully equipped with everything you need to build an SRM4 setup in a box.

I've stumbled upon a great presentation created by Nicholas Travers who works as a VMware Technology Consultant at EMC.  The presentation is called "Storage Protocol Choices & Storage Best Practices for VMware ESX" and deals with storage considerations like:

• How many VMs per LUN?
• Standard LUN Size?
• NFS, RDM or VMFS?
• iSCSI, or FC?
• How do I scale iSCSI and NFS?
• Queue Depths?
• I need a 3TB LUN... How?
• Why do I need multi-pathing?
• I need SRM support... How?

The presentation can be downloaded from: Storage Protocol Choices & Storage Best Practices for VMware ESX

It’s possible to configure the ESX host's virtual switches so the Cisco Discovery Protocol on a standard or distributed switch is issuing broadcasts containing some of your ESX host's information. After enabling the CDP on your ESX server, the Cisco administrator is able to listen for information broadcasted by your ESX host but what can he actually see? To find out I’ve installed the Tallsoft’s Cisco CDP Monitor on my vCenter server.

With Cisco CDP Monitor, you can display the information of the connecting Cisco devices, such as device names, device models, connecting port , administrative ip address, IOS version, VTP Domain Name, and so on. With this information, one could easily learn the total topology of the complete network and do troubleshooting. Once the Cisco Discovery Protocol information changes (such as the link or device failed, or the setup of Cisco device changed), Cisco CDP Monitor will detect it and will display the related info. It also shows information broadcasted by you ESX servers.

Virtual switches can be configured for four different CDP modes of operation:

Down – CDP information is neither sent nor received
Listen – CDP information is received from the physical switches
Advertise – CDP information is sent to the physical switches
Both – CDP information is sent to and received from the physical switches

For enabling CDP on standard switches you have to use command-line interface. CDP can be enabled on distributed switches using the vSphere Client. Here’s the info I was able to retrieve from an ESX host after running  “esxcfg-vswitch -B both vSwitch0” in the service console.

Neigbour1:
device id: esx4-l.ntpro.local
ipaddress: 0.0.0.0
port: vmnic0
capabilities: Switch  
ios_version: Releasebuild-208167
platform: VMware ESX
prefix: 
vtp_domain: 
native_vlan: 
duplex: full

This is a song by Varrowinc told in first person from the perspective of a physical server that has been virtualized by vSphere. This was done on an iPhone with I am T-pain App.