Short-Take: New Oracle/Sun ZFS Goodies

I wanted to pass-on some information posted by Joerg Moellenkamp at c0t0d0s0.org - some good news for Sun/ZFS users out there about Solaris Express 2010.11 availability, links to details on ZFS encryption features in Solaris 11 Express and clarification on "production use" guidelines. Here's the pull quotes from his posting:

"Darren (Moffat) wrote three really interesting articles about ZFS encryption: The first one is Introducing ZFS Crypto in Oracle Solaris 11 Express. This blog entry gives you a first overview how to use encryption for ZFS datasets. The second one..."

-  Darren Moffat about ZFS encryption, c0t0d0s0.org, 11-16-2010

"There is a long section in the FAQ about licensing and production use: The OTN license just covers development, demo and testing use (Question 14) . However you can use Solaris 11 Express on your production system as well..."

- Solaris 11 Express for production use, c0t0d0s0.org, 11-16-2010

"A lot of changes found their way into the newest release of Solaris, the first release of Oracle Solaris Express 2010.11. The changes are summarized in a lengthy document, however..."

- What's new for the Administrator in Oracle Solaris  Express 2010.11, c0t0d0s0.org, 11-15-2010

Follow the links to Joerg's blog for more details and links back to the source articles. Cheers!

Short-Take: SQL Performance Notes

Here are some Microsoft SQL performance notes from discussions that inevitably crop-up when discussing SQL storage:

1. Where do I find technical resources for the current version of MS SQL?


2. I'm new to SQL I/O performance, how can I learn the basics?


3. The basics talk about SQL 2000, but what about performance considerations due to changes in SQL 2005?


4. How does using SQL Server 6.x versus SQL Server 7.0 and change storage I/O performance assumptions?


5. How does TEMPDB affect storage (and memory) requirements and architecture?


6. How does controller and disk caching affect SQL performance and data integrity?


7. How can I use NAS for storage of SQL database in a test/lab environment?


8. What additional considerations are necessary to implement database mirroring in SQL Server?


9. When do SQL dirty cache pages get flushed to disk?


10. Where can I find Microsoft's general reference sheet on SQL I/O requirements for more information?

From performance tuning to performance testing and diagnostics:

1. I've heard that SQLIOStress has been replaced by SQLIOSim: where can I find out about SQLIOSim to evaluate my storage I/O system before application testing?


2. How do I diagnose and detect "unreported" SQL I/O problems?


3. How do I diagnose stuck/stalled I/O problems in SQL Server?


4. What are Bufwait and Writelog Timeout messages in SQL Server indicating?


5. Can I control SQL Server checkpoint behavior to avoid additional I/O during certain operations?


6. Where can I get the SQLIO benchmark tool to assess the potential of my current configuration?

That should provide a good half-day's reading for any storage/db admin...

Quick-Take: vSphere 4, Now with SUSE Enterprise Linux, Gratis

Earlier this month VMware announced that it was expanding its partnership with Novell in order to offer a 1:1 CPU enablement license for SLES. Mike Norman's post at VirtualizationPractice.com discusses the potential "darker side" of the deal, which VMware presents this way:

VMware and Novell are expanding their technology partnership to make it easier for customers to use SLES operating system in vSphere environments with support offerings that will help your organization:

• Reduce the cost of maintaining SLES in vSphere environments


• Obtain direct technical support from VMware for both vSphere and SLES


• Simplify your purchasing and deployment experience

In addition, VMware plans to standardize our virtual appliance-based products on SLES for VMware further simplifying the deployment and ongoing management of these solutions.

• Customers will receive SLES with one (1) entitlement for a subscription to patches and updates per qualified VMware vSphere SKU. For example, if a customer were to buy 100 licenses of a qualified vSphere Enterprise Plus SKU, that customer would receive SLES with one hundred (100) entitlements for subscription to patches and updates.


• Customers cannot install SLES with the accompanying patches and updates subscription entitled by a VMware purchase 1) directly on physical servers or 2) in virtual machines running on third party hypervisors.


• Technical support for SLES with the accompanying patches and updates subscription entitled by a VMware purchase is not included and may be purchased separately from VMware starting in 3Q 2010.

- VMware Website, 6/2010

The part about standardization has been emphasized by us - not VMware - but it seems to be a good fit with VMware's recent acquisition of Zimbra (formerly owned by Yahoo!) and the release of vSphere 4.1 with "cloud scale" implications. That said, the latest version of the VMware Data Recovery appliance has been recast from RedHat to CentOS with AD integration, signaling that it will take some time for VMware to transition to Novell's SUSE Linux.

SOLORI's Take: Linux-based virtual appliances are a great way to extend features and control without increasing license costs. Kudus to VMware for hopping on-board the F/OSS train. Now where's my Linux-based vCenter with a Novell Directory Services for Windows alternative to Microsoft servers?

NexentaStor CIFS Shares with Active Directory Authentication

Sharing folders in NexentaStor is pretty easy in Workgroup mode, but Active Directory integration takes a few extra steps.  Unfortunately, it's not (yet) as easy as point-and-click, but it doesn't have to be too difficult either. (The following assumes/requires that the NexentaStor appliance has been correctly configured-in and joined-to Active Directory.)

[caption id="attachment_1562" align="alignright" width="170" caption="Typical user and group permissions for a local hard disk in Windows."][/caption]

Let's examine the case where a domain admin group will have "Full Control" of the share, and "Everyone" will have read/execute permissions. This is a typical use case where a single share contains multiple user directories under administrative control. It's the same configuration as local disks in a Windows environment. For our example, we're going to mimic this setup using a CIFS share from a NexentaStor CE appliance and create the basic ACL to allow for Windows AD control.

For this process to work, we need to join the NexentaStor appliance to the Active Directory Domain. The best practice is to create the machine account in AD first, assign control user/group rights (if possible) and then attempt to join. It is IMPORTANT that the host name and DNS configuration of the NexentaStor appliance match domain norms, or things will come crashing to a halt pretty quickly.

That said, assuming that your DC is 1.1.1.1 and your BDC is 1.1.1.2 with a "short" domain of "SOLORI" and a FQDN of "SOLORI.MSFT" your NexentaStor's name server configuration (Settings->Network->Name Servers) would look something like this:

This is important because the AD queries will pull service records from the configured domain name servers. If these point to an "Internet" DNS server, the AD entries may not be reflected in that server's database and AD authentication (as well as join) will fail.

The other way the NexentaStor appliance knows what AD Domain to look into is by its own host name. For AD authentication to work properly, the NexentaStor host name must reflect the AD domain. For example, if the FQDN of your AD domain is "SOLORI.MSFT" then your domain name on the appliance would be configured like this (Appliance->Basic Settings->Domainname):

The next step is to create the machine account in AD using "Active Directory Users and Computers" administrator's configuration tool. Find your domain folder and right-click "Computers" - select New->Computer from the menu and enter the computer name (no domain). The default user group assigned to administrative control should be Domain Admins. Since this works for our example, no changes are necessary so click "OK" to complete.

Now it's time to join the AD domain from NexentaStor. Any user with permissions to join a machine to the domain will do. Armed with that information, drill down to Data Management->Shares->CIFS Server->Join AD/DNS Server and enter the AD/DNS server. AD server, AD user and user password into the configuration box:

If your permissions and credentials are good, your NexentaStor appliance is not a member of your domain. As such, it can now identify AD users and groups by unique gid and uid data created from AD. This gid and uid information will be used to create our ACLs for the CIFS share.

To uncover the gid for the "Domain Admins" and "Domain Users" groups, we issue the following from the NexentaStor NMC (CLI):

nmc@san01:/$ idmap dump -n | grep "Domain Admins"

wingroup:Domain Admins@solori.msft     ==      gid:3036392745

nmc@san01:/$ idmap dump -n | grep "Domain Users"
wingroup:Domain Users@solori.msft     ==      gid:1238392562

Now we can construct a CIFS share (with anonymous read/write disabled) and apply the Domain Admin gid to an ACL - just click on the share, and then click "(+) Add Permissions for Group":

[caption id="attachment_1568" align="aligncenter" width="300" caption="Applying administrative permissions with the AD group ID for Domain Admins."][/caption]

We do similarly with the Domain User gid:

[caption id="attachment_1569" align="aligncenter" width="300" caption="Applying the Domain User gid to CIFS share ACL."][/caption]

Note that the "Domain Users" group gets only "execute" and "read" permissions while the "Domain Admins" group gets full control - just like the local disk! Now, with CIFS sharing enabled and the ACL suited to our AD authentication, we can access the share from any domain machine provided our user is in the Domain Users or Admins group.

Administrators can now create "personal" folders and assign detailed user rights just as they would do with any shared storage device. The only trick is in creating the initial ACL for the CIFS share - as about - and you've successfully integrated your NexentaStor appliance into you AD domain.

NOTE: If you're running Windows Server 2008 (or SBS 2008) as your AD controller, you will need to update the share mode prior to joining the domain using the following command (from root CLI):

# sharectl set -p lmauth_level=2 smb

NOTE: I’ve also noticed that, upon reboot of the appliance (i.e. after a major update of the kernel/modules) your ephemeral id mapping takes some time to populate during which time authentication failures to CIFS shares can fail. This appears to have something to do with the state of ephemeral-to-SID mapping after re-boot.

To enable the mapping of unresolvable SIDs, do the following:

$ svccfg -s idmap setprop config/unresolvable_sid_mapping = boolean: true
$ svcadm refresh idmap

Microsoft Update Kills vSphere Client

Got a problem running vSphere Client today? Seeing the following pop-up when trying to access your VMware stack?

Login doesn't really continue, but in fact, ends with the following error:

Your environment has not been hacked! It's a problem with your most recent Windows Update, introducing a .NET exception that your "old" version of VMware vSphere Client can't handle. While you can uninstall the offending patch(es) to resolve the problem, the best remedy is to login to VMware's site and download the latest vSphere Client (VMware KB 1022611).

By the way, if you're vSphere Client is old enough to be affected (prior to Update 1), you might need to scan your vSphere environment for updates too. If you have SnS, run over to VMware's download page for vSphere and get the updated packages, starting with the vSphere Client: you can find the installable Client package with the vCenter Server Update 2 downloads.

vSphere, Hardware Version 7 and Hot Plug

VMware's vSphere added hot plug features in hardware version 7 (first introduced in VMware Workstation 6.5) that were not available in the earlier version 4 virtual hardware. Virtual hardware version 7 adds the following new features to VMware virtual machines:

• LSI SAS virtual device - provides support for Windows Server 2008 fail-over cluster configurations


• Paravirtual SCSI devices - recently updated to allow booting, can allow higher-performance (greater throughput and lower CPU utilization) than the standard virtual SCSI adapter - especially in SAN environments where I/O-intensive applications are used. Currently supported in Windows Server 2003/2008 and Red Hat Linux 5 - although any version of Linux could be modified to support PVSCSI.


• IDE virtual device - useful for older OSes that don't support SCSI drivers


• VMXNET 3 - next generation Vmxnet device with enhanced performance and enhanced networking features.


• Hot plug virtual devices, memory and CPU - supports hot add/remove of virtual devices, memory and CPU for supported OSes.

While the "upgrade" process from version 4 to version 7 is well-known, some of the side effects are not well publicised. The most obvious change after the migration from version 4 to version 7 is the affect hot plug has on the PCI bus adapters - some are now hot plug by default, including the network adapters!

[caption id="attachment_1342" align="aligncenter" width="417" caption="Safe to remove network adapters. Really?"][/caption]

Note that the above example demonstrates also that the updated hardware re-enumerates the network adapters (see #3 and #4) because they have moved to a new PCI bus - one that supports hot plug. Removing the "missing" devices requires a trip to device manager (set devmgr_show_nonpresent_devices=1 in your shell environment first.) This hot plug PCI bus also allows for an administrator to mistakenly remove the device from service - potentially disconnecting tier 1 services from operations (totally by accident, of course.

[caption id="attachment_1340" align="aligncenter" width="450" caption="Devices that can be added while the VM runs with hardware version 4"][/caption]

In virtual hardware version 4, only SCSI devices and hard disks were allowed to be added to a running virtual machine. Now with hardware version 7,

[caption id="attachment_1341" align="aligncenter" width="450" caption="Devices that can be added while the VM runs with hardware version 7"][/caption]

additional devices (USB and Ethernet) are available for hot add. You could change memory and CPU on the fly too, if the OS supports that feature and they are enabled in the virtual machine properties prior to running the VM:

[caption id="attachment_1339" align="aligncenter" width="450" caption="CPU and Memory Hot Plug Properties"][/caption]

However, the hot plug NIC issue isn't discussed in the documentation, but Carlo Costanzo at VMwareInfo.com passes on Chris Hahn's great tip to disable hot plug behaviour in his blog post complete with visual aids. The key is to add a new "Advanced Configuration Parameter" to the virtual machine configuration: this new parameter is called "devices.hotplug" and its value should be set to "false." However, adding this parameter requires the virtual machine to be turned-off, so it is currently an off-line fix.

Quick Take: Red Hat and Microsoft Virtual Inter-Op

This week Red Hat and Microsoft announced support of certain of their OSes as guests in their respective hypervisor implementations: Kernel Virtual Machine (KVM) and Hyper-V, respectively. This comes on the heels of Red Hat's Enterprise Server 5.4 announcement last month.

KVM is Red Hat's new hypervisor that leverages the Linux kernel to accelerate support for hardware and capabilities. It was Red Hat and AMD that first demonstrated live migration between AMD and Intel-based hypervisors using KVM late last year - then somewhat of a "Holy Grail" of hypervisor feats. With nearly a year of improvements and integration into their Red Hat Enterprise Server and Fedora "free and open source" offerings, Red Hat is almost ready to strike-out in a commercially viable way.

Microsoft now officially supports the following Red Hat guest operating systems in Hyper-V:

Red Hat Enterprise Linux 5.2, 5.3 and 5.4

Red Hat likewise officially supports the following Microsoft quest operating systems in KVM:

Windows Server 2003, 2008 and 2008 R2

The goal of the announcement and associated agreements between Red Hat and Microsoft was to enable a fully supported virtualization infrastructure for enterprises with Red Hat and Microsoft assets. As such, Microsoft and Red Hat are committed to supporting their respective products whether the hypervisor environment is all Red Hat, all Hyper-V or totally heterogeneous - mixing Red Hat KVM and Microsoft Hyper-V as necessary.

"With this announcement, Red Hat and Microsoft are ensuring their customers can resolve any issues related to Microsoft Windows on Red Hat Enterprise Virtualization, and Red Hat Enterprise Linux operating on Microsoft Hyper-V, regardless of whether the problem is related to the operating system or the virtualization implementation."

- Red Hat press release, October 7, 2009

Many in the industry cite Red Hat's adoption of KVM as a step backwards [from Xen] requiring the re-development of significant amount of support code. However, Red Hat's use of libvirt as a common management API has allowed the change to happen much more rapidly that critics assumptions had allowed. At Red Hat Summit 2009, key Red Hat officials were keen to point out just how tasty their "dog food" is:

Tim Burke, Red Hat's vice president of engineering, said that Red Hat already runs much of its own infrastructure, including mail servers and file servers, on KVM, and is working hard to promote KVM with key original equipment manufacturer partners and vendors.

And Red Hat CTO Brian Stevens pointed out in his Summit keynote that with KVM inside the Linux kernel, Red Hat customers will no longer have to choose which applications to virtualize; virtualization will be everywhere and the tools to manage applications will be the same as those used to manage virtualized guests.

- Xen vs. KVM, by Pam Derringer, SearchDataCenter.com

For system integrators and virtual infrastructure practices, Red Hat's play is creating opportunities for differentiation. With a focus on light-weight, high-performance, I/O-driven virtualization applications and no need to support years-old established processes that are dragging on Xen and VMware, KVM stands to leap-frog the competition in the short term.

SOLORI's Take: This news is good for all Red Hat and Microsoft customers alike. Indeed, it shows that Microsoft realizes that its licenses are being sold into the enterprise whether or not they run on physical hardware. With 20+:1 consolidation ratios now common, that represents a 5:1 license to hardware sale for Microsoft, regardless of the hypervisor. With KVM's demonstrated CPU agnostic migration capabilities, this opens the door to an even more diverse virtualization infrastructure than ever before.

On the Red Hat side, it demonstrates how rapidly Red Hat has matured its offering following the shift to KVM earlier this year. While KVM is new to Red Hat, it is not new to Linux or aggressive early adopters since being added to the Linux kernel as of 2.6.20 back in September of 2007. With support already in active projects like ConVirt (VM life cycle management), OpenNebula (cloud administration tools), Ganeti, and Enomaly's Elastic Computing Platform, the game of catch-up for Red Hat and KVM is very likely to be a short one.

vSphere Client in Windows7

Until there is an updated release of the VMware vSphere Client, running the client on a Windows7 system will require a couple of tricks. While the basic process outlined in these notes accomplishes the task well, the use of additional "helper" batch files is not necessary. By adding the path to the "System.dll" library to your user's environment, the application can be launched from the standard icon without further modification.

First, add the XML changes at the end of the "VpxClient.exe.config" file. The end of your config file will now look something like this:

  <runtime>
    <developmentMode developerInstallation="true"/>
  </runtime>
</configuration>

Once the changes are made, save the "VpxClient.exe.config" file (if your workstation is secured, you may need "Administrator" privileges to save the file.) Next, copy the "System.dll" file from the "%WINDOWS%\Microsoft.NET\Framework\v2.0.50727" folder on an XP/Vista machine to a newly created "lib" folder in the VpxClient's directory. Now, you will need to update the user environment to reflect the path to "System.dll" to complete the "developer" hack.

To do this, right-click on the "Computer" menu item on the "Start Menu" and select "Properties." In the "Control Panel Home" section, click on "Advanced system settings" to open the "System Properties" control panel. Now, click on the "Environment Variables..." button to open the Environment Variables control panel. If "DEVPATH" is already defined, simply add a semi-colon (";") to the existing path and add the path to your copied "System.dll" file (not including "System.dll") to the existing path. If it does not exist, create a new variable called "DEVPATH" and enter the path string in the "Variable Value" field.

The path begins with either %ProgramFiles% or %ProgramFiles(x86)% depending on whether or not 32-bit or 64-bit Windows7 is installed, respectively. Once the path is entered into the environment and the "System.dll" file is in place, the vSphere Client will launch and run without additional modification. Remember to remove the DEVPATH modification to the environment when a Windows7 vSphere Client is released.

Note that this workaround is not supported by VMware and that the use of the DEVPATH variable could have unforseen consequences in your specific computing environment. Therefore, appropriate considerations should be made prior to the implementation of this "hack." While SOLORI presents this information "AS-IS" without warranty of any kind, we can report that this workaround is effective for our Windows7 workstations, however ...

Red Hat Enterprise Virtualization Strategy

Red Hat's recently updated virtualization strategy has resulted in an "oversubscribed" beta program. The world leader in open source solutions swings a big stick with its kernel-based virtualization products. Some believe one of the keys to successful large scale cloud initiatives is an open source hypervisor, and with Xen going commercial, turning to the open source veteran Red Hat seems a logical move. You may recall that Red Hat - using KVM - was the first to demonstrate live migration between AMD and Intel hosts.

"We are very pleased by the welcome we have received from enterprise companies all over the world who are looking to adopt virtualization pervasively and value the benefits of our open source solutions. Our Beta program is oversubscribed. We are excited to be in a position to deliver a flexible, comprehensive and cost-effective virtualization portfolio in which products will share a consistent hardware and software certification portfolio. We are in a unique position to deliver a comprehensive portfolio of virtualization solutions, ranging from a standalone hypervisor to a virtualized operating system to a comprehensive virtualization management product suite."

- Scott Crenshaw, vice president, Platform Business Unit at Red Hat

Red Hat sees itself as an "agent of change" in the virtualization landscape and wants to deliver a cost effective "boxed" approach to virtualization and virtualization management. All of this is hinged on Red Hat's new KVM-based approach - enabled through their acquisition of Qumranet in September 2008 - which delivers the virtualization and management layers to Red Hat's Enterprise Linux and its kernel.

Along with Qumranet came Solid ICE and SPICE. Solid ICE is the VDI component running on KVM consisting of a virtual desktop server and controller front end. Solid ICE allows Red Hat to rapidly enter the VDI space without disrupting its Eco-System. Additionally, the SPICE protocol (Simple Protocol for Independent Computing Environments) enables an standardized connection protocol alternative to RDP with enhancements for the VDI user experience.

Red Hat's SPICE claims to offer the following features in the enterprise:

• Superior graphics performance (e.g. flash)


• video quality (30+ frames per second)


• bi-directional audio (for soft-phones/IP phones)


• bi-directional video (for video telephony/ video conferencing)


• No specialized hardware. Software only client that can be automatically installed via Active-X and a browser on the client machine

Red Hat's virtualization strategy reveals more of it's capabilities and depth in accompanying blogs and white papers. Adding to the vendor agnostic migration capabilities, Red Hat's KVM is slated to support VM hosts to 96 cores and 1TB of memory with guests scaling to 16 vCPUs and 64GB of memory. Additional features include high availabitily, live migration, global system scheduler, global power saving (through migration and power down), memory page sharing, thin storage provisioning and SELinux security.

Quick Take: Installing Missing Packages with Zypper

OpenSuse 11.1 has added a nice touch for minimal installs: repository index to commands NOT installed. In a most client installations, we installed only minimal OS footprints to reduce size and  attack surface. In the past, this has meant a trip to YAST to install "needed" packages that were not installed initially. While this is no big deal for OpenSuse vets, it can be a bit of a learning curve for clients.

Enter the repository index. Now, when a "missing" executable is attempted, the index is searched for the package containing the executable and guidance is offered on how to install it (assuming repositories are setup correctly.) Here's a sample of how this works on a low attack surface DNS server missing a "whois" utility:

nsarpa:~ # whois supermicro.com

The program 'whois' can be found in the following package:
 * whois [ path: /usr/bin/whois, repository: zypp (openSUSE 11.1-0) ]

Try installing with: sudo zypper install whois

-bash: whois: command not found
nsarpa:~ # zypper install whois
Retrieving repository 'openSUSE-11.1-Update' metadata [done]
Building repository 'openSUSE-11.1-Update' cache [done]
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following NEW package is going to be installed:
 whois

Your Own, Personal Cloud

RightScale, the Computer Science Department at the University of California, Santa Barbar and Ubuntu are launching a tag-team assault on the cloud paradigm. Based on Xen infrastructures and Amazon EC2 control syntax (Amazon Web Services, AWS), the Eucalyptus platform is designed to be a work-alike, elastic cloud building block to promote private cloud confederations.

Starting with Ubuntu 9.04, RightScale will support private cloud management from their web management platform to your Eucalyptus cloud with registration built-into the Eucalyptus install. Why Ubuntu 9.04? Because it is the first distribution to ship with the Eucalyptus technology preview.

Billed as the "Ubuntu Enterprise Cloud" platform, the Ubuntu+Eucalyptus+RightScale triumvirate will allow emulate the EC2 environment and control the hardware build-out as well. Future updates will allow ServerTemplates and automation from RightScale, but this is a "preview" after all.

Some strong points about the Eucalyptus cloud:

• 2-4 times better TCP throughput than EC2


• AppScale (Google AppEngine) can deploy to it


• Runs on Xen and open source

Currently, there is no planned support for non-Linux operating systems, so Windows users will need to look to other technologies. However, if this project delivers, the air between public and private clouds could be getting a lot thinner.

Installing OpManage 8.0 on SLES 10 SP2

Network and device managers abound, but the OpManage platform from AdventNet keeps building features and capabilities. Unfortunately, their embrace of Windows and Linux installation choices leaves some in the lurch depending on the platform chosen.

Recently I took version 8.0 for a spin on a trimmed-down installation of SLES 10 SP2. As has been typical with this platform on Suse systems, there were some issues requiring resolution before OpManager was up an running. Fortunately, the issues were localized to the apache server that comes with OM8.

First up, in my trimmed-down install (minimal X-windows, no additional servers), no Apache was included as a SLES package (i.e. in an attempt to avoid package collision). This required the following changes to the SLES environment after OM8 installation:

create file: /etc/ld.so.cond.d/opmanage.conf
   edit, add:  /opt/AdventNet/ME/OpManager/apache/lib
run:  ldconfig

Next, trouble-shooting the remainder of the apache-related issues uncovered the following dependencies:

create link:  ln -s /usr/lib/libgdbm.so.3 /usr/lib/libgdbm.so.2
create link:  ln -s /usr/lib/libdb-4.3.so /usr/lib/libdb-3.2.so
create link:  ln -s /usr/lib/libexpat.so /usr/lib/libexpat.so.0

Once completed, test the service by issuing the following:

cd /opt/AdventNet/ME/OpManager/bin
run  ./StartOpManagerServer.sh

OpManager will point-out the service port you chose during installation. Remember SUSE's firewall services manager if you get stuck accessing OpManager from the "web client" - it is deny-all by default when enabled.

From the first 15-minutes with the new OpManager, it is clear that AdventNet has come a long way since the early days of the product. There are many new features and devices supported. Check it out for yourself if you're still shopping for a network/server monitoring system that runs nicely in a virtual machine...

Quick Take: Licensing Benefits of Virtualization

For some, the real licensing benefit of virtualization is a hidden entity. This is aided by some rather nebulous language in end user licenses from Microsoft and others.

Steve Kaplan, over at DABCC, has a brief and informative article on how licensing affects the deployment costs of virualized Microsoft products - sometimes offsetting the cost of the hypervisor costs in a VMware environment, for instance.

SOLORI's 1st take: the virtual data center has new ways to increase costs with equal or better offsets to speed ROI - especially where new initiatives are concerned. When in doubt, talk to your software vendor and press for clear information about implementation licensing costs.

SOLORI's 2nd take: Steve's report relies on Gartner's evaluation which is based on Microsoft policies that are outdated. For instance, Server 2003 R2 is NOT "the only edition that will allow the customer to run one instance in a physical operating system (OS) environment and up to four instances in virtual OS environments for one license fee." This also applies to Server 2008... (see Microsoft links).


Check out Steve's evaluation here. Also, see Microsoft's updated policy here and their current Server 2003 policies here.

SBS 2008 Panics, Needs IPv6

Remember how you were told to disable all unused applications and protocols when securing a compute environment? If you've been in networking for years - like I have - it's almost a reflex action. This is also more recently codified in PCI/DSS Section 2.2.2, right? It also seems like a really basic, logical approach. Apparently Microsoft doesn't think so. Apparently, there is a "somewhat artificial albeit deeply ingrained" dependency on IPv6 in Windows Server 2008.

2.2.2 Disable all unnecessary and insecure services and protocols (services and protocols not directly needed to perform the device’s specified function).

- PCI Security Standards Council

Considering the lackluster adoption rate of IPv6 in the Internet domain, it is hard to argue that IPv6 on the local network is a new requirement. Given that most system administrators have enough difficulty understanding IPv4 networks, a dependency on IPv6 seems both premature and an unnecessary complexity.

Corollary: Disabling IPv6 Kills SBS 2008

Simply disabling IPv6 at the network card level carries no dire warning. Services continue to function properly with no warnings or klaxon calls. However, a reboot tells a different story: the absence of IPv6 KILLS a myriad of service on reboot.

Virtualizing Microsoft Small Business Server 2008

Microsoft Small Business Server 2008 appears to be a good option for "Microsoft shops" looking to consolidated Active Directory Domain Controller, Windows Update Services, Security and Virus Protection, SharePoint and Exchange functions on a single server. In practice, however, it takes a really "big" server to support this application – even for a very small office environment.

According to Microsoft's system requirements page a target system will need a 2GHz core, 4GB of RAM and 60GB of disk space to be viable (minimum). As with past experiences with Microsoft's products, this “minimum system specification” is offered as a “use this only if you want to under-perform horribly as to be unusable” configuration.

In reality, a single-user, clean installation with two 2.3GHz cores and 4GB of RAM committed to the installation, the server struggles with the minimum amount of memory. The “real” minimum should have been specified as 6GB instead of the optimistic 4GB. Where does the memory go?

It appears that Microsoft Exchange-related memory utilization weighs in at over 1.2GB (including 600MB for “store.exe”). Another 1.2GB is consumed by IIS, SharePoint and SQL. Forefront Client Security-related memory usage is around 1GB all by itself. That's 3.4GB of “application space” drag in Windows Small Business Server 2008. Granted, the “killer app” for SBS is Exchange 2007 and some might argue SharePoint integration as well, so the use of the term “drag” may not be appropriate. However, let's just agree that 4GB is a ridiculously low (optimistic) minimum.