Zeros & Ones

Free e-book on Microsoft Virtualization

Fawzi — Thu, 18 Feb 2010 04:15:00 GMT

“Microsoft has a broad portfolio of Virtualization technologies and you talk about the concept of ‘from the Desktop to the datacenter’; what does that really mean?”

The short answer is that there are many ways to approach virtualization, depending on what you and your business actually needs. There is no ‘one size fits all’. The challenge is first understanding what you are trying to achieve, then leveraging the right technology to make it happen.

The longer and infinitely more detailed answer can also be found in a book written by a friend of mine and Microsoft MVP, Mitch Tulloch. As it happens, his e-book entitled ‘Understanding Microsoft Virtualization Solutions’ (ISBN: 9780735693371) is being made available as a free download until the end of February 2010 here.

Understanding Microsoft Virtualization Solutions

By Mitch Tulloch with the Microsoft Virtualization Teams
ISBN: 9780735693371

This guide will teach you about the benefits of the latest virtualization technologies and how to plan, implement, and manage virtual infrastructure solutions. The technologies covered include: Windows Server 2008 Hyper-V, System Center Virtual Machine Manager 2008, Microsoft Application Virtualization 4.5, Microsoft Enterprise Desktop Virtualization, and Microsoft Virtual Desktop Infrastructure.

As it happens, his new book (out today – Feb 17th 2010) is called Understanding Microsoft Virtualization R2 Solutions.

Vulnerability in Windows Server 2008 Hyper-V Could Allow Denial of Service

Fawzi — Fri, 12 Feb 2010 16:57:00 GMT

This security update resolves a privately reported vulnerability in Windows Server 2008 Hyper-V and Windows Server 2008 R2 Hyper-V. The vulnerability could allow denial of service if a malformed sequence of machine instructions is run by an authenticated user in one of the guest virtual machines hosted by the Hyper-V server. An attacker must have valid logon credentials and be able to log on locally into a guest virtual machine to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Source: Microsoft Security Bulletin

VMM Tricks: Manage VMM in restrictive Active Directory environment

Fawzi — Fri, 12 Feb 2010 16:55:00 GMT

So you want to manage your VMM infrastructure while keeping an eye on your Hyper-V hosts security. looks like everyone wants to do that. So have you through before about using restricted Group group policy to limit membership for your local admins group.

let’s have a look at when to use a domain account for the VMM Service. In a restrictive Active Directory environment in which restricted Group group policy is in effect, we must use a domain account instead of Local System for the VMM service account. The Restricted Groups policy does not allow machine accounts to be a member of the local Administrators group. Under a Restricted Groups group policy, the VMM machine account will be removed from the computer, leaving VMM unable to communicate with the host. In that situation, VMM places the host in a Needs Attention state and places the VMM agents on hosts and library servers in Not Responding status in VMM.

For our “Restricted Group group policy” issue, we have two methods to fix it.

Method one

==========

Add the VMM Server machine account to the Administrators “restricted groups” group policy setting. But if a Restricted Groups policy is defined and Group Policy is refreshed, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators.

Note To add the VMM Server machine account to the restricted group setting, use the following syntax:

domainname\severname$

Method two

=========

Create a new organizational unit in the domain, move the Virtual Server and Hyper-V Server computer objects to the new OU and then configure the new organizational unit to block policy inheritance.

There are some articles which indicate the restricted group:

Updates to Restricted Groups (“Member of”) behavior of user-defined local groups

http://support.microsoft.com/kb/810076/en-us#appliesto

Restricted Groups

http://technet.microsoft.com/en-us/library/cc785631(WS.10).aspx

Restricted Groups Policy Settings

http://technet.microsoft.com/en-us/library/cc756802(WS.10).aspx

Thanks Alex to help in that.

Hyper-V tricks:Increase VMBus buffer sizes to increase network throughput to guest VMs

Fawzi — Fri, 12 Feb 2010 16:55:00 GMT

The Windows Server Performance team have done a really interesting post on how to optimize network performance inside of virtual machines by increasing the size of the VMBus buffers used by our network adapters.

You can found it there

http://blogs.technet.com/winserverperformance/archive/2010/02/02/increase-vmbus-buffer-sizes-to-increase-network-throughput-to-guest-vms.aspx

Under load, the default buffer size used the by the virtual switch may provide inadequate buffer and result in packet loss. We recommend increasing the VM bus receive buffer from 1Mb to 2Mb.

Traffic jams happen every day, all across the world. Too many vehicles competing for the same stretch of road, gated by flow control devices like stop signs and traffic lights, conspire to ensnare drivers in a vicious web of metal and plastic and cell phones. In the technology world, networking traffic is notoriously plagued by traffic jams, resulting in all sorts of havoc, including delayed web pages, slow email downloads, robotic VOIP and choppy YouTube videos. (Oh, the humanity!)

Virtualized networking can be complicated, what with the root and child partitions relaying packets across the VM bus to reach the physical NIC. The VM bus, anticipating contention, uses buffers to queue data while the recipient VM is swapped out or otherwise not keeping up with the traffic. The default buffer size for WS08 R2 is 1Mb, which provides 655 packet buffers (1,600 bytes per buffer).

The hypervisor, meanwhile, calculates a scheduling interval, or quantum, derived from the system’s interrupt rate. The hypervisor attempts to ensure every VM has a chance to run within that interval, at which time the VM wakes up and does whatever processing it needs to do (including reading packets from the VM bus). At very low interrupt rates, that quantum can be nearly 10ms.

Whereas the native system handles on the order of 260,000 packets/second, virtualized systems, in some scenarios, can—in the worst case scenario—begin seeing packet loss under traffic loads as low as 65,500 packets/second. This isn’t an inherent tax incurred by virtualizing or a design limit; rather, it’s the result of specific characteristics of server load requiring more VM bus buffer capacity. If the logical processors hosting the guest partitions are receiving very few hardware interrupts, then scheduling quantum grows larger, approaching 10ms. The longer scheduling quantum results in longer idle periods between VM execution slices. If the VM is going to spend almost 10ms asleep, then the VM bus’ packet buffers must be able to hold 10ms worth of data. As the idle time for a VM approaches 10ms, the maximum sustainable networking speed can be calculated as:

655 default packet buffers / ~10ms idle interval = maximum 65,500 packets / second

We can increase throughput, though, by increasing the amount of memory allocated to the buffers. How much should it be increased? On paper, 4Mb is the maximum useful size; a 4Mb buffer provides about 2600 buffers, which can handle 10ms’ worth of data flowing at approximately 260,000 packets per second (the max rate sustainable by native systems). In reality, depending on the workload, the VM’s swapped-out time probably doesn’t approach the maximum 10ms quantum. Therefore, depending on how frugal you want to be with memory, increasing to 2 Mb is probably adequate for most scenarios. If you’re living large in the land of RAM, lighting your cigars by burning 4Gb memory sticks, then go for broke, cranking the buffers up to 4Mb.

The buffers are allocated from the guest partition’s memory and updating the buffer size requires, per each guest VM, adding two registry keys. To increase the buffer size, we first need the GUID and index associated with the network adapter. In the guest VM, open the Device Manager, expand Network Adapters , right click Microsoft Virtual Machine Bus Network Adapter and choose Properties (if you have an a driver marked “(emulated)”, you should take a detour to install Integration Services from the VM’s Action menu, then add a new synthetic network driver through the VM setup. See http://technet.microsoft.com/en-us/library/cc732470(WS.10).aspx , step 3 for instructions).

On the Network Adapter Properties dialog, select the Details tab. Select Driver Key in the Property pull-down menu as shown in figure 1 (click the images to see a version that’s actually readable):

Record the GUID\index found in the Value box, as shown in figure 1, above. Open regedit and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{GUID}\{index} as shown in figure 2:

Right click the index number and create two new DWORD values, entitled ReceiveBufferSize and SendBufferSize (see figure 3). These values measure the memory allocated to buffers in 1Kb units. So, 0×400 equates to 1,024Kb buffer space (the default, 640 buffers). In this example, we’ve doubled the buffer size to 0×800, or 2,048Kb of memory, as shown in figure 3:

Your workloads and networking traffic may not need increased buffers; however, these days, 4Mb of RAM isn’t a tremendous amount of memory to invest as an insurance policy against packet loss. Now, if only I could increase a few buffers and alleviate congestion on my daily commute!

Tom Basham

Virtualization Performance PM, Windows Fundamentals Team

Linux Integration Components for Windows Server 2008 Hyper-V R2

Fawzi — Fri, 05 Feb 2010 10:31:00 GMT

When installed in a supported Linux virtual machine running on Hyper-V, the Linux Integration Components provide.

Driver support for synthetic devices: The Linux integration components include support for both the synthetic network controller and synthetic storage controller that have been developed specifically for Hyper-V. These components take advantage of the new high-speed bus, VMBus, which was developed for Hyper-V.

Fastpath Boot Support: Boot devices now take advantage of the storage VSC to provide enhanced performance.

Supported Host Operating Systems
This version of the Linux Integration Components supports the following versions of Hyper-V:
- Windows Server® 2008 Standard, Windows Server® 2008 Enterprise, and Windows Server® 2008 Datacenter (64-bit versions only)
- Microsoft® Hyper-V Server 2008
- Windows Server 2008 R2 Hyper-V RTM (Build 7600) Standard, Enterprise, and Datacenter
-Microsoft Hyper-V Server 2008 R2 RTM (Build 7600)

Supported Guest Operating Systems
This version of the Linux Integration Components supports the following guest operating systems and virtual CPU (vCPU) configurations:
-SUSE Linux Enterprise Server 10 SP2 x86 and x64 (1 vCPU)
-SUSE Linux Enterprise Server 11 x86 and x64 (1 vCPU)
-Red Hat Enterprise Linux 5.2, 5.3, and 5.4 x86 and x64 (1 vCPU)

To download Linux Integration component version 2, please click this link:-
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=c299d675-bb9f-41cf-b5eb-74d0595ccc5c#filelist

SQL Server Consolidation with Microsoft Virtualization

Fawzi — Fri, 29 Jan 2010 21:19:00 GMT

Source

Hello, my name is Vipul Shah and I’m a Senior Product Manager with the Virtualization Team.

Due to its ability to drive down costs and drive up resource usage, Microsoft SQL Server consolidation is top of mind for our customers these days. Microsoft virtualization, which includes Windows Server 2008 R2 Hyper-V and System Center, is one of the well known mechanisms to enable this. Today, Ted Kummert, Senior Vice President, Microsoft Business Platform Division, released a video (click here) that outlines how virtualization enables consolidation.

So the natural question is – can we achieve higher amounts of throughput as we consolidate? Can we improve the throughput with recent advances in hardware and the recent release of Windows Server 2008 R2 Hyper-V?

To address this, we recently performed tests that are discussed in the Best Practices for SQL Server Virtualization webcast (click here) and in the SQL Server Consolidation Guidance (click here).

In our tests, we ran a complex stock trading application workload on servers with Second Level Address Translation (SLAT). In physical environments, the operating system translates virtual memory addresses to physical addresses. However with virtualization, we have an additional translation (the second level address translation) because you are running operating systems within virtual machines. This means additional CPU cycles are spent doing this translation. The SLAT enabled processors complete this translation within the silicon, leading to performance advantage compared with non-SLAT enabled CPUs. You get these processors from both Intel and AMD.

We chose a 16-core HP DL585 server with SLAT-enabled AMD processors with HP EVA 8000 storage running Windows Server 2008 R2 Hyper-V. We created virtual machines (VM) each with 4 virtual processors and 7 GB RAM using a fixed-sized VHD format. We started to run our workload with one VM and gradually increased the load, adding more VMs as we went along. We found that we were able to increase the throughput with consolidation. The workload scaled near-linearly up to 4 VMs consuming all of the physical cores on the server (16 cores total). Then we added even more VMs, consolidating up to 8 VMs. We over-committed virtual-processors to physical-cores ratio by 2:1. We were able to run heavy load (3000 batch requests per second), consuming about 70% CPU on the server. The tests also found that Windows Server 2008 R2 offered improved performance than the prior release as shown by the dotted red-line in the graph.

Microsoft virtualization (Hyper-V and System Center) combined with advances in hardware technology (such as SLAT-enabled technology) can provide a solid consolidation platform for production workloads using SQL Server.

Microsoft continues to work with partners to offer solutions that help our customers realize the benefits of virtualization (click here). Further guidance from our partners will be forthcoming. For more resources on virtualizing Microsoft server applications, click here.

Vipul Shah

Microsoft Virtualization Team, Senior Product Manager

Quote of the Month

Fawzi — Wed, 27 Jan 2010 08:19:00 GMT

We are what we believe we are.
C. S. Lewis

VMM Tricks: V2V failed with Error (protocol error : too many authentication failures for root)

Fawzi — Wed, 27 Jan 2010 08:19:00 GMT

When you perform a V2V from a VMware ESX 3.5 host and I get the following error:

Error (12709)
The operation on did not complete successfully because of the error: Server sent disconnect message: type 2 (protocol error : too many authentication failures for root)

My VMM is connected to ESX using the root account and the security certificate is valid. After some googling I found the source of the problem, SSH login for the root was disabled.

Since ESX 3.0, for increased security, SSH is disabled by default for the root account on an ESX host. That is, the actual sshd service does not allow root logins. Non-root users are able to login with SSH. This is another layer of protection in addition to the host firewall.

To enable root login for SSH and SCP clients:

If you have physical access to the ESX host, login to the console of your ESX host as the root user .

If you can only connect to the ESX host over the network, connect using an SSH client (such as PuTTY) and log in as a user other than root. After you are logged in, switch to the root user with the following command:

su -

Note: If you do not have any other users on the ESX host, you can create a new user by connecting directly to the ESX host with VMware Infrastructure (VI) or vSphere Client. Go to the Users & Groups tab, right-click on the Users list and select Add to open the Add New User dialog. Ensure the Grant shell access to this user option is selected. These options are only available when connecting to the ESX host directly. They are not available if connecting to vCenter Server.

Edit the configuration file for SSH with the following command:nano /etc/ssh/sshd_config
Find the line that starts with PermitRootLogin and change the no to yes. You can find this line about 2 pages down from the top. Save the file by first pressing Ctrl-O and then Enter. Exit with Ctrl-X.
Restart the sshd service with the command:service sshd restart
Note: Alternatively, use the command:

/etc/init.d/sshd restart

Resources

Enabling root SSH login on an ESX host

VMM tricks:Manage Certificate to connect to VMs in the Perimeter

Fawzi — Thu, 14 Jan 2010 21:08:00 GMT

Most of the times you may need to host some VMs on the Perimeter host, After adding this host to VMM console you still can't connect to the VMs on that host.

Your remote desktop connection failed because the remote computer cannot be authenticated..Certificate Errors.

Here you are the steps:

1. Open SCVMM console
2. Connect to virtual host
3. you must be get attention and opportunity to save certificate from host
4. open mmc - certification - machine - <windows2008 R2 hyper-v host>
5. Add certificate to Personal folder
6. open mmc - certification - machine - <client>
7. Add certificate to Personal folder
8. Add central-CA certificate from domain to Root Trust folder

Check it there

Microsoft's Desktop Virtualization product line as of 2009

Fawzi — Tue, 29 Dec 2009 09:48:00 GMT

Gabe Knuth has wrote a very good article about Microsoft's Desktop Virtualization product line as of 2009

Last up in our rundown of the Big 5's desktop virtualization product lines is Microsoft. This is probably the most ambiguous vendor, because so many of their products intertwine to make up their solution. Many of those products have been around for a very long time, and in other capacities, so it's not easy to pick which products to focus on. To make it easier, this article will only cover the products listed on Microsoft's Virtualization Products and Technologies website. (http://www.microsoft.com/virtualization/en/us/products-server.aspx)

Check it out there

Running Microsoft Office Communications Server 2007 R2 in a Virtualized Topology

Fawzi — Tue, 22 Dec 2009 11:16:00 GMT

This whitepaper defines the supported topologies and provides best practice recommendations for running Office Communications Server 2007 R2 and SQL Server™ 2008 in a Windows Hyper-V environment or other hypervisor technologies.

Overview

Office Communications Server 2007 R2 can be deployed onto Windows Server 2008 Hyper-V, or onto any virtualization solution that is a certified partner through the Server Virtualization Validation Program (SVVP) certified partners for the following workloads:

Presence
IM (including conferencing, remote access, federation, and Public IM Connectivity)
Group Chat

This whitepaper:

Identifies which server roles are supported in a virtualized environment
Provides guidance for scaling users and workloads in a virtualized environment

This document describes the results of a series of configurations that were run in a Hyper-V environment to validate that Office Communications Server on Hyper-V provides stable performance and scalability for production use.

Quote of the Month

Fawzi — Fri, 18 Dec 2009 00:30:00 GMT

“If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.”
– Bruce Schneier

Hyper-V Protection with DPM 2010 Beta - How to automatically protect new Virtual Machines

Fawzi — Tue, 15 Dec 2009 11:32:00 GMT

A great post about adding new VMs automatically in the DPM 2010 protection.

DPM team had a great question come into the DPM Newsgroup recently. How do I automatically protect new VMs added to a Hyper-V host using DPM?

In any virtualized environment, adding new VMs is a frequent operation. While backup administrators can protect an entire Hyper-V host using the DPM Management Console, the protection group had to be modified manually to include the new virtual machines that have come up on the Hyper-V host.

Angad, who closely follows the DPM community immediately got going and came up with scripts to support the requested functionality. These scripts have been validated in our in-house Hyper-V protection scale runs.

You can find the scripts here.

Windows 2008 R2 Network Problem under heavy loads

Fawzi — Sun, 13 Dec 2009 11:06:00 GMT

I was facing this problem during the last month till I found this update, My testing server was holding around 12 VMs ( AD, Exchange 2010, SCOM, SCCM, TMG, etc... ) and we were facing a network problem, In heavy network loads some of the VMs got a disconnected NIC.

I found that TMG's team is facing the same problem...

If you've deployed your ISA Server, Microsoft IAG, Forefront TMG or Forefront UAG on Hyper-V R2 and noticed that a connection between the guest and the virtual switch starts "acting odd", performs poorly or becomes disconnected entirely, you may want to apply this update:

http://support.microsoft.com/kb/974909

Consider the following scenario:

You install the Hyper-V role on a computer that is running Windows Server 2008 R2.
You run a virtual machine on the computer.
You use a network adapter on the virtual machine to access a network.
You establish many concurrent network connections, or there is heavy outgoing network traffic.

In this scenario, the network connection on the virtual machine may be lost. Additionally, the network adapter is disabled.

Note You have to restart the virtual machine to recover from this issue.

You have to install this hotfix for this problem, Now everything is fine

The ultimate Hyper-V Resources Guide

Fawzi — Thu, 10 Dec 2009 14:09:00 GMT

Source

It’s all available at : http://technet.microsoft.com/en-us/dd565807.aspx