Virtual machine

How do your virtual machines compare with your peers’? Find out

A small virtual appliance company in Portsmouth, N.H. called vKernel first grabbed my attention last year with its virtualization management software, and they have it again with a new online virtualization community called Compare My VM.

The site gives users a way to annonymously compare their virtual machine (VM) configurations, by application category, with peers to see how others are allocating resources, and hopefully, take something useful back to your own environment.

vKernel’s Founder and CEO, Alex Bakman, came up with the CompareMyVM idea to help the IT community learn from each other about allocating resources for specific application VMs. 

“How to properly allocate resources in a virtual environment is still a trial and error process.  Simply using the same allocations of a physical server when virtualizing it can quickly lead to resource capacity issues caused by either over or under allocations,” said vKernel’s communications director, Christian Simko. “Ultimately, users can come to the site to learn how to ‘right size’ VMs so that they can drive higher VM densities without impacting performance.”

By setting Compare My VM up as a community site, visitors are more apt to share with and learn from their peers, than to have a product vendor tell users how and what to do, Simko explained.

So far, Compare My VM has around 300 submissions. Users typically enter their VM info either because they think their VM set up is da bomb, or because they need some help, which is why vKernel added a peer to peer ranking system on the site, Simko said. 

“One person may think their set up for an MS SQL VM supporting X number of users is allocated just perfectly,” but it might not be so hot when viewed outside the four wall of that users data center.  “We give others a chance to rank what they think is the right way, much like how Blog sites give others the ability to rank stories,” Simko said.

As is vKernel’s style, the site is designed so that it is simple to navigate and submit information to, allowing users to find similar profiles and compare them.

“It is a tool to help admins learn, share, and improve,” Simko said. “VKernel has only set up the framework of this site; we are not populating it or dictacting how people should be doing things.  It’s purely a community tool.”

I encourage you to check out the free CompareMyVM.com site and anonymously compare your VM resource allocation profiles with that of your peers. You will either feel pretty good about what you are doing, or really bad - and in that case, you’ll probably learn something.

Virtualization tool bundles assist older OSes

Virtualization administrators are in a unique situation where older operating systems (OSes) can potentially “live forever” in the virtual world. While we may not wish to enable older OSes to remain in our environments indefinitely as virtual machines (VMs), situations arise where we need to do just that.

Recently, I had a situation where an older OS had been removed from the installable toolkit platform — in this case it was VMware Tools. The older operating system, Windows ‘98, had been removed from the VMware Tools installation with the release of VMware Server 2.0. While the need for a Windows ‘98 virtual machine is rare, it does exist.

To solve the immediate problem, I was able to install a VMware Tools .ISO image from the 1.0.3 version of VMware Server that I’d been using on another host system. Once installed, the older tools are listed as ‘out of date’ as expected, but the basic features of driver optimization are present on the guest VM.

At first this dilemma did not appear to be much of an ordeal, but it started an important thought process. While Windows ‘98 was the first occurrence of platform removal from a guest toolkit installation that I have observed directly, I don’t expect Windows NT or 2000 guestOSes to be that far from the chopping block of supported platforms.

One way to prevent this issue is to hold onto the tools installations for each platform of the hypervisor. VMware Tools, XenTools and Hyper-V Integration Services all exist as virtual CD-ROM .ISO images that you can hold onto for re-installation on another guest VM. Also, keep in mind that there may not be support from the host side either, so check to see which supported guest operating systems are available.

As you might expect, configuring an environment in this fashion may be met with some skepticism, as it could possibly divert resources. As a result, it may be worth placing this type of guest workload on a free hypervisor like VMware Server or on a similar lower tier of virtualization and storage. Having a flat file backup (.VMDK or .VHD) of the VM is a good idea as well.

While this situation is less than ideal for truly obsolete guest operating systems, the rare instance may arise where archiving toolkits can prove very beneficial.

Virtual machine security threat levels; don’t believe the hype

I received an email the other day from Wayne, Pa.-based SunGard Availability Services outlining some “essential” steps for addressing virtualization security challenges. In their email, the company urges users take certain measures, including installing security software, to make sure their virtual machines (VM) are safe from security threats.

There are many virtualization security products on the market today, yet reports of major VM security breaches are nil. In fact, the largest virtualization vendor, VMware Inc., asserts that its software is completely secure - possibly more secure than physical machines.

And even though the majority of VM security breaches I’ve heard about were hypothetical, performed by scientists through demonstrations or at hacker conventions, not in real data centers, I still receive a steady flow of press releases and product announcements addressing VM security issues.

So now, when I see security vendors warning users about un-named threats they need to prepare for, I am reminded of the U.S. Homeland Security Threat Level warning system.

Unfortunately, there are no published criteria for the threat levels of the Homeland Security system, so there is no way to tell whether the current threat level is accurate. And by the way, the threat levels have never been green or blue.

Because of this, the system can be manipulated by government officials. For example, during the Presidential election of 2004 when Republican President George W. Bush was running against Senator John Kerry, the Homeland Security Threat Level was bumped up, prompting some academics to speculate this was done by the Bush administration to scare voters into re-electing him. If so (and we will never know), it worked.

Unfortunately, decisions based on fear are usually not well thought out.

But I haven’t heard of any 9-11-style attacks on virtual infrastructures, and the virtualization users I speak with aren’t convinced they have anything to worry about. The thing that gets people to buy into virtualization security software is that haunting “what if” question that makes everyone default to the”better safe than sorry” mantra. After all, there is no harm in taking proactive steps to protect against the unknowns - just in case.

For instance, according to this article on the security benefits and risks of virtualization, “the [virtualization] drawback is based on fear of threats that aren’t around today but could become serious problems in the future.” Natalie Lambert, a security analyst with Cambridge, Mass.-based Forrester Research, continues in the article:

“One big concern is about what could happen if a flaw were found in a hypervisor, which would give attackers access to thousands of desktops sitting on a virtual server…That’s not a reality today, but it’s certainly a fear for the future.”

And as Sunguard said in its email, “With many organizations focusing on virtualization benefits, they must also examine core risks before it is too late - meaning security needs to be built in from the start.”

It is why we buy life insurance and car insurance and fire insurance for our homes. (Those damn what ifs and their expensive safeguards).

So, for the paranoid among us, check out SunGard’s suggestions for securing your virtual infrastructure here. As they say, better safe than sorry, right?

SolarWinds offers free virtual machine and network monitoring tool

Austin, Texas-based SolarWinds, a provider of downloadable network management software, has released a free tool to monitor the performance of VMware Inc. virtual environments.

The new tool, SolarWinds VM Monitor, and an update to its flagship Orion Network Performance Monitor (NPM) gives IT a way to manage and monitor their virtual machines (VM).

SolarWinds VM Monitor is operated through a desktop dashboard that continuously monitors a VMware ESX server and the associated VMs by providing real-time monitoring of ESX health indicators.

According to SolarWinds, many of the affordable network management solutions on the market don’t extend monitoring to performance and availability of VMs, potentially impacting critical business services including e-mail, web applications, and ERP.

This appears to be a big issue in data centers, as more than 50,000 customers, from small businesses to Fortune 500 companies, use products from 10 year old SolarWinds to monitor and manage their networks, according to Kenny Van Zant, chief product strategist at the company.

It makes sense for companies like SolarWinds to extend their capabilities into virtual environments because virtualization adoption is growly rapidly; worldwide virtualization license shipments in the second quarter of 2008 increased 53% year over year, compared to a 72% year-over-year increase the previous quarter, according to Framingham, Mass.-based IDC’s new Worldwide Quarterly Server Virtualization Tracker released October 16.

VMware holds the top position in the virtualization market with 78% revenue share in the second quarter of this year, the Server Virtualization Tracker showed.

In addition to SolarWinds software and the VMware ESX Virtual Infrastructure 3’s built-in monitoring tools, there is a large selection of third-party applications - both free and for a price - that offer performance management capabilities, including Nagios, Vizioncore vCharter Pro, eG VM Monitor Veeam Reporter, Hyperic HQ and others.

SolarWinds’ free tool, available for download today, makes it easy to:

• Quickly check the health of a single VMware ESX server by monitoring CPU and memory utilization, number of VMs configured and running, and more

• View detailed individual VM health statistics including VM name, IP address, VM state, as well as processor, memory and disk usage.

• Prevent performance degradation by checking threshold specific indicators to remediate issues.

Of course, like most free software, there is a better version of it that isn’t free.

To monitor a full VMware virtual environment, the improved version of Orion Network Performance Monitor (NPM) is the way to go, according to SolarWinds. NPM gives network engineers a way to monitor thousands of VMware ESX servers, as well as associated VM instances, and VMware VirtualCenter.

With this update, Orion NPM can read host MIB information from each VMware ESX server and its corresponding VMs, detailing statistics like CPU utilization, memory utilization, disk usage, and much more. The latest release also offers ESX-specific alerts and reports. Orion Network Performance Monitor offers:

• Monitoring and analysis of in-depth network performance metrics for routers, switches, physical servers, ESX servers, virtual machines, and any other SNMP-enabled devices in real time

• Do-it-yourself deployment that allows users to be up and running in about an hour

• An intuitive, customizable web interface that supports multiple views including maps and global Top 10 lists

• Alerting for correlated events, sustained conditions, and complex combinations of device states

• Modules to expand monitoring of NetFlow traffic analysis and VoIP performance, wireless devices, applications and servers

SolarWinds’ Orion NPM is available now and pricing starts at $2,475 (USD) for 100 monitored elements including first year maintenance. Orion NPM customers, currently under maintenance, get the 9.1 updates for free.

Users can find more information, tips from SolarWinds company experts as well as peer support and perspectives on Orion NPM, at Thwack, the SolarWinds online community.

Also, on Thursday, October 30, SolarWinds’ Head Geek (their term, not mine), Josh Stephens will host a “Geek Speak” webcast that will look at monitoring ESX-based virtual environments and the challenges associated with them. For more information and to register for the “Monitoring the Virtual Environment – A Technical Perspective on ESX Server Health and Performance Monitoring” event, go to http://www.solarwinds.com/geek/.

ThinLaunch not all that impressive

At the New Innovators both at VMworld 2008 was an interesting small booth from ThinLaunch, which was manned by three of the four people in the company. I had a short pow-wow with two of the folks there and came away with mixed feelings. The product, for which the company is named, appears to fulfill a couple of interesting needs, the first being IT shops that want to pilot virtual desktop infrastructure (VDI) but don’t want to invest beyond the server room, and the second being smaller businesses that have server virtualization capacity to devote to hosting clients but have been loathe to rip and replace their thick clients with new thin hardware. I’m not too wowed by the product but I can see where it may be useful. That said, I was royally unimpressed with the technology.

ThinLaunch can be cobbled together with a few Group Policy object edits in Active Directory without buying the product. Simply replace the shell with whatever VDI launcher (or other application) you want. Microsoft tells you how to do it here. True, ThinLaunch then monitors this process if it crashes and can automatically restart it, but this is also something that can be managed with an application or by copying the code from this site.

ThinLaunch is available as an MSI package, meaning it’s very easy to deploy via Group Policy. Then again, Group Policies are even easier to deploy via group policy. Duh. ThinLaunch requires .NET 2.0. and GPOs don’t. ThinLaunch supports Windows 2000 through Vista and 2K8. GPOs do too.

I can see the need for this package and I can even see some large enterprise customers who’d want a packaged application to handle the conversion of legacy desktops. I can even see using the product in small businesses with virtualization already in place but a lot of legacy desktops and a lack of cash. What I can’t see is how it’s innovative in its approach.

Sorry, ThinLaunch, but you get three out of ten pokers — there’s just nothing hot there.

EsXpress: A good idea come ’round again

I had the opportunity to spend a little time at the esXPress booth at VMworld 2008 this year, and I could kick myself. Hard.

To go to the start of why … a long time ago, back when my office primarily used VMware GSX3 for virtulization at the server level, I had a real need to do backups of the virtual machine disk files (VMDK). My GSX hosts were Linux servers and I used a simple cron job to launch scripts on a schedule, which triggered a suspension, tarring of the VMs and scp-ing of the tarballs to a network-attached storage (NAS) box before re-starting the guests. It let me avoid buying backup licenses for my guests (which were mostly pre-production units, image builds, etc.) and gave me a complete point-in-time recovery solution better than anything I could buy off the shelf (at the time). It ws so efficient that when my company joined the Core Customer Program, I was asked to give a webinar on the topic. Sadly, that webinar is now so out-of-date that it’s been pulled from VMware’s site and I can’t find it on archive.org.

Now why would I kick myself? Because that simple idea is at the root of esXpress. It does it a lot better than I did and focuses on ESX rather than GSX/Server, but at the core it’s very similar. It gets around the need for downtime and uses gzip under the hood rather than tar, but it has a Linux OS guest that essentially copies, compresses and offloads other guests. I was pretty impressed by how simply and efficiently the product works, though I must admit to being bit jealous — if only I had realized there was a <i>product</i> there in that idea.

So kudos to esXpress for taking a good idea and making a good product out of it!

VMware defends its upcoming fault-tolerance feature

During VMworld 2008 in Las Vegas last week, VMware Inc. announced its upcoming fault tolerance feature and gave a demonstration of it during one of the keynote sessions. It looked pretty good and simple to use, but Littleton, Mass.-based Marathon Technologies Corp., a company that specializes in fault tolerance software, had plenty to say otherwise.

In response to Marathon’s blog dissin’ the upcoming feature, Palo Alto, Calif.-based VMware’s Mike DePetrillo, a principal systems engineer, wrote a blog defending VMware Fault Tolerance.

For starters, Marathon complained that VMware does not provide component-level fault tolerance. “The most common failures that result in unplanned downtime are component failures such as storage, NIC [network interface card] or controller failures. Yet VMware Fault Tolerance doesn’t do anything to protect against I/O, storage or network failures.”

DePetrillo noted that VMware already has features to protect again component failure. “If your NIC fails you’ve got NIC teaming built into the system. To set it up simply plug in both NICs to the server, go into the network panel and attach both of them to the same virtual switch. Done. Four clicks. Same thing for storage with the built-in SAN [storage area network] multipathing drivers,” DePetrillo wrote. “I absolutely agree with the author that component failures are the cause of most crashes and that’s why VMware added these features in 2002. VMware FT is not designed for component failure because there’s no sense in moving the VM to another host if you’ve simply lost a NIC uplink. NIC teaming will take care of that with ease and is a LOT cheaper than using CPU and memory resources on another host to overcome the failure.”

Marathon’s second beef: VMware’s fault tolerance is too complex. “In order to use VMware Fault Tolerance, you’ll first have to install both VMware HA [High Availability] and DRS [Distributed Resource Scheduler]. No small feat in and of themselves. Then, because VMware FT requires NIC teaming, you’ll also have to manually install paired NICs. Then you’ll need to manually set up dual storage controllers (with the software to manage them) because it requires multipathing. And to top it all off, you’re required to use an expensive, and often complicated, SAN.”

DePetrillo said the process requires checking off two boxes - HA and DRS. That’s it. “If that’s too hard then please comment and let me know how it could possibly be easier. Even my dog has figured out how to do this now. Granted, it’s a pretty smart dog.”

“As for setting up the dual NICs and dual HBAs [host bus adapters], well, yes, you have to actually plug the physical devices in. After you’ve done that the **built-in** NIC teaming and HBA drivers will take over and configure most everything for you. The NIC teaming does require four extra clicks. The HBA drivers actually figure out the failover paths, match them up, and set up the appropriate form of failover all auto-magically. They’ve been doing this since ESX 1.5 (6 years ago),” DePetrillo blogged.

“Lastly, yes, this requires shared storage. Pretty sure that most environments that want FT (no downtime what-so-ever because our business could lose millions) already have a SAN to take advantage of other things virtualization related such as DRS and VMotion,” he wrote.

Also, VMware FT does not require dual NICs or dual HBAs because, DePetrillo said, “This is something you should have in every virtualization setup that’s running VMs you care anything about, but it’s not a requirement to get VMware FT [Fault Tolerance] running.”

The last point Marathon makes that’s worth spending any time on is that VMware  offers onlylimited CPU fault tolerance. “With VMware FT, you’ll need to set up what VMware refers to as a “record/replay” capability on both a primary and secondary server. If something happens to the primary server, the record is stored on the SAN and then restarted on the secondary server. … The whole thing depends on the quality of the SAN. Second, in the words of the VMware engineer who presented at VMworld, “this can take a couple of seconds.” So what happens to your application state in those couple of seconds?”

DePetrillo’s defense is that “if you’re the type of company that requires absolutely no downtime for an app — if the app is just that critical — then I’m pretty sure you’re going to have a decent SAN. … If you’re having so many problems with your SAN that you don’t trust it for FT, then you have much bigger issues at hand that VMware or Marathon or any of the other virtualization related vendors aren’t going to help you with.”

You can read more of VMware’s comments on DePetrillo’s blog, which gets into some details on how VMware Fault Tolerance will work, and vice versa for Marathon.

But I think it is obvious that Marathon is making VMware’s fault tolerance feature seem worse than it is, and VMware is making its new feature seem simpler than it is.

For the most part, this is a pissing contest between the incumbent fault-tolerance vendor and the “new guy,” but the fact of the matter is, if you use VMware virtualization, you can’t use Marathon Technologies because they don’t support VMware (obviously) and if you use Citrix Systems’ XenServer, you can’t use VMware Fault Tolerance, so these arguments are moot.

GlassHouse Technologies offers Managed Services for Virtual Environments

Today, Framingham, Mass.-based GlassHouse Technologies, an IT infrastructure consulting and services firm, launched Managed Services for Virtual Environments offerings. The new services are delivered through a management interface that uses virtualization management software from Dallas-based Tek-Tools‘ Profiler for VMware. This interface gives users visibility, monitoring and reporting capabilities for virtualized IT environments.

GlassHouse developed Managed Services for Virtual Environments based on the company’s experience in planning, designing and deploying effective virtualization strategies. GlassHouse noticed the need for more in-depth instruction for customers on how to maintain visibility, measure results and manage data center environments.

The complete Managed Services for Virtual Environments offering will be available later this year.

GlassHouse will showcase the capabilities of the new services at Booth 440 at VMWorld 2008 in Las Vegas Sept. 15-18.

Bigger and bolder? VMworld 2008

Palo Alto, Calif.-based VMware Inc. expects a record 14,000 attendees at VMworld 2008, the company’s fifth annual virtualization conference being held at the Venetian Hotel in Las Vegas starting Sept. 15. Last year’s VMworld conference at the Moscone Center in San Francisco housed some 10,000 attendees.

Could it be that the buzz surrounding VMware is so magnificent this year that 30% more people will take flight to Vegas just to learn about virtualization technology? Or is the lure of Las Vegas partially to blame for the increased enthusiasm? Hmmm…

This year’s VMworld conference features 300 breakout sessions in seven tracks: Automating the Virtual Data Center; Building Business Continuity and Disaster Recovery; Exploring Technology and Architecture; Planning and Operations in the Data Center; Running Enterprise Applications in Virtual Machines; Virtualization 101; and Virtualizing the Desktop.

There will also be 13 instructor-led and five self-paced labs with around 8,000 lab seats. More than 200 sponsors and exhibitors have supported the conference, including Platinum Sponsors Cisco, Dell, EMC, HP, IBM, Intel, NEC, NetApp and Symantec, all of whom will deliver keynotes.

The keynote I’m most interested in hearing will be from VMware’s new president and CEO, Paul Maritz, who replaced company co-founder and president Diane Greene this summer.

According to a VMware press release, “Maritz will look back at virtualization history and ahead to the industry trends that are influencing VMware’s future and its solutions. Looking ahead, Maritz sees a future of virtualization expanding from the data center to the desktop and beyond to the cloud.”

He will deliver his keynote on Tuesday, Sept. 16, 2008, at 8 a.m. PT, which will also be available via webcast . You can read about his keynote from SearchServerVirtualization.com reporters on our VMworld 2008 coverage page.
I hope Maritz will be willing to field questions after his formal keynote, because with Microsoft Hyper-V nipping at VMware’s heels, he really needs to foster confidence in his leadership and vision for the company.

Also keynoting is VMware CTO Dr. Stephen Herrod, on Wednesday, Sept. 17, 2008, at 8 a.m. PT, also available via webcast.

This year’s theme is “Virtually anything is possible,” and there will be more than 100 customer stories offering insight into how VMware and virtualization have affected data centers. Featured VMware customers include AT&T, Burt’s Bees, Chevron, eBay, First American, Nationwide, Qualcomm, Siemens AG, United Bancorp and Whirlpool.

Also, like last year, SearchServerVirtualization.com will announce the Best of VMworld awards for the latest and greatest technologies.

BMC intros slew of virtualization management products

Houston-based BMC Software introduced several new virtualization management products today, including nine new integrated offerings designed to eliminate the risk and operational expenses associated with management of virtualized data centers.

BMC’s new virtualization management products are fully integrated with virtualization products from Microsoft, Sun Microsystems, Inc. and VMware Inc. The new BMC software is based on an automated set of closed-loop change and configuration management (CLCCM) process workflows that reduce the latency, cost and risk associated with change management. All of the new offerings support both virtual and physical infrastructures.

The nine new offerings support goals for performance, compliance and enterprise visibility by addressing the challenges created by virtualization.

Some of the issues addressed include the following:

*Planning a virtualization/consolidation initiative: BMC Virtualization Capacity Management and Planning Service is a packaged services offering that helps customers accelerate their virtualization efforts.

*Simplifying management: BMC Performance Management does complete performance monitoring across virtual infrastructure and applications with enhanced VMware Infrastructure 3 and VMotion support.

*Ensuring availability: BMC Application Performance and Analytics helps IT actively manage service levels in virtual infrastructures.

*Performance: BMC Capacity Management replaces educated guesses with automatic assessment, prioritization of server workloads, and ongoing capacity monitoring. The result is high performance while reducing capital and operational expenses and maximizing server consolidation.

*Server sprawl: Virtualization allows new servers to be created very rapidly, leading to virtual machine (VM) sprawl. BMC Discovery Solution helps customers keep virtualized environments under control by keeping tabs on virtual servers. Support for VMware, Solaris 9/10 containers and zones, AIX LPARS as well as z/VM dependencies on mainframe (z/OS) mean that all types of virtual servers can be discovered and added to BMC Atrium CMDB.

*VM security: BMC BladeLogic Virtualization Module for Servers adds security and strengthens licensing and regulatory compliance. It includes automatic provisioning and configuration of the entire software stack, including virtual infrastructure, guest VMs and applications, and enforces security best practices, including built-in virtual server hardening rules.

*Compliance: BMC BladeLogic Operations Management Suite establishes automated, closed-loop change and configuration governance over entire virtualized environments. BMC’s policy-driven configuration control prohibits noncompliant servers from being deployed or existing beyond the next audit scan. Automated compliance and remediation capabilities detect and correct any compliance violations.

*Administration costs: BMC Run Book Automation Platform and BMC Run Book Automation VMware Adapter exploit BMC’s CLCCM workflows to automate routine change management tasks.

Of course, BMC isn’t the only game in town when it comes to virtual infrastructure management. There are a number of vendors offering management products for various purposes, including Portsmouth, N.H.-based vKernel and San Francisco-based Hyperic, Inc.

In addition, Austin, Texas-based Surgient announced today its Virtual Automation Platform 6.0, which is designed with physical provisioning and Microsoft Windows Server 2008 Hyper-V support to manage virtual resources and eliminate physical server and virtual machine (VM) sprawl.

In addition to third-party VM management products, virtualization providers offer their own; VMware sells a proprietary management and automation suite, as does Microsoft for Hyper-V.