Well, in the words of Lee Corso:

There are still quite a few people out there who don’t feel totally comfortable virtualizing everything. And they’re not all newbies who don’t know what they’re talking about.

Case in point: Joshua Corman, the principal security strategist for IBM, a company you may have heard of before. He made headlines at Interop when he told attendees, “I highly recommend you don’t adopt virtualization for any regulated project.”

Server virtualization makes it difficult for organizations to show regulatory compliance, especially when they’re regularly provisioning and deprovisioning virtual machines. And it opens up a whole new Pandora’s box of risks, especially when live migration and other advanced technologies are involved, Corman said, according to Network World.

And at TechEd last month, Microsoft product manager Edwin Yuen warned attendees about additional virtualization challenges.

“You have to do all the maintenance, management and control of [virtual] machines that you normally do [on physical machines],” he said.

Some users also have their concerns. Mike Mucha, the information security officer for Stanford Hospital and Clinics, told InfoWorld last week that a recent virtualization deployment has muddied the waters around his organization’s security decision-making process.

“Virtualization tends to be … led by the server team,” he said. “The server people are taking on non-traditional roles, making decisions about network architecture.”

But at TechEd I also spoke to several IT managers and systems administrators who said their servers are or soon will be 100% virtualized. And these weren’t at rinky-dink mom-and-pop shops. Some were large organizations in sensitive verticals like healthcare and government.

When they were telling me about this, I thought, “Wow, that’s pretty cool that you’ve done so much with virtualization!” But after reading what Corman said about virtualization security and compliance, I wonder if my response should have been, “What? Are you nuts?”

The truth probably lies somewhere in between.

Maybe some longtime virtualization users have found ways to secure their environments and show regulatory compliance. Or maybe some think they have and are in for a rude awakening. Maybe Corman is completely right about virtualization’s risks. Or maybe he’s spreading some good, old-fashioned FUD.

Should you consider and addresss the security and compliance concerns? Of course. But don’t let them stop you from realizing the benefits of virtualization.

Virtualization is about so much more than just shrinking the footprint (physical and carbon) of your data center. Think about it: What does virtualization really do for you? It encapsulates your workloads (servers) into a collection of files that are consistent, that are portable, that are uncoupled from hardware, and that can be copied from location to location. Let’s look at each of these benefits individually:

Consistency: A VM is simply a software representation by a hypervisor to a guest operating system of the interfaces required to interact with the “core four” compute resources (CPU, memory, disk and network).
Portability: A VM that you create on one virtualization host can be moved to another virtualization host with impunity. Today, you’re restricted to a single hypervisor solution. As standards develop, I believe you will be able to move VMs among different vendors’ hypervisors without modification — either because everyone has converged on a single standard, or because there are few enough standards that competing vendors can implement emulation or translation services to enable VMs to “float” from hypervisor to hypervisor (cloud pun intended).

Uncoupled: Since these interfaces are implemented in software, they can be abstracted from the underlying physical system and offered to the guest OS in a very consistent manner. There are no more concerns about whether you have an Intel or a Broadcom network adapter, or an LSILogic or a QLogic HBA — or even local disks or centralized storage served up from a SAN or NAS. In fact, it doesn’t really matter if the underlying hardware is from Dell, HP, IBM, Fujitsu Siemens or is a white box solution … the VM and the guest operating system within it don’t know and don’t care.

Can be copied: This is an interesting one. Many people consider this to be a risk of virtualization. Not only is it possible to capture the data used by an application, but you can copy the underlying files that comprise the virtual machine and have the entire operating environment. This poses significant security concerns, as well as licensing concerns. Since a VM can be copied, you’ve essentially made it possible to put your servers onto a USB or other removable media device and walk away with them. All true, all valid concerns (that’s where your security policies come into play). But look at the benefits you derive from being able to copy entire VMs! You can now perform stateful backups of an entire server. No longer do you have to worry about whether your system state matches your application’s data state — they’re in perfect sync. If you have to restore a server due to failure or “operator malfunction,” you simply copy the files that comprise the VM from your archives and you’re back up and running. No more installing the base operating system, applying system state, installing an application and restoring data (then praying that everything works). It’s all rolled into one simple, seamless process.

As you can see, there’s a lot of benefit there with nary a mention of consolidation ratios. But how can you take advantage of those benefits? One of the most obvious ways is to enable rapid provisioning of new servers. Think about your current physical environment. How long does it take from the point where you get authorization to purchase, until you have a server sitting on the data center floor configured with your standard suite of software (operating system, applications, tools, etc.)? In many enterprise organizations, it can easily take six weeks or more! In certain verticals, it can take even longer, due to certification/validation requirements.

In a virtual environment, from the point of getting the signature, you can have your new server deployed and configured in a matter of minutes. And that’s not just any server, but a server that has already gone through your internal validation procedures and been blessed to connect to your network! How much value would your business derive from being able to respond to a change in customer needs six weeks more quickly than you do today?

Another area that’s ripe for improvement in most organizations is disaster recovery planning and implementation. Look at your current DR plan (if you have one and you can find it). What is your current recovery time objective (RTO) and recovery point objective (RPO)? If you’re like most organizations, your RTO for critical services is on the order of 48 hours. Being generous, your RPO is something like 24 hours. When you add the two together (assuming you actually hit your RTO), you get the length of time for which there will be NO information available about your business. How much downtime/data loss can your business afford?

Since a VM is nothing more than a data file (as far as the hypervisor is concerned), it can be replicated to a remote site using technologies that have been around for years! Now you can have a DR plan that you can test at will, that embraces the use of “legacy” systems  — no requirement to have “like” systems for production and DR! –  and that includes RTO and RPO values that make your old DR plan blush.

On another topic, when was the last time you did a platform upgrade for one of your business critical systems? How long did it take? You had to plan it, test it, certify it on the new platform, schedule enough downtime to effect the migration, test it again and finally went off the air and did the upgrade … over the long holiday weekend … to give yourself that extra buffer … just in case. How many change control requests was that? How many man-hours invested? If your systems were virtualized, the upgrade could have been tested, verified, scheduled and executed all within a couple days. It could be done with zero downtime, although you might want to take the opportunity to grab a fully quiesced backup of the system in a powered-off state (something that’s always good to have). And, oh yeah, you could have been home with the family enjoying that long weekend!

So you see, there’s a lot more to virtualization than just consolidation ratios. Virtualization is the foundation for building a robust, flexible, responsive business enablement center.

Johnathan,  a Server Virtualization blog reader, recently posted a comment on one of my posts detailing the math for a 250-seat virtual desktop infrastructure (VDI)/thin-client implementation, which amounted to a $350 per-desktop-capex advantage for VDI; a three-times faster deployment schedule and troubleshooting times that were orders of magnitude faster (albeit harder to quantify). Not too shabby.

Of course, that was before VMware announced new pricing for its re-branded VDI suite, View 3. At $150 per seat for View Enterprise or $250 for View Premier, capex savings would decrease to $300 or $200 per desktop. That’s assuming you pay list price, which is highly doubtful. But it also doesn’t account for the storage capacity savings you might  realize by using View Composer to share desktop images: an average of 70%, according to VMware.

Suffice it to say that assigning ROI dollars to an IT project is a highly personal, subjective affair. And that the numbers posted by others are often suspect, as Bernard Golden points out in his article “Virtualization Projections Deserve Scrutiny.” Here, Golden looks into a Butler Group report that reports client virtualization savings of $159,000 for 1,000 desktops, or $159 per desktop, per year. Come to find out, the $159 savings was in energy costs alone. Who knows what the overall cost of the deployment really was?

At any rate, if you’ve done the math on a VDI implementation, and believe that your numbers bear scrutiny, go ahead and post the numbers in the comments section of our blog.

1. VDI can save you money on software licenses. At least, that’s what I hear from Jeff Cunningham, a network administrator at the Agricultural and Resource Economics department at the University of Maryland, who implemented about 70 virtual desktops for faculty, staff and graduate students. For instance, an individual license for the data analysis and statistical software package Stata runs about $700. In contrast, a 10-seat network license costs the university $2,000, for a savings of $5,000, and the budget to deliver interesting software to a greater number of students.
2. Thin clients can withstand a long power outage. Kunal Patel, the IT director at Nina Plastics, whose VDI project I wrote about earlier this week, told me that during a recent power outage, the company’s regular desktops drained their APC battery backups in less than 10 minutes. Their Pano Logic thin clients, on the other hand, stayed on for four hours. In a similar vein,  the University of Maryland’s Cunningham stuck a kilowatt meter on a bank of five Pano devices and a bank of five regular desktops and discovered that the Pano devices consumed one-fourth the power of the regular desktops.
3. Some IT managers are skeptical of thin clients’ supposed cost advantages. As an example, check out Basilm’s comments on the Server Virtualization Blog. What about you, dear Server Virtualization Blog readers? Have you done the math on VDI and thin clients? What’s the verdict?
4. Big companies need big security. With their strong security and compliance needs, verticals like finance, health care and government are a natural fit for VDI. But in order for them to adopt it, the VDI community needs to support biometric authentication mechanisms, such as fingerprint readers and face recognition software.

That’s all for now, folks. Brace yourself for a lot of news on virtual desktops. Things are about to get interesting

As an investor, this wasn’t my happiest week (I always felt it was odd to invest money in people who invest money), but for a lot of others, last week must have been miserable indeed. Among those who are feeling miserable right now are IT staffers at Bank of America, who must now acquire a global IT infrastructure as their company acquires Morgan Stanley. And of course, federal IT staff are now worrying about how to oversee the essentially nationalized AIG. That’s not to mention the IT teams at numerous other companies engaged in mergers and acquisitions.

This is the time for server virtualization to shine. Bank of America should lead the charge in making efficient use of virtualization in their acquisition of Morgan Stanley. BofA is going to inherit an immense quantity of hardware, not to mention enormous heating/cooling/electric bills, colossal real estate costs and a titanic regulatory compliance project as it tries to integrate its own IT infrastructure with Morgan’s. If BofA (or any acquiring company for that matter) is smart, it will use virtualization to physical-to-virtual (P2V) every possible asset, transport to its own data center and import those virtual systems.

Bank of America shouldn’t just P2V low-hanging fruit, either — it should reach for the stars. Then it should shut down that physical hardware, wipe it and sell it to help offset the project costs. There are obviously a lot of nuanced steps involved in making this happen, but all the major pain points to which virtualization presents solutions are all the major pain points in integrating a new IT infrastructure:

1) Server move/change/add/remove
2) Power costs
3) Real estate costs
4) Heating and cooling
5) Configuration management
6) Asset management

The difference between the slow-rolling projects in most companies and the aggressive plan I recommend is night and day. The ROI in a progressive rollout can be achieved over time, integrated into the budget and then applied over that time. The costs of an acquisition and the integration of that acquisition’s IT assets are immediate and immense.

Virtualization can provide those long-term benefits in the short term — the elimination of real estate, cooling and power costs alone will offset the cost of licensing and storage. The enhanced backup and retention possible with virtualized systems will go a long way towards easing regulatory concerns of data retention.

This week, CiRBA announced the availability of packaged analysis templates that compare Windows Server 2008 Hyper-V versus VMware-based virtualization.

Using CiRBA’s analysis, data centers can examine the suitability of each hypervisor for a given environment, see consolidation ratios, long-term management considerations and financial returns from each platform.

CiRBA’s analysis templates for Hyper-V and VMware-based virtualization are driven by specialized Rulesets for each platform in combination with utilization analysis.

The new comparative analysis templates for Hyper-V and VMware essentially provide a vendor-agnostic analysis, data, and organization-specific business and technical constraints to determine the best option for any given environment. Examples of comparison points between the two competitor products include:

*Per-guest resource limits: Hyper-V and VMware offer different per-guest maximum resource configurations, meaning the number of virtual CPUs, memory and network interfaces supported, which could impact compatibility.

*Memory over commit: Hyper-V and VMware differ in their ability to share memory between VMs, making efficiency gains through “over-commitment.” This differentiating factor can impact consolidation ratios and infrastructure design.

*Workload mobility: The two technologies differ in their support for the live migration of workloads between physical servers. Hyper-V doesn’t offer live migration yet, VMware does (VMotion).

CiRBA customers can access these new analysis features through CiRBA Central, a central repository of analysis rules that allows organizations to stay up to date on the latest best practices in data center optimization. CiRBA Powered Partners will also have access to these rules in order to help guide their clients through the selection of optimal technology for their environment.

For more information on CiRBA’s comparative analysis for Hyper-V versus VMware, contact the company.

“The dream of cloud computing is fast becoming reality,” she said.

With cloud computing, workloads are assigned to connections, software and services, which are accessed over a network of servers and connections in various locations, collectively known as “the cloud.” Using a thin client or other access point, like an iPhone or laptop, users can access the cloud for resources on demand.

Greene told the event attendees that the evolution of virtualization begins with users deploying VMs for testing and development, then easing into server consolidations for production environments. The third phase is resource aggregation, with entire data centers being virtualized, followed by automation of all of those aggregated workloads. The final “liberation” phase is cloud computing, Greene said.

“We now have competition going after the first two phases of virtualization evolution with 1.0 products, but we are very much in the aggregate, automate and liberate phase,” Greene said.

Other vendors have their sights set on cloud computing as well. IBM Corp. and Google announced plans to promote cloud computing in October by investing over $20 million in the hardware, software and services at universities, and Reuters reported this week that Microsoft expects companies will abandon their own in-house computer systems and shift to cloud computing as a less expensive alternative.

While VMware moves towards cloud computing, the company is in the thick of the automation phase and has released a number of virtualization automation products recently, including VMware Site Recovery Manager for Disaster Recovery, VMware Stage Manager and VMware Lifecycle Manager for lifecycle management and VMware Lab Manager, as well as product and service bundles.

The company is also focusing on desktop virtualization with Virtual Desktop Infrastructure and has introduced services and products to move that inititive forward.

“Desktop virtualization does require a major change in the infrastructure, so it could be 2011 before we see desktop virtualization adoption in the millions. We do have hosted desktop virtualization customers with large deployments…but [adoption] will happen at a measured pace,” Greene said. “I do think someday everyone’s desktop will run in a virtual machine, whether it be on PCs or MACs, thin clients or phones. With the advantages from a security, manageability and flexibility standpoint, it will become mainstream.”

The cost of desktop virtualization is a barrier to adoption, but Greene said the price per user of desktop virtualization will come down steadily over the next few years. It is in the $800 per user range today, she said.

Yesterday, I spoke with Stephen Fink, senior infrastructure architect for the global IT consultancy Avanade, about a comprehensive tool he created that takes just about every inch of data centers under consideration to determine what the ROI for virtualization will be.

Fink has 14 years of experience as a consultant and created the virtualization model for ROI as a tool for his own clients, but it made its way around the company and is now used as the way to determine ROI by Avande consultants, he said.

There are 125 inputs in the Microsoft Excel-based tool – such as power and cooling, cabling, network, CPU, servers, floor space, and staffing costs – and each helps determine the impact of implementing virtualization at a customer’s location, he said.

“There will never be a one-size-fits-all solution, and there has to be a business case for virtualization; I look at their environment from a high-level approach and asses the inventory. We look at their apps, their network, the annual power costs, licensing costs for software, etc., to see what they pay for their environment, and we can now give a really good idea of the ROI with Microsoft Hyper-V and VMware,” Fink said.

Avande, which is partially owned by Microsoft, has the benchmark information on Hyper-V from the most recent release candidates and uses that to determine Hyper-V ROI. Hyper-V is scheduled for release in August.

“We look at the net costs of the environment without virtualization versus what they would pay if they virtualized, with specific server types, running ESX or Hyper-V. We can tell you how many systems can be virtualized, and you can see the cost of your virtual servers, the cost per OS and the cost of your virtual hosts, to determine your annual cost reduction from virtualized guests,” Fink explained.

Fink said consultants like him are often used to determine whether virtualization is worth the initial acquisition and licensing costs, which depends on businesses’ expectations when it comes to ROI. “If a company already operates efficiently and has a portfolio of apps that make them a poor candidate for virtualization – like very high CPU and high memory consuming apps or data base severs, virtualization may not be the answer for them,” Fink said.

Avanade uses the tool as part of its consultancy, and it is only available through Avande consultants – which, of course, comes at a cost to businesses.

Other virtualization calculator tools are available for free, like the one from VMware, but these aren’t as precise as Fink’s tool from what I can tell.

There are also plenty of experts offering advice on determining virtualization ROI that won’t cost you anything.

According to IT security and virtualization technology analyst Alessandro Perilli , to calculate ROI, “you need to apply simple math to the costs your company could mitigate or eliminate by adopting virtualization.”

He reported that virtualization can reduce some of the following direct costs:

* Cost of space (leased or owned) for physical servers
* Energy to power physical servers
* Air conditioning to cool the server room
* Hardware cost of physical servers
* Hardware cost of networking devices (including expensive gears like switches and fibre channel host bus adapters)
* Software cost for operating system licenses
* Annual support contracts costs for purchased hardware and software
* Hardware parts for expected failures
* Downtime cost for expected hardware failures
* Service hours of maintenance cost for every physical server and networking device

Scott Feuless, a senior consultant with Compass, based in Texas, wrote about how to quantify virtualization ROI recently, and IT consultant John Hayes of Avnet Technology Solutions also had some advice on figuring out the cost of virtualization that could help make the case for virtualization.

In today’s world the cost of just about everything has been on the rise. Fuel costs in particular have a ripple effect on just about everything we buy which also affects computers. That’s why virtualization is a great way to offset those increased costs. Providing power and cooling to a data center can be a very big expense, virtualizing servers can dramatically reduce this cost. PlateSpin provides a nice power savings calculator on their website. If we plug in the following numbers:

• 200 physical servers
• average usage of 750 watts per server
• average processor utilization of 10% before virtualization
• target processor utilization of 60% after virtualization

The average power and cooling savings a year comes out to $219,000 with a consolidation ratio of 5:1 based on a cost per kilowatt hour of 10 cents. As the cost of power increases the savings become even greater, at 12 cents the cost savings become $262,800 per year and at 15 cents the cost savings become $328,500 per year.

Of course savings will vary based on a number of factors including how well utilized your physical servers are before virtualization, your consolidation ratio which can sometimes be as high as 15:1 and also your location. Different parts of the country average different costs per kilowatt hour, California and New York tend to be the highest at 12 – 15 cents per kilowatt hour where Idaho and Wyoming are the cheapest at about 5 cents per kilowatt hour. Power costs tend to rise a lot more then they go down so the argument for virtualization from a cost perspective becomes much easier when you factor in the potential savings.

Some power companies like PG&E even offer incentives and rebates for virtualizing your data center and reducing power consumption. A greener data center benefits everyone and besides reducing costs also helps the environment. Virtualization is one of the key technology’s to help make this possible.

Yesterday’s Dilbert.com comic strip:

But, as today’s comic points out, even if your company approves a virtualization project, you still may not get to partake in the fun!