Yellow Bricks

by Duncan Epping

VMware Cloud Foundation

What’s new for vSAN in 9.1?

· · Leave a Comment

VMware Cloud Foundation 9.1 was just announced, and that means a lot of new functionality has been released. Some of the features you already knew about, others may come as a surprise. I know Pete Koehler has a whole series he is going to release, so I am just going to introduce a couple of features that I feel everyone should know about. Here’s a list of what was just announced:

  • Native S3 Object Storage
  • Cyber Recovery enhancements with Any to vSAN ESA, Seeding, Tag-Based VM selection and more
  • Auto-RAID
  • Global Deduplication and enhanced compression
  • QLC support
  • Mixed mode for Remote Datastores (ESA <-> OSA)
  • Enhanced Capacity Reporting
  • Resizing Shared VMDKs

Now, some of these capabilities I have been talking about for a while now at events, like Native S3 Object Storage, but it is probably still worth explaining what is announced. Let’s discuss a few of the above.

Native S3 Object Storage

This, in my opinion, is probably together with the Cyber Protection platform, the biggest feature that was announced for 9.1.  Most of you probably use some kind of S3 Object Storage platform as a backup destination, or you may have developers (and apps) directly accessing an S3 bucket for various reasons. S3 Object Storage use cases and total capacity have exploded over the last decade. So far, we (VMware/Broadcom) have always partnered with 3rd party vendors to deliver these S3 capabilities on top of VCF, but more and more customers have asked for a well-integrated solution that would come as part of VCF. With an upcoming patch release of 9.1 the tech preview of Native S3 Object Storage will be released.

Although the platform has been referred to as “vSAN Native Object Storage” in the past, I feel it is more native to VCF. Although the configuration can be completed entirely through the API and CLI, most customers will likely consume the solution through VCF Automation. VCF Automation will provide the ability to have tenants (organizations) create their own S3 Object Storage Service (or even multiple), and have many buckets per S3 Object Storage Service. This will provide the logical isolation you would expect from a multi-tenancy platform. As a Provider Admin you simply enable S3 Object Storage for a region, and then each tenant who has resources in that region assigned can consume it and create the service, and subsequently buckets, as shown below.

What’s new for vSAN in 9.1?


I will probably upload a demo soon and will record a podcast episode specifically on this topic.

Cyber Recovery

Recovery from a ransomware attack and protection against it, is a hot topic these days for every CIO. Just do a Google search, and you will find countless examples of companies losing millions as a result of production outages due to an attack. At Explore 2025, we showed the world what a sophisticated ransomware recovery platform would potentially look like, and with VCF 9.1 and Site Recovery / Cyber Recover, we are finally at the stage where we can say we have a solution to help you recover safely and efficiently fully on-prem!

With 9.1 not only do we provide the option to replicate from any storage platform efficiently to vSAN ESA and have deep snapshot chains, but we now also have the option to build an isolated recovery environment / clean room on-premises. This platform comes fully integrated with VCF, and provides an orchestrated workflow to recovery from a ransomware attack. On top of that, the platform integrates with an EDR solution like Carbon Black or CrowdStrike. to ensure recovered data is clean. Of course, it will also work with other EDRs, but it would just not have the automated scanning and cleaning just yet. I’ve had Jatin on the podcast not too long ago to explain all the benefits of the platform, and will be having another episode on this topic soon!

Global Dedupe and enhanced Compression

From an efficiency perspective, various new enhancements have been introduced. Global Deduplication was already part of vSAN ESA, but only available through a support request, as of 9.1 the feature is available for all customers right there in the UI. Along with Global Deduplication going GA, support for Encryption at Rest with Global Dedupe has also been added. For European customers, do note, support for stretched clusters is not there just yet, so some of you have to wait with enabling Global Dedupe. Besides Global Dedupe, a brand new compression algorithm has been added. In the past, compression was done using LZ4, going forward, compression will be done using zStandard. zStandard allows for better tuning, making it more capacity and cost (CPU) efficient, which should result in a higher compression ratio over time.

Auto-RAID and QLC

Last but not least, I should probably also briefly talk about QLC and Auto-RAID. QLC support is mainly intended for Cyber Recovery deployments. As you can imagine, this is the perfect use case for a lower-tier flash device, which provides high capacity at the cost of performance and endurance. This is something to definitely keep in mind, as these devices are definitely not intended to be used in regular production environment. As always, VMware will provide guidance in terms of what is supported and what not, and special Ready Node configurations will be created for Cyber Recovery specifically.

Auto-RAID is a feature that surprised me personally as well. I had heard about plans to develop a new RAID mechanism, but hadn’t realized it was going to ship in the 9.1 release already. This new storage policy option allows vSAN to make intelligent decisions around the to be used RAID configuration for each object based on the size of the cluster, and the features enabled on the cluster. In other words, if you have Stretched Cluster enabled, Auto-RAID will ensure your VMs are stretched and protect the VMs within a site accordingly, based on the number of hosts. If Auto-RAID is enabled, all 9.1 clusters can be managed using the same policy if you prefer vSAN to make the decisions for you! Why is this useful? Well, if the size of the cluster changes, or the cluster is (un)stretched, the Auto-RAID policy will automatically re-configure all associated VMs. This removes the risk of having VMs incorrectly configured and removes the administrative burden of having to make changes to a policy and re-apply it to all the VMs.

I have planned for a podcast recording with Pete Koehler later this week, so expect a brand new episode covering all the above (and more) dropping soon!

vSAN ESA Witness memory and CPU resources?

· · Leave a Comment

Not sure when this happened, but somehow the resource requirements for the vSAN Witness VM disappeared. Someone asked me last week how much memory is allocated to a VM, and how many vCPUs. Now, of course, this depends on the profile you select as the Witness VM has an M, L, and XL profile. The profile you select is determined by the number of VMs you will be provisioning, yes it is smart to take a growth factor into account. Now, when you deploy the VM, it doesn’t give a hint either, but you can figure out the size by simply looking at the OVF descriptor file. So this is what I got from the vSAN ESA Witness OVF:

  • vSAN ESA Witness XL – 8 vCPUs – 64 GB memory
  • vSAN ESA Witness L – 4 vCPUs – 32 GB memory
  • vSAN ESA Witness M – 4 vCPUs – 16 GB memory

And for those who were wondering, with vSAN OSA the requirements are:

  • vSAN OSA Witness XL – 6 vCPUs – 32 GB memory
  • vSAN OSA Witness L – 2 vCPUs – 32 GB memory
  • vSAN OSA Witness Normal – 2 vCPUs – 16 GB memory
  • vSAN OSA Witness Tiny – 2 vCPUs – 8 GB memory

I hope that helps, and also please do note… if you read this article a few years from now, things may have changed!

Can I replicate, or snapshot, my vSAN Stretched Cluster Witness appliance for fast recovery?

· · Leave a Comment

I’ve been seeing this question pop up more frequently, can I replicate or snapshot my vSAN Stretched Cluster Witness appliance for fast recovery? Usually, people ask this question as they cannot adhere to the 3-site requirement for a vSAN Stretched Cluster. So by setting up some kind of replication mechanism with low RPO, they try to mitigate this risk.

I guess the question stems from a lack of understanding of what the witness does. The witness provides a quorum mechanism, the quorum mechanism helps determine which site has access to the data in the case of a network failure (ISL) between the data locations.

Can I replicate, or snapshot, my vSAN Stretched Cluster Witness appliance for fast recovery?

So why can the Witness Appliance not be snapshotted or replicated then? Well, in order to provide this quorum mechanism, the Witness Appliance stores a witness component for each object. This is not per site, or per VM, but for every object… So if you have a VM with multiple VMDKs, you will have multiple witness objects per VM stored on the witness appliance. That witness object holds metadata and, through a log sequence number, understands which object holds the most recent data. This is where the issue arises. If you revert a Witness Appliance to an earlier point in time, the witness components also revert to an earlier point in time, and will have a different log sequence number than expected. This results in vSAN being unable to make the object available to the surviving site, or the site that is expected to hold quorum.

So in short, should you replicate or snapshot the Witness Appliance? No!

 

Playing around with Memory Tiering, are my memory pages tiered?

· · 2 Comments

There was a question on VMTN about Memory Tiering performance, and how you can check if pages were tiered. I haven’t played around with Memory Tiering too much, so I noted down for myself what I needed to do on every host in order to enable it. Note, if the command contains a path and you want to do this in your own environment you need to change the path and device name accordingly. The question was if memory pages were tiered or not, so I dug up the command that allows you to check this on a per host level. It is at the bottom of this article for those who just want to skip to that part.

Now, before I forget, probably worth mentioning as this is something many people don’t seem to understand, memory tiering only tiers cold memory pages. Active pages are not being moved to NVMe, on top of that, it only tiers memory when there’s memory pressure! So if you don’t see any tiering, it could simply be that you are not under any memory capacity pressure. (Why move pages to a lower tier when there’s no need?)

List all storage devices via the CLI:

esxcli storage core device list

Create memory tiering partition on an NVMe device:

esxcli system tierdevice create -d=/vmfs/devices/disks/eui.1ea506b32a7f4454000c296a4884dc68

Enable Memory Tiering on a host level, note this requires a reboot:

esxcli system settings kernel set -s MemoryTiering -v TRUE

How is Memory Tiering configured in terms of DRAM to NVMe ratio? A 4:1 DRAM to NVMe ratio would be 25%, 1:1 would be 100%. So if you have it set at 4:1, with 512GB of DRAM you would only use 128GB of the NVMe at most, regardless of the size of the device.

esxcli system settings advanced list -o /Mem/TierNvmePct

Is memory tiered or not? Find out all about it via memstats!

memstats -r vmtier-stats -u mb

Want to show a select number of metrics?

memstats -r vmtier-stats -u mb -s name:memSize:active:tier1Target:tier1Consumed:tier1ConsumedPeak:comnsumed

So what would the outcome look like when there is memory tiering happening? I removed a bunch of the metrics, just to keep it readable, “tier1” is the NVMe device, and as you can see each VM has several MBs worth of memory pages on NVMe right now.

 VIRTUAL MACHINE MEMORY TIER STATS: Wed Dec 17 15:29:43 2025
 -----------------------------------------------
   Start Group ID   : 0
   No. of levels    : 12
   Unit             : MB
   Selected columns : name:memSize:tier1Consumed

----------------------------------------
           name    memSize tier1Consumed
----------------------------------------
      vm.533611       4096            12
      vm.533612       4096            34
      vm.533613       4096            24
      vm.533614       4096            11
      vm.533615       4096            25
----------------------------------------
          Total      20480           106
----------------------------------------

What do I do after a vSAN Stretched Cluster Site Takeover?

· · 4 Comments

Over the last couple of months, various new vSAN features were announced. Two of those features are around the Stretched Cluster configuration, and have probably been the number 1 feature request for a few years. Now that we have Site Takeover and Site Maintenance functionality available, I am starting to get some questions about the impact of them, and in particular, the Site Takeover functionality is raising some questions.

For those who don’t know what these features are, let me describe them briefly:

Site Maintenance = The ability to place a full vSAN stretched cluster Fault Domain into maintenance mode at once. This ensures that all hosts within the fault domain have consistently stored the data, and all hosts will go into maintenance mode at the same time.

Site Takeover = This provides the ability when a Witness and a Data Site has failed to bring back the remaining site through a command line interface. This will reconstruct the remaining “site local” RAID configuration, making the objects available again, which will then allow vSphere HA to restart the VMs.

Now, the question that the above typically raises is what happens to the Witness and the Data Site that failed when you do the Site Takeover? If you look at the VMs RAID configuration, you will notice that both the Witness and the Data Site components of the sites that failed will completely disappear from the RAID configuration.

Can I replicate, or snapshot, my vSAN Stretched Cluster Witness appliance for fast recovery?But what do you do next, because even after you run the Site Takeover, you still see your hosts and the witness in vCenter Server, and you still see a stretched cluster configuration in the UI. Now at first I thought that if the environment was completely up and running again, you had to go through some manual effort to reconstruct the stretched cluster. Basically, remove the failed hosts, wipe the disks, and recreate the stretched cluster. This is, however, not the case.

In the example above, if the Preferred site and the Witness site return for duty, vSAN will automatically discard the stale components in those previously failed sites. It will recreate new components for all objects, and it will do a full resync of the data.

If you end up in a situation where your hosts are completely gone (let’s say as a result of a fire), then you will have to do some kind of manual cleanup as follows, before you rebuild and add hosts back:

  • Remove the failed hosts from the vCenter inventory
  • Remove the witness from the vCenter inventory
    • Delete the witness from the vCenter Server it is running, a real delete!
  • Delete the surviving Fault Domain, this should be the only Fault Domain still listed in the vCenter interface
  • You now have a normal cluster again
  • Rebuild hosts and recreate the stretched cluster

I hope that helps,