Yellow Bricks

by Duncan Epping

VMware

Limiting your vCPU

· ·

I had a discussion with someone around limiting a VM to a specific amount of Mhz’s after I found out that limits where set on most VMs. This environment was a “cloud” environment and the limit was set to create an extra level of fairness.

My question of course was doesn’t this impact performance? The answer was simple: No as a limit on a vCPU is only applied when there’s a resource constraint. It took me a couple of minutes to figure out what he actually tried to tell me but basically it came down to the following:

When a single VM has a limit of 300MHz and is the only VM running on a host than it will run it full speed as it will be constantly rescheduled for 300MHz.

However, that’s not what happens in my opinion. It took me a while to get the wording right but after a discussion with @frankdenneman this is what we came up with:

Look at a vCPU limit as a restriction within a specific time frame. When a time frame consists of 2000 units and a limit has been applied of 300 units it will take a full pass, so 300 “active” + 1700 units of waiting before it is scheduled again.

In other words applying a limit on a vCPU will slow your VM down no matter what. Even if there are no other VMs running on that 4 socket quad core host.

Would I ever recommend setting a limit? Only in very few cases. For instance when you have an old MS DOS application which is polling 10000 times a second it might be useful to limit it. Personally witnessed they can consume 100% of your resources, unnecessary as it isn’t doing anything actually.

In most cases however I would recommend against it. It will degrade user experience / performance and there is no need in my opinion. The VMkernel has got a great scheduler which will take fairness into account.

Hytrust Labs….

· ·

During VMware Tech Summit last week one of the few Labs I did get to do myself was the Hytrust Lab. Roughly a year ago I first got introduced to Hytrust.

Hytrust is a policy driven appliance which enhances security and auditing for virtualized environments. Although I had seen multiple demos I had never actually played around with it. I must say I was pleasantly surprised at Tech Summit.

Hytrust sits in between you, the user/admin, and the vCenter/ESX. Basically it proxies the requests based on your role. If the role has no permissions on the specific “task” it will return a message stating “permission denied by Hytrust”.

Now that sounds cool doesn’t it? I guess what was even more impressing was the fact that with Hytrust this also works on ESXi. Yes you are reading that correct, role based “unsupported” mode access to ESXi, that’s something VMware doesn’t even offer at the moment. I tested it, it works great! (Yeah I know it is still not supported, but it does offer a solution to those who need it.)

Another cool thing is the configuration templates for Hosts. It basically enables assessment of security configuration. Hytrust contains several pre-built templates including for instance VMware’s Security Hardening Best Practices. Not only assessment but also the option to remediate when needed.

And I haven’t even talked about the auditing functionality yet. As Hytrust proxies all commands, it is just a small step for them to log all the info and make it audit-able….

After playing around with in Hytrust I fully understand why Cisco invested, it rocks. Just try it out. The Community Edition, free for up to three hosts is available here: Hytrust Appliance v2.0 Community Edition

HA Retries

· ·

I am working on a special project at the moment. I noticed something I never realized before and wanted to share it with you guys. When a restart of a VM fails VMware HA will retry this.

The amount of VMware HA retries is configurable as of vCenter 2.5 U4 with the advanced option “das.maxvmrestartcount”. The default value is 5. Pre vCenter 2.5 U4 HA would keep retrying forever which could lead to serious problems as described in KB article 1009625 where multiple virtual machines would be registered on multiple hosts simultaneously leading to a confusing and inconsistent state.(http://kb.vmware.com/kb/1009625)

Important to note is that HA will try to start the virtual machine on each of the hosts in the affected cluster, if this is unsuccessful the restart count will be increased by 1. In other words, if a cluster contains 32 hosts HA will try to start the virtual machine on all hosts and count it as a single try. Something I definitely never realized and something that definitely is worth knowing.

Changing the directory of your vSphere vCenter log files

· ·

Something that a lot of people haven’t looked in to or just don’t think about is relocating the log files of vCenter, I wrote a short article 2 years ago and thought it was time to reiterate it. By default (Windows 2003) log files are stored in “C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\Logs”, and for Windows 2008 log files are stored in “C:\ProgramData\VMware\VMware VirtualCenter\Logs”.

As you can imagine the C:\ partition is not the ideal place for storing log files. I would personally recommend to use a separate drive for logfiles so avoid it from flooding any OS or Program related drives. You could pick a small size based on the expected log size and if needed increase the amount of logs that are stored and the size of the log file.

Changing this is pretty simple. Open “vpxd.cfg” and add the following line in between <log> and </log>

<directory>D:\VMware\Logs</directory>

Changing the amount of log files stored and the size is also pretty basic, in this example vCenter will store 10 logfiles which are max 10MB each:

<maxFileSize>10485760</maxFileSize>
<maxFileNum>10</maxFileNum>

Keep in mind that you will need to restart the vCenter Service after these changes before they take effect!

Creating a VMware Converter Appliance

· ·

I was playing around with VMware Converter and thought it would be cool to create a VMware Converter Appliance. I can’t put this up for download, yet, but I can describe how to build your own appliance. I will use Novell’s Suse Studio to create a thin Linux VM that contains only the necessary bits and pieces.

  • Go to susestudio.com and open an account
  • Click “Create New Appliance”
  • Select “GNOME Desktop” and click “Create Appliance”
  • Change the name of the appliance to something that makes a bit more sense…
  • I would personally add “File Roller” and “GCC” so that you can actually open archives from the GUI and make modules, which is need to install VMware tools.
  • Go to the  “Configuration Tab” and click on “Appliance”
  • Increase the memory to 1024MB for a better running appliance
  • Download VMware Converter Standalone for Linux and add it as a file in the “Overlay Files” tab
  • When uploading is finished select a folder where the tar.gz file should be extracted, I picked “/vmwconverter”
  • Click on the “Build” Tab and wait for it to complete

It’s as easy as that! With SUSE you have the option to Test Drive it and make changes to the image while test driving it. I would recommend to just download it and install VMware Converter while running the VM with VMware player. Or you could import it with vCenter and run it on an ESX host. This way you can also install VMware tools immediately.

  • Open the VMX file with VMware Player
  • Install VMware Tools:
    Right click VM “install VMware tools”
  • Open a terminal session within the VM and type: 
    cd /media/VMware Tools
tar -C /tmp -xvf <VMware Tools File>
/tmp/vmware-tools-distrib/vmware-install.pl

    Agree with all the defaults…

  • Now to install VMware Converter open a terminal session and do the following: 
    cd /vmwconverter/vmware-converter-distrib
    ./vmware-install.pl

    Use all the defaults!

  • You can add an icon to the desktop by right clicking the desktop and selecting “Create Launcher”
  • Select “/usr/bin/vmware-converter-client”
  • And add the correct icon! (/usr/share/icons/vmware-converter.png)

Now your appliance is good to go and can be used everywhere in your virtual infrastructure. I would recommend making it a template or vApp and deploy it multiple times when doing many parallel migrations!