PFE Virtualization Blog

Windows Server 2012 Failover Clustering Dynamic Quorum

2012-10-25T13:17:24Z

Hello community,

Today I want to point you to a really useful blog of one of our community contributors - Aeval Shah – who has written an interesting blog about the new WS 2012 Failover Clustering Dynamic Quorum. Please go here ( http://blogs.technet.com/b/aevalshah/archive/2012/08/21/windows-server-2012-failover-clustering-dynamic-quorum.aspx ) to read his blog.

Many thanks Aeval!

Hyper-V and BIOS power plans (c-states)

2012-09-14T08:59:37Z

“Scotty, I need more power!”

Growing up watching Science Fiction programs, one of my favorite characters was Scotty from Star Trek. He always came through in a tough situation with an answer that would get more performance or power from the Enterprise when they needed it the most.

On that note, let’s talk about some power settings on your Hyper-V hosts. Microsoft works with the hardware vendors to try to have the best default settings for servers out of the box – balancing power loads and performance. At customers sites though, we have seen instances where tweaking the power settings is needed to provide the best performance for your Hyper-V Hosts.

How long does it take for you to do a live migration between hosts?

I ask that of all the customers I talk to that are using Hyper-V. If your answer is more than 30 seconds, then you should probably look at the settings mentioned below. This timeframe also depends on the load of the host, the load of the VM, the Live Migration network, and the amount of memory the VM is using. But, if you have a VM with 4GB of RAM that is not doing anything (a completely new VM for example) the cluster is not under a heavy load, and it takes longer than 30 seconds to Live Migrate, then this blog post is for you. I have been to some customers where a Live Migration took over 3 minutes – and one of them was even closer to 10 minutes!

In the BIOS of newer servers, there are Power Plan options. We have seen different setting depending on the make and model of the server. Below are the general settings we recommend changing.

On HP servers, we have found the following settings are sometimes needed:

HP Power Plan:	Maximum Performance
HP Power Regulator:	HP Static High Performance Mode
Minimum Processor Idle Power Core State:	C6 State
Minimum Processor Idle Power Package State:	Package C3 State

On Dell servers, we have found the following settings are sometimes needed:

Power Setting:	High Performance
C1E:	Disabled
C State:	Disabled

I hope this helps your Live Migrations move at “Warp speed”!

David Hail | Premier Field Engineer – Platforms
Microsoft Services | US, Central Region, Heartland
dhail@microsoft.com

Hyper-V Cluster Shared Volume Monitoring

2012-02-20T23:55:00Z

My name’s Thomas Roettinger and I am a private cloud and virtualization Premier Field Engineer over Microsoft Germany. Today I am writing about the availability of Cluster Shared Volume monitoring in System Center Operations Manager.

The new monitoring rule set is named “Windows Server Cluster Shared Volume Monitoring” and the version number is 6.0.6057.0.

This extension was released on 9/30/2011 so it is fairly new. The previous Cluster Management Pack did not include a rule for CSV monitoring.

A lot of customers implemented a workaround with a PowerShell script that was released by Simon Perriman and NOW you can use a built in management function.

When opening the Operations Manager Console you should search the online catalog within the Import Management Packs dialog.

Browse the Core OS folder and select Cluster Shared Volume Monitoring. Keep in mind that this new MP has dependencies to all Windows Server Library running latest version 6.0.6957.0

As soon as the import was successfully done you can switch to Monitoring at the Operation Manager Console. While expanding Microsoft Windows Server you should see a new entry in “Health Monitoring” for Cluster Shared Volume Health.

Also at Performance you should see Cluster Share Volume Disk Capacity (Free Space) .

As always I hope you find this Blog entry useful.

Hyper-V Dynamic Memory and Host Memory Reserve setting

2011-08-29T08:31:00Z

My name is Nick Eales and I am a Premier Field Engineer based in Sydney, Australia. I specialize in Hyper-V and Failover Clustering.

Today I am writing about the following registry setting for Hyper-V’s Dynamic memory which was introduced with Windows Server 2008 R2 Service Pack 1

Registry Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization

Value Name: MemoryReserve

Value Type: REG_DWORD

(Value is set in decimal, and is in megabytes. It needs a reboot to take effect)

As Hyper-V can now dynamically allocate memory to virtual machines on demand, the host needs to ensure that some memory is kept for itself. This registry setting enables the amount of memory reserved for the host OS to be manually set for scenarios where the default is not appropriate.

There are many comments, blog posts, and articles around that suggest setting this value. Some state that the default is 32MB (very wrong). Recommended values range from 1024 to 2048.

I read a lot of these and as they all recommended that this value be set and I didn’t want to run into any problems on our team’s Hyper-V server, I had a go and set this value to 1024 (1GB).

A month later, I had a look at our Hyper-V server and found out it had 11MB of memory available. While VM’s were running relatively normally, the host OS was running extremely poorly, which was making management of the host very difficult. Hyper-V had allocated so much memory to the VMs, that it had starved the host (no memory for disk cache, many services were crippled, etc.).

I decided to do some more research on this value to find out why a non-default value is needed, and what the default value is.

In summary, for Hyper-V in Windows Server 2008 R2 SP1 the default value for this is calculated based on the following formula:

384MB + 30MB per 1GB of physical memory on the host machine.

(For a machine without SLAT (Second Level Address Translation) enabled CPUs, it is slightly higher)

So for my SLAT enabled Hyper-V server with 64GB RAM, this would mean the default value is:

Note: The above calculation only applies to Windows Server 2008 R2 SP1 / Hyper-V Server 2008 R2 SP1. Later operating systems use a very different calculation and we strongly suggest re-evaluating the need to change this setting from the default (to set it to the default, delete the registry value).

384 + (30 * 64) = 2304 (MB)

This explains why:

Some sites suggest setting this value – on a machine with less than 32GB of RAM the default value would be too low to allow the machine to be used for other applications.
Setting the value (as I mistakenly did) to a value significantly less than the default (eg 1024MB on a 64GB machine) might have a negative effect on performance

So my recommendation is as simple as;

If (as per best practice) you use only Hyper-V on your servers and your drivers, backup, antivirus and other applications do not use a lot of memory, then leave this value at the default (i.e. it should not be present).
If you run virtual machines at the same time as other applications or services (Outlook / Domain Controller), then calculate the default value for your machine, and add to this a number sufficient for your applications. Please note that by running other services and applications on the host, you will be non-compliant with Microsoft Hyper-V best practices.

Hyper-V VM Partition Alignment

2011-08-08T17:08:09Z

Hello everybody. This is Cristian Edwards Sabathe from Microsoft Spain. Today I am really happy to write my first post on our new World Wide Virtualization PFE blog. Our team has lots of talented PFEs and I am a lucky man to be part of it. I am pretty sure this blog is going to be a good reference for the community and I hope I can contribute with useful content.

Now let’s talk about a subject that some of you might have heard before.

One of the configurations we analyze during the Hyper-V Health Checks is the disk partition misalignments within the VMs (Virtual Machines) because this can impact the Hyper-V storage performance.

We also validate this configuration at host level but this will not be an issue in most cases because partitions created with Windows Server 2008 R2 are aligned by default using the 1,048,576 bytes starting at offset (1024KB). So when installing the Host OS you use the wizard to create the partition you can be sure that is already aligned. Of course, if you create a partition on a new disk from Disk Management console on Windows Server 2008 R2 it will be aligned too.

Note: The intention of this post is not to explain what the partition misalignment (as it’s already been well explained on the following articles) but I am just adding information to cover this topic when Hyper-V is part of the equation.

Disk Partition Alignment Best Practices for SQL Server

http://msdn.microsoft.com/en-us/library/dd758814(v=sql.100).aspx

Disk Partition Alignment (Sector Alignment) for SQL Server: Part 1: Slide Deck

http://blogs.msdn.com/b/jimmymay/archive/2008/10/14/disk-partition-alignment-for-sql-server-slide-deck.aspx

Disk Partition Alignment (Sector Alignment) for SQL Server: Part 4: Essentials (Cheat Sheet)

http://blogs.msdn.com/b/jimmymay/archive/2008/12/04/disk-partition-alignment-sector-alignment-for-sql-server-part-4-essentials-cheat-sheet.aspx

Disk Partition Alignment (Sector Alignment): Make the Case: Save Hundreds of Thousands of Dollars

http://blogs.msdn.com/b/jimmymay/archive/2009/05/08/disk-partition-alignment-sector-alignment-make-the-case-with-this-template.aspx

Assuming that the partition where you place your VHDs is aligned we need to go one step deeper and validate that the NTFS partition inside the VHD that will be used by the Guest operating system is also aligned.

If the guest operating system is Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2 and the partitions were created using one of these operating systems you don’t have to worry because they will be aligned.

Unfortunately, partitions created with Windows Server 2003 and Windows XP will have the default starting offset 32,256 bytes, (31.5 KB) and will be misaligned.

The picture below has 5 rows and assumes that your starting offset is set at 32,768 bytes. I decided to use the same pattern that is in the above MSDN articles to be consistent with the SQL team example.

The first black row represents a stripped volume from the SAN that is using 64k block allocation unit size. This means that data will be read and write on pieces of 64K.

The second grey row represents the number of physical sectors contained on each SAN block allocation unit size.

In this case the SAN block size is 64K (65536 bytes). Note that this value has to be provided by your SAN vendor. If you divide 65536 by the physical sector size (512 bytes) you are going to have 128 sectors on each SAN block.

Starting at the third blue row you can see a NTFS partition with the default cluster size (4K). Now we have 2 different block sizes. The stripped SAN block size and the NTFS block size. We can say that NFTS partition is aligned with the stripped volume because 64K is divisible by 4K and that fits perfect without crossing any block boundary. One SAN block will contain 32 NTFS 4K blocks with the exception of the first block that is shared with the MBR information.

The fourth orange layer represents a VHD file placed on the NTFS partition and has no block information at all. Fixed VHD file structures are transparent at block size level to improve performance.

The fifth blue row with 63KB marked in red is a NTFS partition inside the VHD file that has a misaligned starting offset 32,256 bytes, (31.5 KB). This means that data will be written starting at sector 128, which is the last sector of the SAN block.

So, two SAN blocks will be accessed if the OS inside the VM needs to read or write data on the firsts 8K. This will degrade the performance because it requires two accesses to the SAN disks instead of just using one disk IO within the same SAN block.

The most common cases for this problem are Windows Server 2003 or Windows XP VMs where the partitions were created using the default method instead of using Diskpart.exe to define an aligned starting offset.

If you perform a P2V (Physical to Virtual) of a Window Server 2003 machine and it has a misaligned partition you also going to bring the same issue to your VM.

The last blue row with 64KB marked in green is a NTFS partition inside the VHD file that has an aligned partition. Any IO inside VMs will use only the necessary IOs at SAN level because the block boundaries are aligned.

How can you detect it?

You can use the following command to list your partitions starting offset inside your VMs and make an easy operation. Divide the StartingOffset value by the block size value. If the returned value is an integer without decimals your partition is aligned at NTFS level. In the example below this operation (1048576 / 512 = 2048) for the first partition on disk 0 results on 2048, which is an aligned partition.

Once you are sure that your partition is aligned at NTFS level inside the VM, you should check the same but at Host level. To do that you need to run the same command in your Hyper-V host and divide the StartingOffset by the Stripped allocation unit size provided by your SAN vendor. In the picture above we use an example of 64KB SAN block size, which means we need to divide the starting offset by 65536 bytes. If we assume that partition where the VHDs are placed was created using WS2008 R2, the operation will be (1048576 / 65536 = 16). The resulting value is 16 and this means that the partition where the VHD is placed is also aligned.

You can find more examples and information in the following link.

Disk performance may be slower than expected when you use multiple disks in Windows Server 2003, in Windows XP, and in Windows 2000

http://support.microsoft.com/kb/929491

Command: wmic partition get BlockSize, StartingOffset, Name, Index

How can you fix the issue?

Unfortunately there isn’t any easy solution for this problem. If your VMs have misaligned partitions you will have to reformat the partitions using the procedure documented in the following KB;

Disk performance may be slower than expected when you use multiple disks in Windows Server 2003, in Windows XP, and in Windows 2000

http://support.microsoft.com/kb/929491

Hope that helps and see you in next posts.

ARP Spoofing Prevention in Hyper-V 2008 R2 SP1

2011-08-02T21:41:00Z

Note: This article only applies to Windows Server 2008 R2 SP1. Please refer to this site if you want to learn how to implement ARP Spoofing in Windows Server 2012 using Port ACLs http://blogs.technet.com/b/wincat/archive/2012/11/18/arp-spoofing-prevention-in-windows-server-2012-hyper-v.aspx

My name’s Thomas Roettinger and I am a private cloud and virtualization Premier Field Engineer over Microsoft Germany. I’m proud to be submitting my first blog post in our brand new PFE Virtualization Blog. Today I am blogging about a new network feature that is made available in Hyper-V R2 SP1.

This feature is called ARP Spoofing Prevention and is not exposed through Hyper-V or SCVMM 2008 R2 SP1 management consoles.

Many private cloud hosters are looking for a functionality to make sure that customers can’t compromise a virtual machine by changing the IP Address.

This also a nice option when you plan to virtualize your workload inside Perimeter Network.

This is the technical explanation of the ARP Spoofing Prevention functionality:

ARP spoofing is a man-in-the-middle attack technique that is used to attack an Ethernet local area network (LAN). The attacker associates a MAC (media access control) address with the IP address of another node by sending fake ARP messages to an Ethernet LAN. Therefore, the attacker can capture data frames that are sent to another node (here Virtual Machine attached to the same virtual switch).

So, what can Hyper-V R2 SP1 do to harden your workload against this attack?

Checks the mapping of a MAC address and respected IP address in a virtual switch
WMI API to associate a MAC address with an IP address in a virtual switch
Protect against an ARP for IPv4 response or an NDP for IPv6 response

Technical Requirements:

Windows Server 2008 R2 Service Pack 1
Windows Hyper-V Server 2008 R2 SP1

Here’s a PowerShell sample script to enable the virtual machine named "TestVM” to only communicate with the IP Address 192.168.0.1

$VmName = "TestVM"

$Msvm_ComputerSystem = (Get-WmiObject -Namespace root\virtualization `

  -Class Msvm_ComputerSystem -Filter "ElementName='$VmName'")

#Retrieve all Msvm_SyntheticEthernetPort's associated with this VM

#  there will be one per Synthetic NIC

$Msvm_SyntheticEthernetPortCollection = `

 $Msvm_ComputerSystem.GetRelated("Msvm_SyntheticEthernetPort")

#This will get the last object in a collection or if the collection

#  has one object just that object

$Msvm_SyntheticEthernetPort = $Msvm_SyntheticEthernetPortCollection | % {$_}

#There will only ever be one Msvm_VmLANEndpoint per

#  Msvm_SyntheticEthernetPort

$Msvm_VmLANEndpointCollection = `

 $Msvm_SyntheticEthernetPort.GetRelated("Msvm_VmLANEndpoint")

$Msvm_VmLANEndpoint = $Msvm_VmLANEndpointCollection | % {$_}

#There will only ever be one Msvm_SwitchPort per Msvm_VmLANEndpoint

$Msvm_SwitchPortCollection = `

 $Msvm_VmLANEndpoint.GetRelated("Msvm_SwitchPort")

#This will get the last object in a collection or if the collection

#   has one object just that object

$Msvm_SwitchPort = $Msvm_SwitchPortCollection | % {$_}

$Msvm_SwitchPort.PreventIPSpoofing=$true

$Msvm_SwitchPort.AllowedIPv4Addresses= (, "192.168.0.1")

$Msvm_SwitchPort.Put()

And the following PowerShell sample script allows communication with all IP Address again:

$VmName = "TestVM"

$Msvm_ComputerSystem = (Get-WmiObject -Namespace root\virtualization `

  -Class Msvm_ComputerSystem -Filter "ElementName='$VmName'")

#Retrieve all Msvm_SyntheticEthernetPort's associated with this VM

# there will be one per Synthetic NIC

$Msvm_SyntheticEthernetPortCollection = `

 $Msvm_ComputerSystem.GetRelated("Msvm_SyntheticEthernetPort")

#This will get the last object in a collection or if the collection

#  has one object just that object

$Msvm_SyntheticEthernetPort = $Msvm_SyntheticEthernetPortCollection | % {$_}

#There will only ever be one Msvm_VmLANEndpoint per Msvm_SyntheticEthernetPort

$Msvm_VmLANEndpointCollection = `

 $Msvm_SyntheticEthernetPort.GetRelated("Msvm_VmLANEndpoint")

$Msvm_VmLANEndpoint = $Msvm_VmLANEndpointCollection | % {$_}

#There will only ever be one Msvm_SwitchPort per Msvm_VmLANEndpoint

$Msvm_SwitchPortCollection = $Msvm_VmLANEndpoint.GetRelated("Msvm_SwitchPort")

#This will get the last object in a collection or if the collection

#  has one object just that object

$Msvm_SwitchPort = $Msvm_SwitchPortCollection | % {$_}

$Msvm_SwitchPort.PreventIPSpoofing=$false

$Msvm_SwitchPort.AllowedIPv4Addresses=$null

$Msvm_SwitchPort.Put()

This sample script is also cluster aware but you must refresh Virtual Machine’s configuration within the Failover Cluster Management Console.

Please keep in mind that this feature is different from MAC Spoofing that has been available since Windows Server 2008 R2 Hyper-V.

I hope you find this blog post helpful.

Disclaimer: Any software (or sample code) provided in this blog is not supported under any Microsoft standard support program or service. The sample code is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the software and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the software be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the software or documentation, even if Microsoft has been advised of the possibility of such damages. Please test the sample code before implementing in your production environment.