Stuff from stuf

Exercising live migration

2009-10-10T08:30:40Z

One of the scenarios that we had running at TechEd NZ was a continuous live migration between two hosts which I had set up using Virtual Machine Manager & the Powershell components. Someone asked for it internally, and I thought I’d post it here in case anyone else would find it useful.

This is useful if you want to do any long running tests of live migration, and record the number of migrations you have done.

To set up, create C:\temp\counter.txt and edit it so that it has a single line which has the content 0. It uses this text file to record the number of migrations (it also stores in memory but uses the file in case you have to restart the script for any reason). Edit the script to replace the following fields:

vmmhost.yourdomain.com –> FQDN of your VMM Server

HyperVHost1.yourdomain.com –> FQDN of Hyper-V host 1

HyperVHost2.yourdomain.com –> FQDN of Hyper-V host 2

VMName –> Name of the VM you are going to migrate.

There is also a random delay introduced at the end of the script so the migration is not predictable.

get-vmmserver -computername "vmmhost.yourdomain.com"
$vm = get-vm | where { $_.Name -eq "VMName"}
$host1 = get-vmhost | where {$_.Name -eq "HyperVHost1.yourdomain.com"}
$host2 = get-vmhost | where {$_.Name -eq "HyperVHost2.yourdomain.com"}

Do
{

if ($vm.VMhost -eq "HyperVHost1.yourdomain.com")
{$desthost=$host2}
else
{$desthost=$host1}

move-vm -vm $vm -vmhost $desthost -jobvariable movejob
if ($movejob.Errorinfo.DetailedCode -eq 0)
{
$rawmigrations = get-content -Path C:\temp\counter.txt -TotalCount 1
$migrations = [int32] $rawmigrations
$migrations++
$migrations
set-content -Path C:\temp\counter.txt -value $migrations
}
$wait=get-random -minimum 60 -maximum 240
start-sleep -seconds $wait

}
while ($true)

To enhance this you could also randomise the guest that is being migrated, and if you have more than a two node cluster you could randomise the destination host. If I get bored over the next few weeks I’ll update it so that it does these things.

Application Virtualisation – Agent or Agentless Part II?

2009-06-12T06:09:18Z

In my previous post I talked about some of the advantages of using agent based technology to deliver virtual applications. There were a couple of things that I forgot to include when I wrote that post. So continuing on from that list, here are the extras:

5. Inventory

If I’ve got my application content separated from my agent, I can now query my agent to find out what applications are present on my machine. That means using tools like System Center Configuration Manager I can find out which virtual applications are where (just because they’re virtual doesn’t mean you don’t have to pay for them).

6. Usage information

My agent can now collate all the usage information about my virtual applications and report that into a single location, using a single mechanism that is independent of the virtual application itself. Now I can get accurate information about how my users are using the virtual applications, and use that to optimise my licensing.

Those 6 points demonstrate that to truly be effective with virtualisation, the management component is essential. And the only way to effectively provide an application virtualisation solution that is enterprise ready is to use an agent based technology. Anyone selling you an agentless application virtualisation solution is not selling you any cost savings or flexibility, they are selling you complexity and overhead.

Application Virtualisation – Agent or Agentless?

2009-06-05T05:15:18Z

One of the things I sometimes hear from my customers when we’re talking about Application Virtualisation is “why do you need an agent for virtualising applications, especially when some of your competitors don’t?”. My answer to them is “what do you think an agentless solution does except introduce management overhead?”. Sure it looks attractive in the short term since all you have to do is distribute an executable to your clients and they can run virtual applications.

However I can think of several reasons why an agent based technology is superior.

1. Management of the virtualisation agent

Let’s say that I discover a security vulnerability in my virtualisation agent, or I want to add new capability to my application virtualisation client (for instance, in the App-V 4.5 release, we added the capability to stream over HTTP). If I’m using an agentless technology and want to update my client, I have to go off and rebuild every package that I’ve deployed, and then redistribute that package to each of my clients. With agent based technology I just deploy an update to my agent software and can leverage that new technology without rebuilding my application packages.

In addition, if I want to know what version of my virtualisation agent that is in the packages it out there, I can’t really do that.

2. Duplication of resources

If I have an agent based technology, when I launch a virtual app I’m sharing all the same agent resources as any other virtual apps (CPU/Memory/Disk etc). When I’m running agentless, every virtual app that I launch starts it’s own instance of the virtualisation agent, each adding it’s own overhead to the process.

3. Speed

If I have to extract the agent and execute it every time I launch the application, that adds overhead to my application launch time.

4. Scriptability

Because we’ve separated the virtual application content from the virtual application client, now we can do some more interesting things with the client. Things like prepopulating the cache with certain applications, or removing applications from the machine at the command line.

Overall having the virtual application content separated from the virtual application client allows us to have a more manageable implementation, and this will in turn lead to significantly reduced cost of ongoing maintenance over an agentless environment. If you can’t manage your virtual apps, you’ve missed half the benefit of having them virtualised in the first place.

Save money managing your virtual hosts

2009-05-27T07:42:19Z

As I said in my post below, I read a lot of blogs. I’ve been meaning to write a response to a post I read on Vcritical.com for a while, and haven’t got around to it. Vcritical is written by Eric Gray who is a VMware employee, so clearly he has a biased view, much as I do given my employer :). However it’s always fun to debate the issues, and we shouldn’t shy away from respectful disagreement.

Eric wrote a post a while back “Save $14970 on VMware ESX Management” where he said to save money managing your VMware hosts, don’t use Virtual Machine Manager, and then pointed out that the cost of the Server Management Suite Enterprise license is $1,497 per physical host.

I think Eric is understating the value that the SMSE license brings. SMSE doesn’t just give you the Operations Manager management license for the host, but also for all the guests running on that host, along with the management agents for Configuration Manager, Data Protection Manager & Virtual Machine Manager. So now we get detailed information about what’s going on at the host level, but detailed application level information about what’s going in all the guests, plus backup, plus inventory, plus patching, plus software distribution, plus desired configuration management, plus self service VM provisioning, plus a whole bunch of other capability.

For me the deep application information is really important. Sure you could take a black box view of the VM and just treat it as a CPU & memory & disk IO consuming thing, but just because it’s virtualised doesn’t mean you don’t want to know what’s going on in that VM. If that VM is running BizTalk you’d want to know that the BizTalk services are behaving the way they should, if the VM is running Exchange you want to know that mail is flowing, if it’s running SQL you want to know that the SQL databases aren’t running out of space. The black box view is great if all you want to do is play musical chairs with your VM’s, but if you really want to know that they’re doing what they’re supposed to, you need deep application knowledge. And that’s where Operations Manager excels.

And forget that Eric tells you that PRO is too hard to configure – it’s not.

Just to be explicit on my comment policy: comments are moderated on this blog, but I’ll publish every comment that isn’t offensive, spam or defamatory. It just takes me a while sometimes.

Rethinking the guest?

2009-05-27T07:16:21Z

I love working in the IT industry. Apart from being involved in an industry that is constantly changing and evolving, there are also lots of smart people out there who are doing & saying stuff that is interesting & challenging. I read a lot of blogs, and I read a lot of blogs of people who are working with competitors technology, or doing things that aren’t in my area of focus. I read an interesting post recently on the vinternals.com site called Rethinking the guest. I was going to comment on the post there, but thought I would blog my response instead.

Stu who posts there is a VMware guy and has a lot of interesting things to say. This post touches my area of work (Systems Management) and challenged me to think about how we do stuff, and how our world might evolve – thanks Stu!

Stu’s theory is that agent based management of guests needs to change, and posted four key areas where things could be done better. I find myself half agreeing and half disagreeing with him.

His first point is that managing patching with an agent is probably not efficient, and a sub point was that an enterprise software management system will likely do other stuff like hardware & software inventory, but we should disable hardware inventory because Vcenter captures that. I think that misses the important point that a lot of these systems that capture inventory then pass that information up to other systems (like your CMDB) and it’s nice to have a consistent place to capture that. I know that with System Center Configuration Manager I can grab all the information about my Windows inventory (software & hardware, physical or virtual) from a single place, and with partners like Quest I can grab information about my non-Windows environment as well from the same location. Do we need to complicate our environment by splitting our virtualised hardware inventory from our physical hardware inventory, or from our desktop inventory? And what if we want to do other things with our inventory system like baselining our desired configurations?
And agentless patch management is not without it’s problems. What about when the machine is turned off or unreachable (maybe the Windows Firewall is switched on)? What about when we want more control over when things happen – agentless patching can be good, but I think we give up control of a lot.

His second point is that agentless monitoring is also possible with the new Windows eventing subsystem. Again, that only gives us a subset of the information that we might care about. If all I care about is what events are being logged in the event log then sure, maybe that’s a potential solution. But what if I want deeper information? What if I want to be alerted when my disk space is low? What if I want deeper information about what an application is doing? If I really want to understand what my application is doing, merely looking at Windows events simply isn’t enough. I need to look at more metrics than events expose. That’s where System Center Operations Manager excels – and then using the PRO functionality inside Virtual Machine Manager we can use that contextual information to make smart decisions about remediating problems. Which might be live migrating/Vmotioning a machine to another node, or it might be provisioning a new VM to take the extra load because we’ve hit an OS limit that providing extra resource can’t solve.
And don’t get me started on SNMP. SNMP is an overcomplicated, insecure (at least until SNMP v3) mess that is great for monitoring simple network devices, but it really shows it’s age. And you simply don’t get the depth of information about Windows devices with SNMP.

His third point – backup. All I can say is, good to see VMware catching up on the great backup tools we have available with System Center Data Protection Manager which provides the same functionality but across physical and virtual environments. :)

I’ll skip VMsafe for now, I don’t know enough about it to comment – but I guess virtualisation will require security models to evolve, and VMsafe looks like one step in the process.

But his overall point – this will hinder the move to the cloud. This is where I start to agree. I think it probably will, and it’s one of the things people will have to consider when they look at their cloud strategy. So he’s right in that things have to change, but I’m not sure that the alternatives he’s proposed are good ones yet. It’s going to be interesting to see how the management tools industry does evolve to take into account the cloud. I’m just glad I’m here to see what happens!

Monitoring service levels in ops Mgr r2

2009-05-25T03:39:51Z

I’ve just been playing with the new Service Level Dashboard for System Center Operations Manager 2007 R2. It’s a great improvement on the first version, and it’s pretty straightforward to set up. I thought I’d document the steps I took to configure it, although if you just follow through the documentation you’ll get there pretty easily.

First the prerequisites:

1. Install Operations Manager 2007 R2

2. Install Windows SharePoint Services 3.0 (You need to install against SQL, not against the internal Windows database)

3. You’ll need to import the Service Level Dashboard management pack into Ops Mgr

4. Install the Service Level Dashboard following the wizard – it’s pretty straightforward.

5. Make the following change to the web.config file for the Service Level Dashboard application that gets created (by default it’s stored in C:\inetpub\wwwroot\wss\VirtualDirectories\51918) and change the line that reads:
<identity impersonate=”false”> to:
<identity impersonate=”true”>

You’ll need to run iisreset after you’ve done this. If you don’t do this, you’ll get a “Cannot complete this action” when you navigate to the home page.

6. Make sure to create a firewall exception for the port that you’ve configured for the Service Level Dashboard.

Now you should be good to go. First thing you need to do is define your service level in the Operations Manager console. Open the console and go to the Authoring pane. Choose the “Service Level Tracking” option.

In the right hand pane, click Create. This brings up the Service Level Tracking wizard. Give it a name.

Now we need to define what we’re interested in tracking for service levels.

The first thing we need to do is select the class that we’re monitoring. Click the top Select button and choose the class that matches what you’re interested in. By default it’s scoped to Distributed Application, but you can change this to Group or All. In this case I’m interested in tracking one of my pre-created distributed applications, so I choose “Distributed Application” from the list.

Now we’ve selected our class, we need to target to a specific object – in this case I’m looking for my distributed application called “OpsMgr Website”. This is a distributed application I created based on the “Line of business web application template” – it monitors the OpsMgr web console & backend database of the OpsMgr server itself.

Also make sure you choose a management pack to store this new service level in.

Now we need to define what our service level objective actually is

Click the Add button and we can define what we want our service level objective to be. I want my app to available at least 95% of the time and I can specify which states count as downtime.

Once I’ve done this, I can now create the service level tracking.

Now that I’ve defined what I need to track, I can then go to the Service Level Dashboard and setup the web page that lets me view this. Navigate to the website you set up when installing the service level dashboard (by default it’s http://localhost:51918). It’s also blank by default. Make sure you log on as an Administrator of the site so that you can make changes.

Go to the Site Actions button, and choose Edit Page. This will bring up the screen below and, all things going well, you should have your service level that you’ve defined available to select. Choose the one you want to monitor, and choose the refresh rate and over what period you want to report. Once you’re done, exit edit mode.

You should now have a nice view of how you’re tracking against your service levels – you can see that I’m not meeting my 95% objective (that’s what happens when you stop the web console web site for a few hours…)

As you can see, the new version of the Service Level Dashboard is easy to set up and provides a great view of how you’re tracking.

PowerPoint from DPM Events

2009-03-22T22:50:00Z

For those that want them, here are the PowerPoint presentations from the DPM Unplugged events that ran in Auckland, Wellington & Christchurch last week. I hope that all who attended enjoyed the events, and got a lot out of them, and thanks to Peter Niven for making it over and working so hard presenting.

OEM Deployment Packs for ConfigMgr

2009-03-05T01:55:15Z

Like I said before, I don't like to use this blog to simply mirror product announcements (although can I just say - the Windows 7 beta rocks!). I talk a lot to customers about Operating System Deployment in System Center Configuration Manager. With the ability to deploy server operating systems with it as well a lot of customers are using the ConfigMgr OSD technology to provide a single provisioning location for their Windows clients and servers. It's a great way to do it, as the technologies are essentially the same. If you can deploy Windows Vista, you can deploy Windows Server 2008. If you can deploy Windows XP, you can deploy Windows Server 2003. However some things a slightly different for servers as they have some unique hardware requirements that you don't have to do on workstations (e.g. configuring the hardware RAID etc etc). This is where our partners at Dell, HP & IBM are extending the ConfigMgr platform and providing tools that plug in to the OSD framework and let you configure their server hardware as part of a task sequence.

Dell released their tool late last month: Dell Deployment Pack for ConfigMgr

IBM released their tool at the end of last year: IBM Deployment Pack for ConfigMgr

Now all we need is the HP pack and we've got the whole set!

Subselect syntax in Config Mgr

2009-03-05T01:07:07Z

I'm mostly posting this as a reminder to myself, but someone may find it useful. This is the subselect syntax for ConfigMgr queries, so you can do a query along the lines of "Show me all the machines that meet criteria X except the machines that meet criteria Y". My SQL skills are weak, so this is my permanent record of this.

select SMS_R_System.Name from SMS_R_System where SMS_R_System.SystemGroupName = "Domain\\GroupName" and SMS_R_System.Name not in (select SMS_R_System.Name from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "ApplicationX")

This particular subselect looks for machines that are members of a particular AD System Group called "Domain\GroupName" (note that you need two backslashes in the query to escape the special character) that don't have an application called "ApplicationX" present in Add/Remove Programs. If you're resourceful you'll be able to modify this to do other stuff as well.

Thanks Jaimie!

User initiated F12 machine rebuilds with Config Mgr OSD

2009-03-05T00:46:00Z

One of the things I often get asked by customers is how do they make it possible for a user to rebuild a failed machine at their desk, without requiring that the machine is moved to a special collection, or other administrative input. There are several problems with doing this:

Config Mgr & the machine (if the OS is running) remember that the machine has run the OS deployment task sequence before, so will not execute the task sequence again. The solution to this is to add a mandatory recurring schedule. However, this means that as long as the machine remains in the collection that the task sequence is targeted at it will try to rebuild itself according to the schedule.
If you advertise a slightly different task sequence at the machine collection without making it mandatory this could get around this (the first time at least), but the user will be prompted that there is an optional operating system deployment available for them. In the standard software distribution case we can suppress this by selecting the "Suppress program notifications" option in the Program. This option is not available when advertising task sequences, so it is not an option here (as useful as it would be).

One of my colleagues shared a great way of making this happen by leveraging the way WinPE behaves. One of the options you get inside the task sequence is to specify which client platform that the task sequence can run on.

This is useful in a number of situations, one where you are doing an OS upgrade and don't want to rebuild machines that are already at the current release. In this case you would say it can run on Windows XP but not Windows Vista. The other situation would be where you are using task sequences to do complicated software installations that need a lot of chained tasks or logic in place, and need to control which OS versions it can run on. However where your OS is in a steady state (e.g. everyone running Windows Vista SP1) then the client platform targeting doesn't help much for operating system deployment, except in the case I outline above. In this case we can now target the task sequence at an operating system you don't have in your environment - in the screenshot above I have selected x86 Windows 2000 Service Pack 4 (you don't still have this right?). In this case we can advertise our task sequence at our collection with our standard machines, make it mandatory & recurring, but because they don't meet the client platform requirement, they will simply ignore the task sequence advertisement.

The magic comes when you PXE boot and run the task sequence inside WinPE. WinPE just ignores any of the client platform requirements (which makes sense, since it isn't any of those client platforms so if that was set the task sequence could never execute inside WinPE, and also WinPE has no way of knowing what any existing OS on the machine might be). WinPE will pick up the recurrence and mandatory nature of the advertisement, so the users can execute an F12 rebuild of their machine at their desk with no administrative input.

Thanks to Andrew Cobb for the idea!

Upcoming New Zealand DPM Events

2009-03-04T23:59:00Z

I made a decision when I started this blog to only use it for original content and not just repost links to other site (which explains why I don't post frequently). However this one is near and dear to my heart. We have some DPM technical events coming up in a couple of weeks, and I'd really like to see these events full. DPM is a really exciting data protection & backup technology for Windows workloads, and this event will be great for learning about the technology behind it. The event details are below, it's a free event so please sign up and get along.

March 2009 - TechNet UNPLUGGED Update

Data Protection Manager 2007 Technical Briefing

This technical briefing focuses on Microsoft Data Protection Manager (DPM) 2007 - a member of the Microsoft System Centre family of management products. If you are an IT Administrator that works with Microsoft Technologies or simply looking to understand how Microsoft is addressing the demands from our customers and partners for greater manageability and protection of IT infrastructure - this is the technical briefing for you.
Peter Niven - Microsoft's Regional Specialist on DPM - will be helping attendees understand how DPM can better protect your Microsoft IT investment and elaborate on the wider opportunities to design a more resilient infrastructure. See below for our proposed agenda:

· Why Microsoft developed Data Protection Manager

· Brief DPM 2007 overview

· Specific Workloads (with demos)

o Exchange

o SQL

o SharePoint

o Virtualised environments

· What about non Microsoft Workloads?

· Sizing and Deployment

· Architecting for Disaster Resilience

· Service Pack 1 (released December 2008)

· Roadmap

Note: This is a Level 300 Event for IT Professionals
Registration is free. Dates and locations below. Full details here.

Christchurch - 17 Mar 09: 1- 4pm Register
Christchurch Convention Centre, 95 Kilmore Street, Christchurch

Wellington - 18 Mar 09: 1- 4pm Register
Microsoft Wellington, Level 12, 157 Lambton Quay, Wellington

Auckland - 19 Mar 09: 1 - 4pm Register
Microsoft Auckland, Level 5, 22 Viaduct Harbour Ave, Auckland

Windows 7 & Error 80072ee2

2009-01-12T11:58:00Z

I upgraded my home laptop to the beta of Windows 7 this weekend, and when I ran Windows Update I kept getting error 80072ee2 in the windowsupdate.log. It's a good idea to run windows update when you've done a fresh install of Windows 7 as it picks up a fair few of the missing device drivers (including in my case video). Error 80072ee2 is one of those errors that seems to be relatively generic, and related to network connectivity of some kind. My fix was relatively simple - I manually downloaded the latest Intel network drivers for my machine and installed them - problem solved. Windows Update works again. If you're getting this error, it's a relatively easy first step to try.

strange virtual app error message in config mgr

2008-12-12T02:16:00Z

I’ve recently been working in a proof of concept environment streaming some virtual applications from System Center Configuration Manager 2007 R2. The process for adding a virtual application is really simple – there is a nice wizard that you run and point at the xml manifest that gets created when you sequence an application in App-V 4.5.

However, in this particular case I pointed at my valid manifest file and got this error instead of the nice display of the virtual apps in my sequence.

"Load Virtual Application Package Failed. Error: Argument 'picture' must be a picture that can be used as a Icon".

Unfortunately it’s not a very helpful message as there is no ‘picture’ element in my manifest or in my OSD files (the error is also grammatically incorrect - but then half this post probably is as well). It took a little bit of digging to figure out what was going on.

My application was made up of three separate “applications” – the main executable, a license executable and a help file. The only clue I had to what might be going wrong was the reference to an icon. When you virtualise an application with App-V, the icons are stripped out and stored in a subdirectory <application name> icons. Taking a look in there I saw four .ico files - (one for each executable and a fourth for the document association). However, the icon file for the help application was 251KB, and all the others were 2KB. Looking at the properties of the help icon, it’s actually the winhelp executable and for some reason the sequencer has grabbed the whole application rather than just the icon.

In this case, I didn’t actually need the Help application (I should have probably removed it during sequencing) so to get around this issue I edited my manifest xml and removed the help application section. Once I did this, the manifest imported perfectly and I was able to successfully deploy using Configuration Manager.

Unplugged MDT Session Deck

2008-11-17T06:04:00Z

Here is the deck from the "Deploying Windows Vista with MDT" session that I've run at Technet Unplugged. It's shamelessly stolen from Michael Niehaus & Tim Mintners sessions from Teched, so thanks to them for doing all the hard work.

Hyper-V with Server Core - too hard for VMware to use?

2008-09-28T23:30:00Z

There was an video posted recently showing the difference between setting up Hyper-V with Windows Server Core, and setting up ESX3i. Mike DiPetrillo posted an interesting comment to the effect that the commands that were entered were net new for Windows Server 2008 Core.

I watched the first video and counted one net new command line for Windows Server 2008 (let alone core). The command sequence is something like:
netdom (around since Windows NT 4.0)
shutdown (around since Windows NT 4.0)
netsh (around since Windows 2003)
netdom (see above)
netsh (see above)
ocsetup (Only net new command)

The second video shows setting up the ISCSI storage and I counted no net new command line tools there:
iscsicli (has been available as part of the ISCSI initiator for a while now - it's available for 2K, XP, 2003 - this is first time the iscsi initiator is in the OS) - it is probably fair to say that it's not the most intuitive command line in the world, but it is well documented.
diskpart (been around since Windows XP)

So far from being all net new command lines, we have one net new command line tools, and a bunch that have been around for a while (over ten years in some cases). Guess you'll need to update that MCSE to the new Windows 2008 certification Mike? :)

The great thing about having all this command line stuff available is that it works on both Windows Server Core & Windows Server Full installs, and you can use all this stuff to automate your server builds (or even better, use System Center Configuration Manager to deploy your Windows Server with image based deployment and task sequences).

My question to Mike is this: once I have my host up and running, what extra steps do I have to do to do things like copy my ISO files on there, or copy my gold images on there?

With Windows I browse to my file share and copy them on. It's the Windows you know and love.

What do I have to do to do this on ESX3i? Usually it's getting a SCP tool and copying files on there, then when I want to provision it means logging on to the console (command line) and copying my images around. It's the *nix you might not know or love.

Either that or I deploy System Center Virtual Machine Manager and use that to manage my Hyper-V & VMware environments, and use that to do all my provisioning.