Windows Virtualization Team Blog : ESX

Update: More than recession: IDC's server virtualization tracker report

porourke — Tue, 27 Oct 2009 04:24:00 GMT

Update: The folks at IDC asked that I remove this blog post until further notice.

That said, do check out Roger Johnson's post. He discusses Dell PowerEdge R910 and his Hyper-V deployment at Crutchfield. I met Roger at VMworld 2009. He's a VCP, having run an ESX Server-based datacenter for some time before Crutchfield moved away from VMware and onto Hyper-V/SCVMM earlier this year.

Patrick

Virtualization: desktop to datacenter

porourke — Tue, 20 Oct 2009 21:54:00 GMT

It's been a while since I've posted a blog ... but that one really caused a stir in the Virt circles in the Bay Area. Hopefully it doesn't mean I can't hit up those people for Sharks tickets.

I've stumbled across some interesting items that I wanted to share with you.

Microsoft Desktop Optimization Pack 2009 R2 is now available. The big thing is support for Windows 7. Read the blog here. Here's an excerpt:

If you are an MDOP customer, you can download MDOP 2009 R2 through Microsoft Volume Licensing Site (MVLS). For others who wish to evaluate MDOP products, the MDOP software is available at MSDN and TechNet (in accordance with your MSDN or TechNet agreements, except for AIS).

MDOP has been licensed for over 21 million desktops worldwide! In a recent survey completed for Microsoft by Answers Research, and including 1000 IT professionals across five countries, we learned several interesting facts:

66% of MDOP customers deployed three or more of the MDOP products

52% of them deployed MDOP across more than half of their PCs

94% of MDOP customers said they would recommend MDOP to a colleague

When comparing MDOP and non-MDOP customers, customer satisfaction with Software Assurance increases by 25%

Microsoft Enterprise Desktop Virtualization (MED-V) V 1.0 SP1 - This updated tool will support Windows 7 and enable enterprise deployment of virtual Windows XP environments to support incompatible applications. A Beta version of MED-V 1.0 SP1 will be available by the end of 2009 and final release is scheduled for the first quarter of calendar year 2010.

On the server side, the latest is from Gartner Symposium in Orlando. Gartner announced their top 10 strategic technologies for 2010. Not surprisingly, virtualization is named or underlying several of the strategic technologies. And speaking of, Gartner also shared data on server virtualization adoption today and forecasted through 2012. Read this article. Here's an excerpt:

According to Gartner, 18% of server workloads this year run on virtualized servers; that share will grow to 28% next year and reach almost half by 2012. But growth is anticipated among the small-to-midsize businesses (SMB), and it's in this segment that Microsoft has a good chance to build a customer base. By 2012, VMware's share is expected to shrink to 65% but the base of VMs will have grown to 58 million, a 10-fold leap. By that time, Gartner believes, Microsoft will hold 27% share, Citrix 6%, Red Hat 2% and others about 1%.

Along those lines, I had a great email exchange a couple weeks ago with Steve at PoundHost in Maidenhead, UK. I was giving a presentation at IP Expo / VM Expo conference in London, and wanted to highlight PoundHost's business results since switching to Hyper-V and System Center away from VMware tools, and since PoundHost has deployed the Dynamic Datacenter Tookit for hosters. PoundHost has a very compelling story of how technology can really help a business transform itself and create new opportunities. The Microsoft case study doesn't really do it justice. Here's some of what Steve shared with me:

Cost. "It meant we could offer Linux and Windows at the same price (when we went live with the beta of R2 we had Linux guests but we don’t now). It means we can offer low cost VMs on high quality (and cost!) host servers which ultimately give the end user a better experience. [It] works out about £1.00 per guest assuming 60 guests per host."
Common management tools. "We were also very impressed with a demo we had seen of System Center Virtual Machine Manager and Ops Manager so we now use both in our infrastructure."
Choice. "I’m a VCP and have a lot of experience with ESX but I’d never use it again now I’ve used Hyper-V under R2"
Grow business. "[We've] expanded our Hyper-V/System Center offerings into our managed services company Server Arcade "
Grow business: profitability boost by 55%
Customer service. "We’re also doing the customer control panel now for Poundhost which is based on the Dynamic Datacenter Toolkit."

Check out more about the Dynamic Datacenter toolkits and partner alliance at their blog.

Patrick O'Rourke

Update: What you won't see at VMworld 2009

porourke — Thu, 27 Aug 2009 02:30:00 GMT

This post is for the readers out there that will be attending VMworld, or have colleagues attending VMworld.

There’s been some speculative statements made in the press and blogs in the past 24 hours, so I want to try to set the record straight:

1. Microsoft will be exhibiting at VMworld 2009. Can't wait! We have a 10x10 booth, #2422. If you have a chance, please stop by booth. It's right next to the Blogger lounge. See more below.

2. Unlike prior VMworld conferences, we’re no longer allowed to sponsor the event. We can only be an exhibitor. Why? Let's look at excerpts from VMworld’s rules (my highlights):

VMworld 2009 Sponsor and Exhibitor Rules and Regulations

Booth/Session Demonstrations (pg. 2)

Sponsors and exhibitors must market or demonstrate products on the exhibition floor and in the sessions

which are complementary to VMware products and technologies. Complementary products and services are

defined as products/services that do not overlap/substitute with VMware’s products/capabilities, and help

expand the reach and solution scope of VMware’s capabilities solely as deemed by VMware. All sponsors

and exhibitors must adhere to following guidelines in regards to booth demonstrations (please also review

the “Promotion, Giveaways, Contests” section below):

Eligibility (pg. 4)

To sponsor or exhibit at VMworld a company must be a VMware partner in good standing in our TAP,

Strategic Global Partner or VIP Partner Programs. Companies that are not VMware partners may be allowed

to exhibit at VMworld under exception by VMware.

Both sides (us and VMware) agreed that, apart from the features in System Center Virtual Machine Manager that manage ESX, Microsoft products aren’t complementary to VMware’s products. We discussed and confirmed their intent of these clauses in early August, and had a follow-up Aug. 11 email from VMware, that reads in part:

As I mentioned, the rules require all exhibitors to market and demonstrate products that are complimentary to VMware products and technologies. We are open to reviewing any proposals for complimentary positioning of Microsoft products and demos at the show…

As a result, based on the clause above, phone/email with VMware employees, we don't believe we have the right to demo our products in the booth. This decision runs counter to Microsoft’s geek culture, as you can imagine, but we've also become more pragmatic over the years :-).

So what is Microsoft doing at VMworld?

We’ve learned over the course of 4 years attending VMworld (first was Vegas 2005) that there are many attendees who use, admin, manage, sell, support Windows Server, SQL Server, Exchange Server, Windows XP/Vista, System Center, etc. They want the opportunity to engage and receive information from Microsoft virtualization experts. So we’ll have Microsoft virtualization experts in the booth. These experts will be there to answer your questions. They’ll also be Tweeting about their experiences and impressions as they talk to customers and attend sessions. I encourage you to follow them on Twitter - see the table below for their usernames.

Expert in	Name	Twitter Username
Disaster Recovery, Backup	Allen Stewart	dynamic_dc
Desktop Virtualization	Ben Armstrong	virtualpcguy
App & Desktop Virtualization	Jeff Johnson	JJ_VDI
Virtualization Management	Stuart Schaefer	Sshaffer_MS
Cloud	Isaac Roybal	DDACloudGuy
Business value	Edwin Yuen	edwinyuen
Workloads, partners, licensing	Kenon Owen	MS_Int_Virt
Server Virtualization	Vijay Tewari	vtango

We’ll also have two customers in the booth at different times. I’ll be there. See you there!

Patrick O’Rourke

VMworld 2009 an oppurtunity to meet our customers

vtango — Wed, 26 Aug 2009 19:09:00 GMT

Hi, I am Vijay Tewari a program manager with the Virtualization team here at Microsoft. Having spent the last 15 months or so deeply involved in the development of Hyper-V I am really looking forward to meeting customers and partners at VMworld 2009.

Much is being made about the fact that we are not showing Hyper-V and System Center Virtual Machine Manager at this event due to the show policies. I will stay away from that debate although coming on the heels of our RTM I would have loved to show the product. However, a lot of us will be there at the event and are really looking forward to interacting with customers. At the end of the day the product is only useful if it meets our customers’ demands and there is nothing like having a face to face interaction with our customers to hear firsthand what they like and hate about the product.

Below is my tentative schedule for VMworld. As you can see a lot of wait lists, but I am hoping that I can squeeze in. Would like your feedback if there are sessions you would like to see covered.

We will be tweeting (follow vtango on Twitter) and blogging all through the event, so follow along.

Looking forward to seeing you!!

Vijay

Vijay Tewari, Principal Program Manager, Virtualization

Personal Schedule for Vijay Tewari

Monday


7:30 AM-9:30 AM (Waiting List)	LAB01	VMware vSphere™ 4 - New Features, Best of, Advanced Topics

10:00 AM-11:00 AM (Waiting List)	V13100	The VMware Competitive Advantage - A Comparison of Server Virtualization Offerings

11:30 AM-12:30 PM (Waiting List)	V13229	Introduction to VMware vSphere

1:30 PM-2:30 PM (Waiting List)	V11721	Best Practices for Successful VI Design

2:30 PM-3:30 PM (Waiting List)	V13478	Executing Enterprise Virtualization - Continuing Case Study with USMC

4:00 PM-5:00 PM	V12226	Building a High Availability and Disaster Recovery Solution with VMware

Tuesday


9:30 AM-10:30 AM	SS5160	Stop Virtualizing Servers, Start Virtualizing Infrastructure

11:30 AM-12:30 PM	VM3142	Large Scale Virtualization

1:00 PM-2:00 PM	VM3235	Introducing VMware vCenter Product Family: Managing Service Levels Across Dynamic IT Infrastructure

2:30 PM-3:30 PM (Waiting List)	VM1960	Datacenter Consolidation and Migration with VMware Site Recovery Manager

4:30 PM-5:30 PM (Waiting List)	BC2761	ESX Networking for High Availability and Disaster Recovery

5:30 PM-7:00 PM	TA2544	A Comprehensive Look at the Security and Compliance of vSphere 4

Wednesday


9:00 AM-10:00 AM (Waiting List)	BOF105	Technology and Architecture -- Virtual Networking

10:00 AM-11:00 AM	TA3220	VMware vStorage VMFS-3: Architectural Advances since ESX 3.0

11:00 AM-12:00 PM (Waiting List)	BOF104	Cloud Computing

12:00 PM-1:30 PM (Waiting List)	VM1700	vApps and advanced VM templates in vSphere 4

2:00 PM-3:30 PM	TA3880	Head-To-Head Comparison: VMware vSphere and ESX vs. Hyper-V and XenServer

4:30 PM-6:00 PM	BC3301	DR Architecture Design Workshop with SRM

Thursday


9:30 AM-10:30 AM (Waiting List)	BC2961	VMware Fault Tolerance Architecture and Performance

11:00 AM-12:00 PM	BC3387	Advanced Data Protection for Microsoft SQL and Exchange Server in a VMware Environment

12:30 PM-2:30 PM	LAB07	VMware vCenter Lab Manager 4

2:30 PM-3:30 PM (Waiting List)	BC3421	SRM Architecture & Features: The Road Ahead

4:00 PM-5:30 PM	TA2525	VMware vSphere 4 Networking Deep Dive

Hypervisor Footprint Debate Part 3: Windows Server 2008 Hyper-V & VMware ESXi 3.5

WSV_GUY — Mon, 17 Aug 2009 16:01:00 GMT

In my last two blog posts (Part 1 & Part 2), I started an in depth analysis tackling VMware's claims head on that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. If that's the case, then it stands to reason that ESX/ESXi:

should have fewer patches (they have less code to patch)
patches should be smaller in disk footprint (they have a smaller codebase and you want to keep code churn to a minimum; otherwise one could ship a 1k stub file and claim to be smaller)
should offer higher availability, reliability and uptime

Using VMware's own metrics:

In part 3, lets take a look at VMware's favorite comparison Windows Server 2008 Hyper-V to ESXi 3.5. Let's have a look.

Stacking The Deck In VMware's Favor

In this last comparison, I will freely admit that this isn't an apples to apples comparison. In this comparison, I gave ESXi 3.5 a 6 month advantage. Here's what I mean. Specifically, I compare:

VMware ESXi 3.5 from June 30th 2008 to June 30th 2009 (a 12 month period)
Windows Server 2008 Hyper-V January 1 2008 to June 30th 2009 (an 18 month period)

Using an 18 month sample set for Windows Server 2008 covers the majority of its time in market and goes to the heart VMware's fundamental claim that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. This tilts the scale in VMware's favor.

Windows Server 2008 Hyper-V to VMware ESXi 3.5

Disk Footprint & Patch Count. Here's what we found:

Windows Server 2008 Full Installation: 32 patches totaling 408 MB of patches
Windows Server 2008 Core Installation: 26 patches totaling 82 MB of patches or (~20% fewer than a Windows Server 2008 full installation)
VMware ESXi 3.5: 13 patches, totaling over 2.7 GB.

Yes, I said over 2.7 GB. To put it another way,

VMware ESXi 3.5 had a 6.6x greater patch footprint than Windows Server 2008 (Full)
VMware ESXi 3.5 had a 33x greater patch footprint than Windows Server 2008 (Core)

So much for the disk footprint argument. Again, how can the ESXi footprint be so huge?

Because VMware releases a whole new ESXi image every time they release a patch. Furthermore, because VMware releases a whole new ESXi image every time they release a patch it also means that every ESXi 3.5 server requires a reboot. At this point, a VMware salesman may actually concede that every ESXi server has to be rebooted for every patch, but they will then state that they have VMotion (Live Migration) so it doesn't affect their uptime.

Except when their own patches cause days of downtime and render VMotion impotent.

Reliability/Availability. With VMware ESXi 3.5 Update 2, it included a serious flaw which resulted in two days of downtime for their customers including the loss of VMotion:

"Starting this morning, we could not power on nor VMotion any of our virtual machines," said someone identified as "mattjk" on a VMware support forum. "The VI Client threw the error 'A general system error occurred: Internal Error.'"

It was so bad, VMware's CEO had to apologize on numerous occasions. (HERE, HERE, HERE, HERE, HERE, & HERE). VMware then rushed out the VMware ESXi 3.5 Update 3 which introduced instability to VMware High Availability and could cause virtual machines to spontaneously reboot. (HERE & HERE)

Virtual machines that spontaneously reboot due to bugs in VMware high availability.

Now consider the fact that there were two significant quality and reliability issues with two major updates in a row (ESX/ESXi Update 2 & Update 3). While the initial Windows Server 2008 Hyper-V release didn't provide Live Migration (Windows Server 2008 Hyper-V R1 had Quick Migration and Windows Server 2008 Hyper-V R2 includes Live Migration for free), it didn't include two days of potential downtime and virtual machines unexpectedly rebooting either. For those that track availability in terms of nines (five nines is 5.26 minutes of downtime a year) VMware Update 3.5 Update 2 dropped customers to "two nines" of availability.

Using VMware's own metrics, Windows Server 2008 Hyper-V is clearly the winner over ESXi 3.5.

The Facts Contradict VMware's Claims

As stated at the beginning of this series, VMware's overarching point is because their disk footprint is smaller and ESX/ESXi is a single purpose hypervisor, they are therefore more secure. While VMware heavily touts this claim (it's in numerous location on their website for starters), the facts from this analysis directly contradict their claims. Specifically:

The platform with the largest number of patches was VMware ESX 3.5 with 85 Security & Critical Patches averaging over a patch per week.
The platform with the largest patch footprint was VMware ESX 3.5 totaling over 3 GB worth of patches followed by VMware ESXi 3.5 with over 2.7 GB. That's right, VMware's single purpose virtualization platforms that claims to have the smallest footprint had the two largest patch footprints by about a mile. (Graph below)
Both VMware ESX & ESXi had a recent case of the most severe virtualization flaw with guest code able to break out of the virtual machine and could potentially:
- Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.
VMotion/Live Migration is not a panacea to patching. It can help, but in the case of VMware's own self-inflicted faulty patch, it rendered their advantage impotent.
VMware had not just one, but two significant updates with serious quality and reliability issues with both ESX and ESXi. Specifically, ESX/ESXi Update 2 Issues: HERE, HERE, HERE, HERE, HERE, & HERE & ESX/ESXi Update 3 Issues: HERE & HERE.

The Point Of This Series

Say it with me:

> Security is more than just disk footprint. <

Quoting disk footprint size alone is a nice pithy, superficial phrase, but it's also a boat load of bollocks. The next time some VMware representative throws out that argument, point them to this blog and tell them Jeff sent you. If you've ever spent anytime with a security expert, one of the first things they will tell you is that security is not a one time exercise. Security is an ongoing process that should be embedded throughout the entire development lifecycle. It's that belief that drove us to develop the Microsoft Secure Development Lifecycle (SDL) and is publicly available.

Microsoft Secure Development Lifecycle (SDL)

The concepts that make up the Microsoft SDL were formed with the Trustworthy Computing (TwC) directive of January 2002. At that time, many software development groups at Microsoft instigated "security pushes" to find ways to improve the security of existing code.

Becoming a mandatory policy in 2004, the SDL represents a major cultural evolution at Microsoft with regards to software security and privacy and has matured into a well defined methodology. A "security process by a software company," the SDL was designed as an integral part of the development process. The development, implementation and constant improvement of the SDL represents a strategic investment for Microsoft, and an evolution in the way that software is designed, developed, and tested.

From a high level, the Microsoft SDL looks like this:

The Microsoft Security Development Lifecycle

Benefits of the Microsoft SDL:

Reducing the number of software vulnerabilities
The SDL has played a critical role in embedding security and privacy into Microsoft software and culture, leading to measurable and widely recognized security improvements in flagship products such as Windows and SQL Server and the proof is real. How about:
- Windows XP to Vista a 45% decrease
- SQL Server 2000 to 2005 91% decrease

Windows Server 2008 Full vs Server Core
- Reduction in patches by ~50%

Reducing the total cost of development
The SDL reduces the "total cost of development" by finding and eliminating vulnerabilities early. According to the National Institute of Standards and Technology (NIST), eliminating vulnerabilities in the design stage can cost 30 times less than fixing them post release.

Read that last sentence again.

Thirty times.

I also want to point out that the Microsoft Security Development Lifecycle doesn't end once the bits are released. It also means having a well-established response mechanism including:

responding to potential security threats
root cause analysis to understand why the issue occurred and ensure that issue isn't repeated
issuing security patches

The importance of a security development lifecycle cannot be understated. No matter how well you execute, there is no such thing as perfect code. Whether it's Microsoft, VMware, <insert software vendor here>, having a rigorous security development practices in place is imperative. And, in case you think I'm satisfied with our patch numbers above, you'd be wrong. I don't ever want to get complacent and think for a moment that "security is done." Security is never done.

Let he who has written perfect code throw the first stone.

Let's Have A Look At The VMware's Security Development Lifecycle

So, where's the VMware Security Development Lifecycle?

You're guess is as good as mine.

I went to VMware's site and searched for their security development lifecycle. I found their Security Center which lists their patches, but that's just one small aspect to a security development lifecycle. I Bing searched "VMware security development lifecycle" and was returned a sales pitch from VMware to buy something at $1500 per processor.

No, I'm not kidding.

Making The SDL Available To Our Partners

After a significant investment in time, money, manpower we've developed and want to give back to our partners. A great place to start is the Microsoft SDL Homepage. Here you will find whitepapers, best practices, threat modeling tools, process guidance and much more. In addition, we recently released the Microsoft SDL Process Template for Visual Studio Team Systems. This template helps ease the adoption of the SDL, demonstrates security return on investment and provides auditable security requirements and status.

I'd be remiss if I didn't point out an excellent book aptly titled, Writing Secure Code Vol. 2 and point to the blog of one of the authors, Michael Howard. More links below.

Microsoft SDL Homepage: http://msdn.microsoft.com/en-us/security/cc448177.aspx

Microsoft SDL Process Template for Visual Studio Team System: http://msdn.microsoft.com/en-us/security/dd670265.aspx

Writing Secure Code Volume 2: http://www.amazon.com/Writing-Secure-Second-Michael-Howard/dp/0735617228

Michael Howard's Blog: http://blogs.msdn.com/michael_howard/

In my next blog, we'll discuss more free tools and programs available our partners.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Hypervisor Footprint Debate Part 1 UPDATE: Microsoft Hyper-V Server 2008 & VMware ESXi 3.5

WSV_GUY — Fri, 14 Aug 2009 00:56:00 GMT

Virtualization Nation,

In my last blog post, I started an in depth analysis tackling VMware’s claims head on that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. I read some posts on the blogosphere that had questions about the methodology. Let’s dive in.

Didn’t Compare The Number Of Reboots

You’re right I didn’t. I didn’t think comparing the number of reboots was needed after:

establishing that VMware’s own patches caused customers two days of downtime without the use of VMotion to mitigate that downtime
referring to VMware’s own updates that caused VMs to spontaneously reboot due to bugs in VMware HA
pointing out that every ESXi patch requires a reboot

Even if every Microsoft Hyper-V Server 2008 patch came out on a different day (that wasn’t the case most of the patches came out in groups) and required a reboot at the time, there’s no way on earth that the cumulative time would be in the ball park of two days per server.

Service Pack 2

You’re right I didn’t include Service Pack 2. Service Pack 2 is an optional download. You can test this out very easily. Go to any server running Microsoft Hyper-V Server 2008 or Windows Server 2008 and run Windows Update.

Here’s what I included:

Both Microsoft and VMware also have optional patches, but I didn't include this type because they are optional, so we could focus on the most acute patches. Finally, let me very clear about the Microsoft patches. These counts include ALL critical and recommended patches, meaning if there was a critical patch for IE or some other Windows component I counted it. Had I ignored these types of patches, that wouldn’t be a fair comparison.

However, for the sake of comparison and transparency, I added Service Pack 2 to the count and here’s what we found:

Microsoft Hyper-V Server 2008: 27 patches, totaling 845 MB.
VMware ESXi 3.5: 13 patches, totaling over 2.7 GB.

To put it another way,

VMware ESXi 3.5 still had a 4.3x greater patch footprint

Microsoft Hyper-V Server 2008 RTM’d Later Than Windows Server 2008

That’s a great point and my mistake. I apologize for that error and have corrected it. (BTW: It doesn’t take me a month to apologize and make corrections, but I digress..)

Let me tell you how this happened.

In doing the patch comparison, I started with VMware’s favorite example, VMware ESXi 3.5 and Windows Server 2008 which RTM’d in Q4 2007. I wanted to take a reasonable, historical sample size of both platforms. Going back 18 months ensures the sample set covers the majority of Windows Server 2008 time in market and tackles VMware’s fundamental claim that because their disk footprint is smaller and ESX/ESXi are single purpose hypervisors, they are therefore more secure. If anything this should work in VMware’s favor.

As I pored through data I realized I wanted to do the full matrix and include:

VMware ESXi
VMware ESX
Windows Server 2008 (Full)
Windows Server 2008 (Core)
and finally Microsoft Hyper-V Server 2008

This way, customers get the most comprehensive data and can make an informed decision. As you can see, MS Hyper-V Server 2008 was at the end of the analysis and this mistake crept because it slipped my mind that MS Hyper-V Server 2008 shipped after Windows Server 2008. (For example, MS Hyper-V Server 2008 R2 and Windows Server 2008 R2 are sim shipping this time around…)

The Notion Of Truth

This is an ideal time to make an important and fundamental point about competitive comparisons. The reason we’re able to perform this analysis and debate this topic openly is because the facts are freely available in the public domain without restriction. I’m happy to discuss the methodology used and make corrections as needed, but the point is we can have these discussions.

This point may sound obvious, reasonable and rational, but it’s not what VMware believes when it comes to competitive benchmarking. VMware has decided that they want to tightly control the concept of truth and only want the public to hear the VMware version of the truth. This is an unfortunate situation for customers who value open debate and basic fairness.

That’s another blog for another time.

Cheers, -Jeff

Hypervisor Footprint Debate Part 1: Microsoft Hyper-V Server 2008 & VMware ESXi 3.5

WSV_GUY — Wed, 12 Aug 2009 18:13:00 GMT

Virtualization Nation,

After my recent blog discussing the release of Microsoft Hyper-V Server 2008 R2, we received overwhelmingly positive feedback. At the same time, there's still some skepticism about free Live Migration and almost daily we keep hearing, "This is too good to be true, is Live Migration really free? Is High Availability also free? What's the catch?" Yes, both Live Migration and HA are free. Check out this earlier blog for details.

At the same time, we've also received questions about Windows Server 2008 Hyper-V, Microsoft Hyper-V Server 2008 and VMware ESX/ESXi in terms of disk footprint. The disk footprint argument is a favorite bit of FUD by VMware which appears to making the rounds again in the blogosphere. In the past couple of weeks, I've seen a few articles reprinting this pabulum almost verbatim. So today, I thought we'd analyze the whole disk footprint argument and, as usual, let's analyze the facts.

The Thin Hypervisor Debate In A Nutshell

Rather than attempt to restate VMware's argument, let's just use their exact verbiage. From VMware's website:

It's interesting to point out that VMware uses ESX & ESXi 3.5 in the column title, but then only uses ESXi for comparison in the right hand column and then rushes to compares ESXi to Windows Server 2008 Hyper-V.

Gosh, I wonder why ESX 3.5 isn't included? We'll cover that too.

Pay special attention to the last paragraph:

"VMware ESXi is a fully functional hypervisor in a 32 MB disk footprint, which reduces the risk of down time and increases reliability."

There are three metrics to VMware's argument:

Disk footprint. Disk footprint. Disk footprint. They're quite fixated on that.
Reduce the risk of downtime due to fewer patches (i.e. fewer patches is good)
Increase reliability (and, in turn, availability)

VMware's overarching point is because their disk footprint is smaller and ESX/ESXi is a single purpose hypervisor, they are therefore more secure. If that's the case, then it stands to reason that ESX/ESXi:

should have fewer patches (they have less code to patch)
patches should be smaller in disk footprint (they have a smaller codebase and you want to keep code churn to a minimum; otherwise one could ship a 1k stub file and claim to be smaller)
should offer higher availability, reliability and uptime

We're going to put that to the test.

Before We Get Started

Before we delve into the analysis, I'd like to point out that VMware touts ESXi as a 32 MB hypervisor, yet the download is over 200 MB. So, are we too assume that the other 170+ MB doesn't count? I point this out because both Windows Server 2008 Hyper-V and Microsoft Hyper-V Server 2008 do have larger disk footprints, but also provide incredible value and capabilities that our customers desire such as driver compatibility with a vast catalog of hardware, widely used management interfaces, scripting capability (PowerShell anyone?), MPIO, High Availability, etc.

If you really want to focus on the disk footprint that matters, the amount of software that could be directly exposed to VM attack, the Hyper-V hypervisor and virtualization stack combined is about 20 MB, ~19.4 MB for the virtualization stack and ~600k for the hypervisor.

In short, VMware has focused on our entire footprint which is made up mostly of stuff that isn't exposed to VM traffic at all or only exposed indirectly, while ignoring the part that matters most and for which VMware doesn't have a strong track record.

Time For Some Analysis

With VMware's own metrics in mind, I decided we should perform an apples to apples comparison. Specifically, over a 12 month period from June 30th 2008 to June 30th 2009, comparing: Microsoft Hyper-V Server 2008 (R1) and VMware ESXi 3.5 in terms of numbers of patches, size of patches and availability. I specifically chose these versions because I wanted to take a reasonable, historical sample size (12 months) of both platforms. Both Hyper-V R2 and VSphere have RTM'd within the last 90 days and that wouldn't be statistically relevant.

What did we compare? Wanting to keep the comparisons as close as possible, here's what we analyzed:

VMware: Security and Critical Patches
Microsoft: Critical and Important Patches

Both Microsoft and VMware also have optional patches, but I didn't include this type because they are optional, so we could focus on the most acute patches.. Finally, let me very clear about the Microsoft patches. These counts include ALL critical and recommended patches, meaning if there was a critical patch for IE or some other Windows component I counted it. Had I ignored these types of patches, that wouldn’t be a fair comparison.

Comparison #1: Microsoft Hyper-V Server 2008 & VMware ESXi 3.5

Disk Footprint & Patch Count. Here's what we found:

Microsoft Hyper-V Server 2008: 26 patches, totaling 82 MB.
VMware ESXi 3.5: 13 patches, totaling over 2.7 GB.

Yes, I said over 2.7 GB. To put it another way,

VMware ESXi 3.5 had a 33x greater patch footprint

So much for the disk footprint argument. How can the ESXi patch footprint be so huge?

Because VMware releases a whole new ESXi image every time they release a patch. Furthermore, because VMware releases a whole new ESXi image every time they release a patch it also means that every ESXi patch requires a reboot. At this point, a VMware salesman, may concede the point that every ESXi server has to be rebooted for every patch, but they will then state that they have VMotion (Live Migration), so it doesn't affect their uptime.

Except when their own patches cause days of downtime and render VMotion impotent.

Reliability/Availability. With VMware ESXi 3.5 Update 2, it included a serious flaw which resulted in two days of downtime for their customers including the loss of VMotion:

"Starting this morning, we could not power on nor VMotion any of our virtual machines," said someone identified as "mattjk" on a VMware support forum. "The VI Client threw the error 'A general system error occurred: Internal Error.'"

Virtual machines that unexpectedly reboot due to bugs in VMware high availability. Think about that for a minute.

The News Gets Worse

Not only did VMware ESXi have a 31x greater patch footprint, but they also had the most serious virtualization security flaws. Specifically,

Guest code able to break out of VM and into the ESX Hypervisor

For those you who may not know, code running in a guest operating system that is able to break out of a VM and into a hypervisor is THE WORST type of security flaw you can have for a virtualization platform. Period. VMware has had exploits on both their "thin hypervisor (ESXi)" and on their "thick hypervisor (ESX)" as recently as a few months ago.

For example, April 2009 CVE-2009-1244: A critical vulnerability in the virtual machine display function allows a guest operating system users to execute arbitrary code on the host OS.

Impact: Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Something to consider when VMware wants to host your data in "their cloud."

Now consider the fact that there were two significant quality and reliability issues with two major updates in a row (ESX/ESXi Update 2 & Update 3). While the initial Microsoft Hyper-V Server 2008 release didn't offer Live Migration (MS Hyper-V Server 2008 R2 now includes Live Migration/HA for free), it didn't include two days of potential downtime and virtual machines unexpectedly rebooting either. For those that track availability in terms of nines (five nines is 5.26 minutes of downtime a year) VMware Update ESXi 3.5 Update 2 dropped customers to "two nines" of availability.

Using VMware's own metrics, Microsoft Hyper-V Server 2008 is clearly the winner over ESXi 3.5.

One more interesting observation

After VMware released Update 2, which affected both ESXi & ESX, they rushed to get a fix out the door and did so in a few days. One interesting thing I noticed was that in the span of a few days, the patch grew 17 MB.

17 MB in a few days????

Now, I'm not sure what's in that 17 MB (potentially more than 50% of their hypervisor footprint could have been churned using VMware's 32 MB hypervisor claim, but I digress.), but if I had just released a patch that resulted in multiple days of downtime for my customers let me tell you what I would have done:

Created a highly scoped, well tested, surgical fix with minimal code churn.

To see a 17 MB change in just a few days would be cause for concern and an immediate code review.

Maybe that's just me.

In my next blog, we'll compare Windows Server 2008 Hyper-V and VMware ESX 3.5.

Cheers,

Jeff Woolsey

Principal Group Program Manager

Windows Server, Hyper-V

Too many Virtual Iron customers in the fire?

porourke — Thu, 16 Jul 2009 08:38:00 GMT

With the recent announcement by Oracle to stop Virtual Iron development and sales, the past few weeks have certainly been eventful for Virtual Iron customers. A related announcement came out from VMware about a program to offer Virtual Iron customers discounts to move over. But a closer look at the VMware offer shows some serious limitations. These include:

· Only Virtual Iron 4.0 or newer customers are eligible

· Only those with active support subscriptions with Virtual Iron are eligible

· Customers must buy a VMware license for every socket on their Virtual Iron contract. This effectively locks in the customer to VMware for size of their Virtual Iron contract.

· The discount is 40% off the list price of the product but only 10% on one-year of support and subscription, 0% for more than one year of support subscription.

· The offer isn’t valid on all SKUs. This means for Virtual Iron customers who want to keep their Live Migration and CPU balancing capability, they need to buy vSphere Enterprise Plus, the most expensive SKU.

Even with the discounts, VMware is still very expensive. For vSphere Advanced, the cost after discount is still $1,347 per processor without support, which has a very small discount. For vSphere Enterprise Plus, which is required for DRS and other features, the cost is still $2,097 per processor without support. With two years of support, it’s $3,722.64 per processor.

As noted above, Virtual Iron customers must convert all their sockets to VMware and this can only be done once.

As an alternative, I would recommend Virtual Iron customers try Microsoft solutions. Our Hyper-V solutions are low cost, easy to use, and work well with Xen-based solutions like Virtual Iron. In fact, many Virtual Iron users are already running their VMs in the VHD format that’s used with Hyper-V.

If Virtual Iron customers are running Windows Server 2008 in their VMs, they can leverage Windows Server 2008 Hyper-V and Windows Server 2008 R2 Hyper-V. For those customers running non-Windows VMs or do not own Windows Server 2008, you can use the new Microsoft Hyper-V Server 2008 R2 hypervisor. This is our free, standalone hypervisor, which now includes both high availability cluster and live migration at no cost. Both are available for download, a trial for Windows Server 2008 Hyper-V and a full download for Microsoft Hyper-V Server 2008 R2.

Best of all, Virtual Iron customers can just try out the Microsoft solutions, see if it fits their needs, and migrate on their own schedule, all at a much lower cost than the VMware solution.

Edwin Yuen

VMware vSphere pricing - Meet the new price; same as the old price, only more

WSV_GUY — Mon, 04 May 2009 17:00:00 GMT

Hi, I'm Edwin Yuen, a Senior Technical Product Manager at Microsoft's Integrated Virtualization team. This past week, there were two key announcements made, one by Microsoft and one by VMware, that have an impact on how we compare Microsoft and VMware pricing.

The first announcement was actually off this blog, made by Zane Adam, announcing that with the upcoming release of our free, standalone hypervisor, Microsoft Hyper-V Server 2008 R2, features like clustering, high availability (HA), and live migration would be included. This was a very important announcement, as many customers are currently paying a significant amount of money for those features, and as we'll see below, will potentially continue to pay for them. With Microsoft Hyper-V Server 2008 R2, you can now implement HA and live migration without having to buy a premium management SKU, which could save you thousands of dollars.

The second announcement was VMware's announcement of vSphere, the next version of VMware's hypervisor. I spend a lot of time working and speaking with customers, both Microsoft and VMware users. The one theme repeated in those conversations is that everyone understands VMware is not a low cost solution and many have been re-evaluating how much they spend to implement virtualization. I think that everyone, including those of us at Microsoft, were wondering if VMware would drop their prices in the new version of vSphere. When the announcement came out, it had a bullet point on reduced costs and new SKUs for customers. When I sat down to actually figure out the pricing, it was pretty clear that the pricing really didn't change for many customers and the prices still don't compare to the offerings from Microsoft.

One of the key things I noticed is that for the SKU that most people bought, VI Enterprise or vSphere Enterprise, the price didn't actually change. It went from $5,750 for a two processors host to $2,875 per processor, which is the same thing. Thus, for many VMware customers, there is no cost savings in vSphere. Another interesting issue about vSphere can be seen on the version comparisons page off VMware's website. Many of the touted new features of vSphere, such as 8-way vSMP, >256GB of memory on the host, the vNetwork Switch, and Host Profiles, are only available if you buy new Enterprise Plus SKU, which is 18% more expensive than Enterprise and a cost increase for existing customers. This means, for those customers who want these new vSphere features, there is a net increase in their cost. Even when we compare just vSphere Enterprise SKU, the cost of vSphere Enterprise is five times that of buying the Microsoft solution with the Server Manage Suite Enterprise.

On the small and medium business side, VMware changed the name of their VI Foundation SKU to vSphere Essentials and added a new vSphere Essentials Plus SKU. Essentials is just like VI Foundation, but without consolidated backup. Essentials Plus is like Foundation, but with HA added. Essentials is priced at $995 for three two processors hosts and Essentials Plus is priced at $2995 for three two processor hosts. In contrast, a customer using Microsoft Hyper-V Server 2008 R2 with System Center Virtual Machine Manager 2008 (VMM) Workgroup Edition (WGE) will only have to pay $499 for five hosts. Thus, the Essentials SKU is four times more expensive compared to the Microsoft Solution, which also includes HA, clustering, and live migration. The Essentials Plus SKU is 12 times more expensive than the Microsoft solution, while still missing live migration. In fact, for customers who need live migration, they must purchase the vSphere Advanced SKU, which starts at $4490 for a single, two processor host. When we look at the chart below, we can easily how the costs add up on the VMware side.

Finally, VMware has also argued on evaluating price per VM, based on a white paper and calculator they published recently. We recently published a white paper that reviews why this model and the cost calculator associated with it are not applicable to most customers. One of the key issues to the price per VM model, especially with how VMware has been promoting it, is that it doesn't take into account the applications being run. The number of VMs that can be run on a host depends on how the applications inside the VMs run. Don't believe VMware marketing about low consolidation ratios on Hyper-V. For example, this case study about Kroll Factual Data shows them running 30 VMs on a single Hyper-V host.

The consolidation ratio can vary depending on what you are running and how you run them. Because of this, you can't just plug consolidation ratios into a calculator and try to apply this across your entire deployment. The best way to compare Hypervisors is to compare Hypervisors, running your applications and VMs. When you do that, it will be easy to see why Microsoft is still less expensive then VMware. You can read about other companies that have made the switch to Microsoft here.

Still, in the end, the big question to ask yourself is the following: Is it worth all this expense for VMware, when the Microsoft solution offers a comparable or even better feature set for much less cost? Is it worth the extra line item on the invoice, the extra line in the budget, to use VMware virtualization when it's built into Windows? That is a question I think many customers will be asking themselves in the coming months and that is just another reason that you should start using Microsoft Virtualization solutions.

The vSphere Cloud Operating System: Extra Layer, Extra Cost?

porourke — Tue, 21 Apr 2009 11:30:00 GMT

Hi, I’m David Greschler, director of Microsoft virtualization and management. Today VMware announced their new “Cloud OS,” called vSphere. It’s an interesting announcement in that it points out more clearly than ever that VMware adds an extra layer to the computing stack.

This extra layer, a virtualization “substrate” (VMware CEO Paul Maritz’s words), is inserted by VMware between hardware and the OS. But is it really necessary to add an extra layer just to do virtualization and the cloud? Do we really need another operating system to effectively just host other operating systems?

I can see how initially this made sense when the industry was first experimenting with virtualization. But virtualization has now become mainstream, and as such it’s just another feature we should have as part of our computing process. As a result, Microsoft chose to take a more streamlined approach to virtualization. Instead of adding an additional layer of complexity, we’ve put the virtualization component inside the OS. We think this is a better approach as it means you have one less layer to manage, secure and pay for. (And at the cost of $3,495 per processor for vSphere Enterprise Plus, that’s a pretty expensive layer!).

But what about cloud? There’s a lot of talk about how vSphere lets enterprises build “private clouds.” This concept, of a dynamic datacenter where additional compute power can be provisioned on-demand, is something Microsoft has already been talking about for over six years with our Dynamic IT initiative. But does it need an extra layer? We have been developing Windows Server 2008 with System Center, as well as development tools and an application platform, with the Dynamic IT vision all along. The industry terms may have changed from “dynamic datacenter” to “private cloud” but the fact remains that these products today already provide the foundation for building a private – and hosted – cloud infrastructure. After all, the cloud isn’t about throwing away your old applications; it’s partly about taking your existing applications and making them more flexible, extensible and distributed. That’s what Windows Server 2008 and System Center are all about. And customers agree. Take a look at what Kroll Factual Data did with the two products to build their own private cloud. Check out what Lionbridge Technologies did with their Virtual Cloud Lab.

In other words, you don’t need an extra “cloud operating system” to build a cloud running Windows Server. Just use Windows Server.

If you’re an existing VMware 3.x customer who’s considering migrating to VMware’s new Cloud OS, try the combination of Windows Server 2008 Hyper-V and System Center first. You’ll see that System Center can manage both your VMware and Hyper-V deployments from the same console, as well as both your virtual and physical infrastructure. And compare costs: VMware vSphere’s extra layer is approximately three to five times the cost of Microsoft’s solution, while just yesterday Zane Adam announced in this blog that Microsoft Hyper-V Server R2, which includes live migration and high availability, will be free of charge.

vSphere may be the best reason yet to move to Microsoft’s virtualization solution.

David Greschler

March 31 live web chat

porourke — Sat, 28 Mar 2009 19:24:00 GMT

On Tuesday, March 31, Microsoft's Edwin Yuen will be hosting a live web chat 11am-3pm EST. Edwin is a sr. technical product manager. Edwin came to Microsoft with the acquisition of Softricity (and the SoftGrid application virtualization technology). He now also covers Hyper-V and System Center VMM. Sign up here.

Patrick

System Center Ops Manager management pack for Hyper-V

porourke — Fri, 13 Mar 2009 21:43:00 GMT

A quick note that a beta of the Hyper-V management pack for System Center Operations Manager (2007, 2007 R2) is available. In combination with SCVMM (for advanced monitoring of VMs across your Hyper-V, ESX and Virtual Server environments), this SCOM management pack enables health/perf monitoring of the Hyper-V host. The management pack includes health diagram view of virtual machines, virtual components roll-up per host, critical Hyper-V Service monitoring, disk space threshold monitoring.

This beta management pack supports the following OS only (for now):

§ Windows Server 2008 Standard Edition (Full Installation with Hyper-V Role enabled)

§ Windows Server 2008 Enterprise Edition (Full Installation with Hyper-V Role enabled)

§ Windows Server 2008 Datacenter Edition (Full Installation with Hyper-V Role enabled)

To request an invitation to access this beta, you can send a message to the following address: MPCC@microsoft.com

Patrick

SCVMM and VMware ESX management

porourke — Tue, 10 Mar 2009 05:43:00 GMT

The threat of virtualization sprawl. That was a theme my colleagues heard last week at IDC's "Directions" conference in San Jose. And true to IDC's form, they backed up their predictions with some numbers. Here's an excerpt from one article:

Virtualization has often been seen as something of a magic bullet to this problem, promising to consolidate a number of low-utilization servers onto a single piece of hardware. But the average number of virtual machines per server is only five, Bailey noted, with that number going to eight by 2012. So much for the vision of consolidating dozens of servers onto one machine. More important, though, was that IDC found that just going from five virtual machines to eight means there will be 100 million new servers by 2012, and "all of them still need to be managed." That's a problem, she said, since the tools to do this are not keeping pace.

Our customers have referred to this issue as "islands," referring to the need for different management tools, interfaces, etc. to manage their heterogeneous environment. After all, customers and partners tell us, they're trying to manage services, no matter if the applications run on Windows or non-Windows, physical or virtualized.

For those of you in that last camp, like Atlanta Journal Constitution, Mamut and Maxol, you know that Microsoft and some other systems management vendors are creating tools to keep pace with heterogeneous hypervisors and VMs, and as well traditional physical systems and non-virtualized applications. System Center is one such management tool; VMware vCenter isn't (yet, according to Alessandro). To elaborate on this point, check out RakeshM's latest blog post here. Here's an excerpt from his intro:

Put simply, people want to use a single primary console for day to day management of virtual machines across multiple hypervisors so we went after this problem. As a result, multi-hypervisor management via SCVMM 2008 has proven to be enormously popular with customers and partners alike.

Rakesh sheds light on VMware's concocted "demos" (nice touch using Microsoft exec names "muglia" and "ballmer" as host names) and conjecture. Rakesh summarizes his post with the following:

If you are thinking of using SCVMM 2008 to manage VMware because you have a mixed environment (and we have many many customers who are doing just that), keep in mind that SCVMM does not require you to uninstall or remove VMware Virtual Center from your environment. In fact, you have to keep Virtual Center around because VMware does not expose some APIs (like Vmotion) through ESX. We’re a manager of managers so it is nearly risk free to try it out and make up your own mind about how effective we are.

Oh, and by the way, Rakesh also says that the beta of SCVMM 2008 r2 will be coming this month.

I can't wait to see what demos VMware concocts next to counter the physical/virtual management sales and marketing by HP, IBM, CA and BMC. HP's Peter Spielvogel tips his hand here with HP's reaction. I'm sure this reaction will become stronger once VMware crosses the line to be more competitor than partner.

Patrick

Virtualization Review's hypervisor test

porourke — Mon, 09 Mar 2009 23:09:00 GMT

The other day, Virtualization Review published a comparative performance test of three hypervisors: VMware ESX 3.5, Windows Server 2008 Hyper-V and Citrix XenServer. You can see it here.

NOTE - there are few independent, published performance reviews of hypervisors because including ESX in the review without VMware's permission violates the VMware EULA about posting benchmarks. VMark doesn't count as independent. Amongst reviewers, this EULA restriction is well-known and am told serves as a deterrent to try to do performance comparatives. Rick Vanover and his editor, Keith Ward, deserve kudos for securing VMware approval for the performance comparison without jeopardizing journalistic integrity. Way to go!

OK, back to Rick Vanover's test. His test objectives:

All the hypervisors offer essentially the same base functionality. In this series of tests, the objective was to put the same workloads on each one and see how they stack up. The types of workloads tested varied, to simulate a typical environment in which some virtual machines (VMs) are stressed, and some aren't. Each platform was subjected to the same test plan parameters, to give a fair accounting of their performance.

Read about the comparison parameters, test environment and caveats. The results will be surprising (in a "man bites dog" sort of way) to many. Keith wrote:

The results, from writer/online columnist Rick Vanover, were startling, to say the least. The Porsche of hypervisors? XenServer. Raise your hand if you saw that coming. It outperformed Hyper-V and ESX in most categories. The pokiest? ESX. Again, not at all what I expected. In fact, even in the few tests ESX came out on top, it barely edged out the competition. Microsoft did well across the board, and is definitely a fine product.

We're pleased to see Hyper-V won 4 of the 11 tests (the others going to XenServer by a less than a horse length). For example, test 2 focused on a large number of heavy workload systems: 1 database server running one midsize database and 12 VMs with a heavy workload of CPU, memory and disk operations. Key takeaways from this test:

· Hyper-V completed SQLjob 52% faster than ESX.

· Hyper-V is 2.3 times faster than VMware ESX in CPU oVirtualization Review's hypervisor testperations.

· Hyper-V is 3 times faster than VMware ESX in test for average RAM operations.

At the end of the article, Rick ran one set of tests with 3 GB overcommit for ESX 3.5. Rick pointed out that this feature is useful to many in the data center, it does come at the expense of performance. The test showed that with ESX overcommit enabled:

· Average CPU Operations per VM were 3x slower

· Average Disk Operations per VM with 4.5x slower

· Average SQLjob Completion Time was 33% slower

As Rick wrote:

Results showed that while you can load more guests onto the host, there's no free lunch. There was a dip in performance and database response time.

Patrick

Windows Virtualization Team Blog : ESX

Update: More than recession: IDC's server virtualization tracker report

Virtualization: desktop to datacenter

Update: What you won't see at VMworld 2009

VMworld 2009 an oppurtunity to meet our customers

Hypervisor Footprint Debate Part 3: Windows Server 2008 Hyper-V & VMware ESXi 3.5

The Microsoft Security Development Lifecycle

Hypervisor Footprint Debate Part 1 UPDATE: Microsoft Hyper-V Server 2008 & VMware ESXi 3.5

Hypervisor Footprint Debate Part 1: Microsoft Hyper-V Server 2008 & VMware ESXi 3.5

Too many Virtual Iron customers in the fire?

VMware vSphere pricing - Meet the new price; same as the old price, only more

The vSphere Cloud Operating System: Extra Layer, Extra Cost?

Top 10 VMWare myths video

March 31 live web chat

System Center Ops Manager management pack for Hyper-V

SCVMM and VMware ESX management

Virtualization Review's hypervisor test