c0t0d0s0.org - Sun/Oracle

Deep insight into the behaviour of the SPARC T4 processor

nospam@example.com (Joerg Moellenkamp) — Sat, 07 Apr 2012 15:24:07 +0200

Ruud van der Pas and Jared Smolens wrote an really interesting whitepaper about the SPARC T4 and its behaviour in regard with certain code: How the SPARC T4 Processor Optimizes Throughput Capacity: A Case Study. In this article the authors compare and explain the behaviour of the the UltraSPARC T4 and T2+ processor in order to highlight some of the strengths of the SPARC T-series processors in general and the T4 in particular.

Performance impact of the new mtmalloc memory allocator

nospam@example.com (Joerg Moellenkamp) — Fri, 16 Mar 2012 08:50:44 +0100

I wrote at a number of occasions (here or here), that it could be really beneficial to use a different memory allocator for highly-threaded workloads, as the standard allocator is well ... the standard, however not very effective as soon as many threads comes into play.

I didn't wrote about this as it was in my phase of silence but there was some change in the allocator area, Solaris 10 got a revamped mtmalloc allocator in version Solaris 10 08/11 (as described in "libmtmalloc Improvements"). The new memory allocator was introduced to Solaris development by the PSARC case 2010/212.

But what's the effect of this new allocator and how does it works? Rickey C. Weisner wrote a nice article with "How Memory Allocation Affects Performance in Multithreaded Programs" explaining the inner mechanism of various allocators but he also publishes test results comparing Hoard, mtmalloc, umem, new mtmalloc and the libc malloc. Really interesting read and a must for people running applications on servers with a high number of threads.

Tracing ZFS

nospam@example.com (Joerg Moellenkamp) — Tue, 10 Jan 2012 11:34:50 +0100

Brendan Gregg wrote a really interesting article about tracing ZFS: Activity of the ZFS ARC. Really worth a read.

Simulating that clould

nospam@example.com (Joerg Moellenkamp) — Sat, 10 Dec 2011 09:45:38 +0100

In the past i wrote quite often about a thing that i call systemic features, when features start to fit together seamlessly in order to create possibilities more than the sum of the features. One of the systemic features is the simulation of the cloud. I don't talk about that thing that most people connect in mind with the word cloud (the grid with a credit card checkout ), but the cloud-like icon in many architectural diagrams called "Network" or "Internet" that sits between the client and the application that often resembles the "a wonder happens here" box in many architectures.

It's not new: I talked about this mid November at the DOAG conference in Nuremberg. And i've playing around with this at customers an privately for a while now.

Many customers have networks as large and as complex as the internet part of a smaller country perhaps 15 years ago. The interesting question is: How can you test your application for it's resiliency against failures in this cloud shaped icon. How does your application react, when your network is doing its high availability magic.

And interestingly Solaris 11 can help you here. The thoughts behind this are pretty simple.

A router is a computer that runs an operating environment that is tailormade to do network stuff, but at the end it's a computer with a OS (yeah, i know, hardware offloading makes this a little bit more complex, but at the end it's that way)
A zone is a virtual operating environment.
Each zone can have it's own set of routes.
Each zone can have it's own set of firewall rules.
Each zone can have it's own set of processes.
Routing protocols are not more than processes collecting information from the network and configuring the routing table.
You can install a vast array of dynamic routing protocols on a zone.
I can have up to 8192 zones (given enough memory)
In Solaris 11 i can emulate switches (etherstubs)
I can limit bandwidths in Solaris 11 out-of-the-box with crossbow

When i'm combining all this features i can set up a vast array of zones doing nothing else taking each incoming packet on a interface, routing it on a multitude of ways between each other, and send it out on a outgoing interface. Even when the system in your environment are placed in many separate networks of your network you can still use a system with many networking cards or something called server-on-a-stick (single high-bandwidth connection to a vlan-trunking capable switch and using the switch ports as a fan-out).

So in order to emulate a complex corporate network, all i have to do is configuring a lot of etherstubs, configuring many vnics, replicate the physical bandwidths with the maxbw setting on the vnics, set up a lot of zones, perhaps translate the ACL of the routers into firewall rules for firewall functionality of Solaris, installting the routing daemons and configure it similar to the configuration of the routers (in regard of timeouts and so on).

Now i can test, how my applications react, when the network starts to converge against a new topology because of the failures of some lines. I can test, to which topology my network will converge after an line outage (which is nothing more than a deny-all firewall rule). I can test the impact, when the network converges that way, that my traffic flows over a 2 MBit/s line instead of a 155 MBit/s line. For even more complex failure modes i can even use the htbx driver to introduce additional latencies, packet drop or packet reorderung as shown in this article. In essence you can emulate your complete internal network in a single box and with Zones and Crossbow in Solaris 11 it's so low overhead (at the end it is still just one kernel) that you can really emulate the reality and not a simplyfied view, as you don't have emulate via separate hardware or many independent operating system instances in virtual machines.

At the end you could simply use a single Solaris system, put it between all your test systems and use this solaris system as a emulation device for your corporate network. It's simulating the cloud-shaped icon in your architectural diagrams.

Veranstaltungshinweis: Oracle PARTNER SE (System Engineer) University in Fulda

nospam@example.com (Joerg Moellenkamp) — Mon, 05 Dec 2011 13:10:38 +0100

Vor der Acquisition von Sun durch Oracle gab es ja die Sun SE University. Dieses Format gibt es wieder. Vom 13. bis 14. Dezember 2011 findet die erste Oracle PARTNER SE University in Fulda statt. Diese Veranstaltung ist für Partner System Engineers gedacht, von denen ich weiss, das eine Reihe hier mitlesen. Mehr Informationen findet ihr hier

Nice example for the power of boot environments

nospam@example.com (Joerg Moellenkamp) — Tue, 04 Oct 2011 20:06:04 +0200

There is a nice example of the power of boot environment. Boot environments are something like snapshots of your operating system installation made writeable. As you may already assume, they are based on ZFS snapshots and the clone functionality. This is possible due to the usage of ZFS as the root filesystem.

So: Please don't try this at home. Whey you try it, don't try it on any Solaris 11 Express installation of any value. But don't try it. I don't want to hear any story. that you've deleted your ERP system by accident because you used the wrong terminal window. Leave that to trained professional stunt admins with the right equipment (Solaris 11 Express)

Assume you have a system, configured with all your application, everything is running fine. So you think it would be nice to have something like a freezed state of this situation. No problem. This command will do the trick.

# beadm create rescuenet
# init 6

When you reboot your system you will see it as a new entry in the grub menu.

Okay, but boot into the old environment starting "Oracle Solaris ..." first by selecting it in the grub menu (it should be already selected, or you used beadm activate already. Now i will drop the atomic bomb on your installation.

# rm --no-preserve-root -rf /

Essentially we've just nuked the installation. After a moment the system should just freeze. Reset the system and boot again via grub into the boot environment starting with "Oracle Solaris ...":

Okay ... on a normal system this would send you to the tapes. With Solaris 11: Reset the system. Boot into the boot environment "rescuenet" via selecting it in grub.

Tada! Just creating a boot environment with a single command after a config change may safe your butt later .... and btw ... this even works in zones ... they know the concepts of boot environment,too.

How to activate IPoIB Connected mode in Solaris 10 Update 9

nospam@example.com (Joerg Moellenkamp) — Mon, 03 Oct 2011 23:03:36 +0200

Just a short hint: The What's new document of Solaris 10 Update 9 states, that the support for IPoIB Connected Mode has been added in the release. However you have to search a bit in order for some information how to activate it. The necessary step is documented in the manpage for the ibd driver. Let's assume you have to instances of the ibd driver running (ibd0 and ibd1). In this case you have to change one line at the end of /kernel/drv/ibd.conf file to enable_rc=1,1; and reload the ibd driver respectively reboot the system. After that you ibd devices should show an mtu size of 65520 bytes instead of 2044.

PS: The process for Solaris 11 is better, as you just use dladm for it. However connected mode is the default there anyway. In Solaris 10 unreliable datagram was kept as the default, as one of the rules in Solaris is that you have to opt-in to such changes between updates.

Migrating your notebook from a smaller to a larger disk

nospam@example.com (Joerg Moellenkamp) — Thu, 21 Jul 2011 14:05:11 +0200

My colleague Christophe Pauliat - Principal Sales Consultant at Oracle - came up with a really nifty way to migrate his Solaris based notebook from a smaller disk to a larger one. I will copy his mail in verbatim here, because i think it's extremely useful. It somewhat resembles the "workaround" for ZFS resizing, however Christophe does takes this significantly forward and does this for boot disks.

OS: Solaris 11 express 2010.11 + SRU8 

Steps:

1) Copy data + OS on the new HDD
    a) connection of the new 500 GB HDD as an external USB HDD (using a USB external HDD box)
    b) creation of a Solaris 2 partition with fdisk and make it active (bootable)
         # fdisk /dev/rdsk/c4t0d0p0
    c) with the format command, create a partition s0 with all cylinders except cylinder 0
    d) Mirroring the existing ZFS pool (rpool) to the new HDD
         # zpool attach -f rpool c1t0d0s0 c4t0d0s0
        notes:
        - c1t0d0 is the 80 GB HDD (old HDD)
        - c4t0d0 is the 500 GB HDD (new HDD)
        - the option -f is necessary to bypass the warning "partition 0 overlaps partition 2"
    e) wait for the sync to be finished (with zpool status)
    f) Install Grub on the new HDD
        #  installgrub -m /boot/grub/stage1 /boot/grub/stage2 /dev/rdsk/c4t0d0s0
    g) Split the pool rpool by detaching to new HDD to create a new pool
        # zpool split rpool rpool2 c4t0d0s0
        note: I chose not to detach the old HDD because I wanted it to be usable in case of problem

2) Shutdown OS and laptop, disconnect the USB external HDD and replace the internal 80 GB HDD by the new one

3) Rename the new pool rpool2 to rpool
     - Boot on a Solaris 11 Express LiveCD or the network using AI
    note: In my case, I used an AI server I had installed before (Solaris 11 express 2010.11 with no SRU)
    - zpool import rpool2 rpool        to rename the pool
    - zpool export rpool                    to export it so that there is no warning in step 4

4) Boot on the new HDD
    - It works just fine, but the pool size is still the size of the old HDD (80 GB)
      altough it uses a 500 GB partition (c4t0d0s0)

5) Increase the pool size to use the whole partition
     # zpool set autoexpand=on rpool

The autoexpand really does an large amount of the trick. The size of a mirrored pool is always the size of the smallest disk. When you have an 80 GB and a 500 GB disk, the size of the pool is 80 GB. Remove the 80 GB disk. The smallest disk is now 500 GB and the size of the pool is 500 GB now as well, as long as you've activated autoexpand.

A little change of queues

nospam@example.com (Joerg Moellenkamp) — Wed, 06 Jul 2011 11:50:58 +0200

An overwhelming number of ZFS installations work with just a bunch of disks, perhaps in a JBOD or in the server itself. However there are installations, that use disk arrays with RAID-controllers. Some of those installations are even using a single LUN. I dont think that this is a good idea (for e.g. because ZFS can just detect corruptions without redundancies, but not repair them) but thats a different story I dont want to discuss here.

There is a slight change in the default parameters of ZFS in Update 9. Its related to the parameter zfs:zfs_vdev_max_pending . This parameter controls, how many I/O requests can be pending per vdev. For example when you have 100 disks visible from your OS with a zfs:zfs_vdev_max_pending of 2, you have 200 request outstanding at maximum. When you have 100 disks hidden behind your storage controller just showing a single LUN, you will have you will know it 2 pending requests at maximum.

You may think, that you could increase the queue depth without end, but as usual this is a tradeoff game and not that easy, longer queue depths may increase latency of the commands. Experience showed that certain queue depth delivered the best performance on most installations.

However the installed landscape changes and sometimes you have to adjust things. Exactly this happened a while ago in Opensolaris. And it seems that this change moved into Solaris. The default for zfs:zfs_vdev_max_pending is 10 at the moment. You can check this:

# echo zfs_vdev_max_pending::print | mdb kw
0xa
#

0xa in decimal is 10.

And this is a wise choice for most implementations out there. But it was different on older versions. I checked it on U7, i asked my twitter/facebook contacts to make quick check on U8 as i was to lazy to install it:

# echo zfs_vdev_max_pending::print | mdb kw
0x23
#

0x23 in decimal is 35 and 35 was the default up to Update 8 of Solaris 10.

So essentially the queues are less deep than before. For JBODs this is most often a good thing, as each vdev and thus each LUN has its own queue of 10 pending I/Os. For a single LUN hiding many disks sometimes not. So how do you change it back to the old value?
You can change it dynamically:

# echo zfs_vdev_max_pending/W0t35 | mdb kw

To make this change boot-persistent you have to add a line to /etc/system:

set zfs:zfs_vdev_max_pending = 35

Sometimes even an higher value may be indicated with very large numbers of disks behind your controller forming a single LUN.
How do you know if this decreased queue depth is a problem for you at all? The command iostat will help you:

jmoekamp@hivemind:~$ iostat -xdn
                    extended device statistics
    r/s    w/s   kr/s   kw/s wait actv wsvc_t asvc_t  %w  %b device
    6,3    1,9  525,9   31,2  0,1  0,0   16,4    6,0   2   3 c3d0
   17,1    1,0 1676,0    8,0  0,2  0,1   11,4    4,8   4   4 c3d1
    6,4    1,9  525,8   31,2  0,1  0,0   14,1    4,8   2   2 c4d0
   17,1    1,0 1675,9    8,0  0,2  0,1   12,9    4,7   4   4 c4d1
    0,0    0,0    0,0    0,0  0,0  0,0    0,0    0,0   0   0 gsdbc
jmoekamp@hivemind:~$

If you see the column actv at or near the number of zfs:zfs_vdev_max_pending, its worth a try. Otherwise not.

Result of the "How long do you wait before Solaris 11 gets on your prod systems?"

nospam@example.com (Joerg Moellenkamp) — Thu, 23 Jun 2011 16:20:48 +0200

At approx. 16:20 the poll had the following outcome:

Solaris 10/11x hardware compatibility list

nospam@example.com (Joerg Moellenkamp) — Thu, 02 Jun 2011 21:40:16 +0200

The Solaris 10/11 Express Hardware compatibility list has a new home: It's now part of the OTN and available at http://www.oracle.com/webfolder/technetwork/hcl/index.html

Darren Moffat about encrypted swap and /var/tmp

nospam@example.com (Joerg Moellenkamp) — Sun, 22 May 2011 08:42:01 +0200

Darren Moffat explained in his blog how to encrypt swap and /var/tmp in Solaris 11 Express.

Stefan Schneider about the Solaris 11 Compatibility Checker

nospam@example.com (Joerg Moellenkamp) — Wed, 23 Mar 2011 17:57:20 +0100

Just got a mail from Stefan Schneider, the developer of the compatibility toolkit, describing what the compatibility tester is really for:

Being the project owner of the tool: Oracle takes extreme care that previous investments of software partners in Solaris 10 will be protected. The tool is spotting fairly extreme corner cases of usage of private or deprecated interfaces and commands. The tool tracks the delta of Solaris 10 (318000 files) to Solaris 11 Express at a command and symbol level. This is about common change management with a strong focus on frame work version creep and end of life of components which are outdated for more than a decade. A few examples and their mitigation are getting discussed here: http://www.scalingbits.com/solaris/compatibility

Image Packaging System in the Spotlight of the OTN

nospam@example.com (Joerg Moellenkamp) — Thu, 17 Mar 2011 21:15:59 +0100

There is an interesting page at the Oracle Technology Network summarizing the information about the new packaging of Solaris 11 Express and Solaris 11: "Oracle Solaris 11 Express Package Management with Image Packaging System (IPS)"

Second talk on Cebit 2011

nospam@example.com (Joerg Moellenkamp) — Thu, 03 Mar 2011 14:40:25 +0100

My talk at the cebit yesterday afternoon wasn't that good, for the level i demand from me, it was exceptionally bad. It wasn't my presentation, it was a presentation made by the product manager. It wasn't a bad presentation. To the contrary. However it wasn't my presentation style and i assume everybody aware of my usual style got quite aware that i felt not that well while giving this talk. Okay ... At 15:15 i have the opportunity to hold the talk again in pavillion 36 on the CeBIT fairground and i hope it will be much better than yesterday.

Backporting

nospam@example.com (Joerg Moellenkamp) — Mon, 21 Feb 2011 22:10:49 +0100

A nice article written by Alan Hargreaves -as well Principal Field Technologist- to explain, why the version number of the Apache delivered with Solaris 10 doesn't automatically indicates that it's vulnerable against the attacks reported against Apache since that version:

Now, that being said you may also note after installation that it still identifies as Apache 2.0.63 and you may have concerns about vulnerabilities addressed in 2.0.64 mentioned on the Apache web site.

The way that we maintain Apache on Solaris 10 is not to drop in new releases as they happen, rather we take the fixes mentioned and backport them to our 2.0.63 codebase.

Alan, i hope linking to this article reliefs you from some additional calls about this topic

Secure Deployment of LDOMs

nospam@example.com (Joerg Moellenkamp) — Thu, 03 Feb 2011 19:09:34 +0100

Stefan Hinker wrote a great document about the secure deployment of LDOMs.

Apple start to make public contributions to OpenJDK

nospam@example.com (Joerg Moellenkamp) — Wed, 12 Jan 2011 20:42:30 +0100

Mike Swingler of Apple announced yesterday, that Apple has started to contribute to the OpenJDK project:

I'm very happy to let you know that today we made the first public contribution of code to the OpenJDK project for Mac OS X. This initial contribution builds on the hard work of the BSD port, and initially has the same functionality. Today's contribution simply modifies the build process to create universal binary, and produces a .jdk bundle which is recognized by Java Preferences and the JVM detection logic in Mac OS X.

You will find a list of important links in regard of this project in the announcement mail.

New Solaris features: Notifications from the Fault Management Architecture

nospam@example.com (Joerg Moellenkamp) — Mon, 22 Nov 2010 12:55:06 +0100

The notification framework in Solaris is not only able to notify you of problems with services. As you may know, the fault management architecture monitors the hardware of a Solaris system. With the fmdump command you can retrieve the information. For example you get this informatoin when you unplug an USB stick with an active ZFS filesystem:

root@solaris:/home/jmoekamp# fmdump -v TIME UUID SUNW-MSG-ID EVENT Nov 22 12:59:48.7489 22dffa96-bf27-4f41-ab1f-dfedcdfb11e7 ZFS-8000-HC Diagnosed 100% fault.fs.zfs.io_failure_wait Problem in: zfs://pool=usbstick1 Affects: zfs://pool=usbstick1 FRU: - Location: -

Wouldn't it be nice to receive this and similar information about the failure of components. It's really simple to configure. However i assume , that you've already installed smtp-notify package with

root@solaris:/# pkg install service/fault-management/smtp-notify

To configure the notification, you just have to configure the target mail adress for the mails.

root@solaris:/# svccfg setnotify problem-diagnosed mailto:root@localhost

To check the configuration you can use the listnotify command:

root@solaris:/# svccfg listnotify problem-diagnosed
    Event: problem-diagnosed (source: svc:/system/fm/notify-params:default)
        Notification Type: smtp
            Active: true
            reply-to: root@localhost
            to: root@localhost

        Notification Type: snmp
            Active: true

        Notification Type: syslog
            Active: true

When you unplug the USB-stick with while the ZFS pool is imported, you will find a mail like this one in your mailbox:

root@solaris:/# mail
From noaccess@solaris.local Mon Nov 22 12:59:48 2010
Date: Mon, 22 Nov 2010 12:59:48 +0100 (CET)
From: No Access User 
Message-Id: <201011221159.oAMBxm5o002968@solaris.local>
Subject: Fault Management Event: solaris:ZFS-8000-HC
To: root@solaris.local
Content-Length: 560

SUNW-MSG-ID: ZFS-8000-HC, TYPE: Error, VER: 1, SEVERITY: Major
EVENT-TIME: Mon Nov 22 12:59:44 CET 2010
PLATFORM: VirtualBox, CSN: 0, HOSTNAME: solaris
SOURCE: zfs-diagnosis, REV: 1.0
EVENT-ID: 22dffa96-bf27-4f41-ab1f-dfedcdfb11e7
DESC: The ZFS pool has experienced currently unrecoverable I/O
	    failures.  Refer to http://sun.com/msg/ZFS-8000-HC for more information.
AUTO-RESPONSE: No automated response will be taken.
IMPACT: Read and write I/Os cannot be serviced.
REC-ACTION: Make sure the affected devices are connected, then run
	    'zpool clear'.


? q

Neat, isn't it?

Darren Moffat about the internals of ZFS encryption

nospam@example.com (Joerg Moellenkamp) — Fri, 19 Nov 2010 22:22:31 +0100

Darren Moffat wrote a great blog article about the internals of the ZFS encryption - "ZFS encryption what is on disk ?":

This article is about what is and isn't stored encrypted on disk for ZFS datasets that are encrypted and how we do the actual encryption. It does require some understanding of Solaris and ZFS debugging tools.

New Solaris features: How to monitor SMF services via mail?

nospam@example.com (Joerg Moellenkamp) — Fri, 19 Nov 2010 21:47:00 +0100

It's a small feature compared to other additions to Solaris, however already i got the first questions how to configure it: the capability of the Service Management Facility to send mails when a state transitions occur.

Continue reading "New Solaris features: How to monitor SMF services via mail?"

Darren Moffat about ZFS encryption

nospam@example.com (Joerg Moellenkamp) — Tue, 16 Nov 2010 08:50:43 +0100

Darren wrote three really interesting articles about ZFS encryption: The first one is Introducing ZFS Crypto in Oracle Solaris 11 Express. This blog entry gives you a first overview how to use encryption for ZFS datasets. The second one titled "Assured delete with ZFS dataset encryption" explains how you can use the encryption feature to implement assured deletion with the "throwing the keys away" technique. Last but not least the article "Having my secured cake and Cloning it too (aka Encryption + Dedup with ZFS)" explains how deduplication and encryption work together in Solaris 11 Express.

About Java on MacOS X

nospam@example.com (Joerg Moellenkamp) — Sat, 13 Nov 2010 07:26:17 +0100

There is an interesting joint statement about the future of Java on MacOS X:

Oracle and Apple today announced the OpenJDK project for Mac OS X. Apple will contribute most of the key components, tools and technology required for a Java SE 7 implementation on Mac OS X, including a 32-bit and 64-bit HotSpot-based Java virtual machine, class libraries, a networking stack and the foundation for a new graphical client. OpenJDK will make Apples Java technology available to open source developers so they can access and contribute to the effort.

Vortrag auf der DOAG 2010

nospam@example.com (Joerg Moellenkamp) — Fri, 05 Nov 2010 15:27:57 +0100

Wo ich vorhin meine Karte für die DOAG2010 aus meinem Postfach in der Firma rausgefingert habe: Ich halte am 18.10 um 10:00 bis 10:45 einen Vortag zum Thema "Performance Analyse - oder: Was macht eigentlich mein Solaris?". Ich werd wahrscheinlich auch am 18.10 nachmittags auf dem Oracle-Stand Dienst schieben.

Das Programm bietet auch noch andere interessante Vortraege zum Thema Solaris, Sun und das Drumherum. So beispielsweise am 18.11: Detlef Drewanz wird beispielsweise zum Thema "Neue Technologien zur Netzwerk-Virtualisierung in Solaris 11" sprechen. Zum Thema Hardware werden Elke Freymann und Stefan Hinker in "Sun Server News: SPARC T3, x86, Virtualisierung und Management". Die Vorträge von Thorsten Lange lohnen sich immer und ich gehe davon aus, das "Content Management und Archivierung mit Oracle Software und Sun Hardware" da keine Ausnahme darstellen wird. Ansonsten empfehle ich noch Hartmut Streppels "Hochverfügbarkeit von Anwendungen mit Oracle Solaris Cluster ". Hartmut hat wahrscheinlich mehr über den Sun Cluster vergessen, als ich je wusste.

Firesheep and the SSL everywhere route - Solaris and SPARC may be of help

nospam@example.com (Joerg Moellenkamp) — Fri, 29 Oct 2010 09:08:32 +0200

Sometimes i can observe trends in reader interest in the webserver logs: In the last time there were a lot of accesses to an article dating back to September 2007 when i talked about SSL acceleration and made the case for T2.

In the first few seconds i asked my self, why there is that new interest in this article. However then i just thought "Damned, Firesheep".

Just in case you didn't heard about it: With firesheep you can highjack user sessions by sniffing on unencrypted data flow in your network. This can work, as often the authentication form itself is encrypted, but afterwards they use unencrypted communication. The authorization to access those pages with your login credentials is carried forward by cookies. When you are able to gather this cookie, you can take over the session of a user. This isn't really a new attack vector, but firesheep is makes this really easy ... script-kiddies easy. It's integrated into Firefox as a plugin and hijacking other peoples session is as easy as changing tabs.When you want an explanation for that, please look at Eric Butlers preso "Hey Web 2.0:Start protecting user privacy instead of pretending to". The attack vector bases on the fact that someone can sniff your data. You may think at first "Well, we have switches, no sniffing", however think about unencrypted (and i consider WEP as unencrypted) WLANs.

There is just one solution: Encrypt everything. HTTPS to the help. However while this isn't a problem on client side, it creates a lot of problems on the server side. Like the problem, that virtual hosts are in need of their own IP addresses (there is an Hen-Egg-Problem in SSL). Or that you have to provide the other end of the cryptographic connection, thus you have to do all the calculation on the server side.

I'm still pretty sure, that SPARC T-class and Solaris can really help you here. The T-Series because of it's cryptographic unit. It isn't just an rather small extension like the additional commands in Nehalem to accelerate AES, it's a full-fledged crypto co processor. In the case of the SPARC T3 you have 16 of them and they got some significant update to accelerate mor ciphers and to handle many small packets much better. There is an interesting presentation availble about this piece of silicon in T3. It's already the 3rd generation of crypto acceleration in T3.

However hardware is nothing without software and thus i want to point you view to kssl. kssl is an in-kernel proxy for SSL. This in-kernel proxy uses the hardware acceleration in the T3 via the Solaris Cryptographic Framework (SCF), another nice thing that does the abstraction between the hardware (or non-existing hardware, when you do cryptography on your normal CPU) and the services using cryptography. Why is the in-kernel proxy that useful? At first it's easy to configure, but more important you don't have to hop between user- and kernelspace, as when a usermode library like openssl uses the kernel driver of your hardware. This gives you additional performance.

This kssl and SCF thing is however nothing that's limited to T-class. It's available on x86-solaris as well and in the case you purchase a supported crypto acceleration card, kssl uses this via SCF as well. However a PCI based card can never be as fast as crypto accelerators directly on die and on core like the ones in T-class.

Performance Impact of kssl

nospam@example.com (Joerg Moellenkamp) — Fri, 24 Sep 2010 21:50:49 +0200

One of the hidden gem of Solaris is the kssl feature. Long-time readers know this feature, as i wrote a tutorial about it. For the uninitiated: It's a in-kernel SSL proxy. Why should you put this in the kernel. Well, especially when you use a SSL-accelerator you have to jump from user space to kernel space and back several times as the SSL library (OpenSSL e.g) is in user space and the driver for the card is in kernel space. That jumping costs you a lot of time. There is an interesting article about Weblogic SSL performance in the BestPerf blog.

When you just want to take one thing out of this whole article, then just look at the first chart at the red and the blue line: Red is the system configured to provide SSL via kssl, blue is the system configured to provide SSL via Weblogic itself. Both systems are using the SSL hardware. I don't know how you would call it, but the difference is pretty significant. A good example, why kssl is such a nice tool. And it's just there in Solaris 10.

System Duty Cycle scheduler class

nospam@example.com (Joerg Moellenkamp) — Wed, 15 Sep 2010 13:04:00 +0200

Perhaps you've read about the System Duty Cycle scheduler class. Some people reported about it, but rather cursory. So ... what is the story behind the System Duty Cycle scheduler or short SDC?

Continue reading "System Duty Cycle scheduler class"

zfs diff in Opensolaris

nospam@example.com (Joerg Moellenkamp) — Sun, 08 Aug 2010 17:44:00 +0200

A while ago i wrote about the PSARC PSARC 2010/105. It's about an extension to the zfs tool to implement a subcommand to create a list of changed files between two snapshots. This change has been integrated to Solaris now.

So with a command like zfs diff datapool/texts@monday datapool/texts, you get an output like

M       /myfiles/
M       /myfiles/link_to_me	(+1)
R       /myfiles/rename_me -> /myfiles/renamed
-       /myfiles/delete_me
+       /myfiles/new_file

A M represents a modified file or directory, a R is a renamed filesystem objects. - files and dirs were removed, the ones with + were added.

Snapshot based boot environments into OS/Net

nospam@example.com (Joerg Moellenkamp) — Fri, 06 Aug 2010 06:09:01 +0200

At first you might have thought "Snapshot-based boot environments in Solaris? Old hat!". And indeed, this is part of Opensolaris for quite a time. However it wasn't part of the the ON consolidation. With the implementation of PSARC 2010/059 and RFE like "6964804 SNAP BE management into ON" this mechanism is now part of the consolidation.

PSARC 2010/306 - read-only zpools

nospam@example.com (Joerg Moellenkamp) — Sat, 31 Jul 2010 16:07:06 +0200

You may think that this already there, but so far you was only able to set a single dataset (ZFS filesystem or ZFS emulated volume) into read-only. This PSARC case proposed such an mode-of-operation for the complete zpool. According to the documentation of this case, the following steps are done to reach the read-only-ness.

1). pool is loaded but transaction processing is disabled
2). all filesystems and zvols are mounted in read-only mode
3). any intent-log replays are deferred (any pending synchronous writes will be replayed once the pool is imported read-write)