1 Bit at a Time

This site has moved

2017-12-26T14:51:00.001-08:00

This site has moved to https://www.christopherkeim.com . Please update any links you may have. Not all content will be moved over.

New Script: XenServer VM Memory Management Bash Script

2015-02-14T12:25:00.001-08:00

Once virtual desktops are deployed, you typically don't need to adjust the resources often for those VMs unless resource utilization has grown due to additions or some other reason. This happened recently with a customer. Their desktops needed a bit more RAM and there was some additional RAM added to the XenServer hosts. They requested my help and wanted to know the quickest and least impact method for adjusting the RAM allocation for each virtual desktop. Right away I thought of three ways of accomplishing this:

Manually perform this feat.
Update the template VM and re-deploy hundreds of desktops. Better than manually updating the RAM allocation, but still takes too much effort and time.
Script it.

Obviously I chose door number 3 above. This was a quick script, but I built some logic into it as well as added logging. With this menu driven script, you can:

List all VMs in a XenServer pool with a specified static max setting.
Update memory on all VMs within a XenServer pool with a specified static max to a newly specified amount.
Preview the changes before making them.

After writing the script, I chose to run the script after-hours, as this script will only change memory on VMs that are shutdown. I ran the script and updated several hundred VMs in just a few minutes.

You can read more about this script and download it here.

This post was written in reference to the following platforms and versions:

XenServer 6.2

Citrix Summit 2015: Day 2

2015-02-08T11:22:00.001-08:00

Day 2 (really day 3) started with the tech talks keynote. This key note is NDA, so I cannot go into detail. But, suffice to say there will be a good number of announcements most likely during Synergy later this year. But one thing I am excited to look into, is Workspace Cloud.

I attended self-paced labs for a good chunk of the day, which gives great hands-on experience to many Citrix technologies. But starting in the afternoon, I attended a session about vGPU and XenServer presented by David Cottingham. It is nice to see XenServer getting some love. I am really happy about the 64bit architecture, as this will allow for further compatibility with hardware manufacturers (Fusion-io). This session went into detail about the 6.5 release of XenServer. Below are some of the new features / information about this release:

64-Bit control domain. The control domain (dom0) used to be 32bit, not anymore!
In memory read cache. This feature allows you to store your golden images in RAM, significantly improving performance.
Storage. Live LUN expansion! Support for tapdisk3.
Network. Updated Open vSwitch 2.1.3. Improved vNIC performance.
vGPU. Now 96 GRID vGPU sessions per host.
XenServer split into two editions: Standard and Enterprise.

The last session of the day, I attended was another great presentation by Daniel Feller. Extremely fast paced because so much great information crammed into a small segment of time. Daniel went into various tests the Citrix team performed on various hypervisors with the resulting performance outcomes. The three hypervisors tested were Microsoft, VMWare, and of course Citrix. One of the best stats was that of the RAM Cache with Disk Overflow. In a nut shell, you can get down from an average of 15 IOPS per Windows 7 user to .1 IOPS. All this while not using expensive an SAN, or using local expensive SSDs or some other complex configuration or expensive 3rd party hardware addition. All you need is RAM plus some disk.

The day closes out with the partner closing keynote. Another great day! But, there is more to be had...PARTY!!! Well the partner appreciation party. This time we got bused to the Las Vegas Speedway. Plenty of great food and entertainment. You could strap in and take a ride around the oval with a professional driver, take a drifting ride, or get in the driver seat yourself with go-karts. I was able to get in the drifting car and that was a insane! Well played Citrix.

With the close of Summit, there are a few things to take away:

Citrix is definitely focused on consumer (a.k.a the user) experience.
With Framehawk integration, it is a no brainer when choosing between Citrix and VMWare.
Linux is not a limiting factor anymore when looking into desktop virtualization.
A mouse for iPad!
Easier migrations from Legacy Citrix products.

If you are on legacy Citrix products, thinking about VDI, or wanting to load balance / accelerate network traffic, contact a Citrix partner and ask for a demo. This year is a great year to get started.

Citrix Summit 2015: Day 1

2015-01-21T20:56:00.002-08:00

As day 1 (really day 2) started and I realized it takes me 30 minutes to get from my hotel to Summit and working off bad in room coffee, I ponder my hotel choice for the event. Oh well, a quick grab of actual coffee (not hotel room coffee).... and on to the Vision Keynote! So this if the official kick off of Summit, even though it really started yesterday. Great attendance, great vibe, and a great staff as we walk into the main room. The lights dim and the information starts flowing.

OK, there was some great presentations, but you want to see a summary, not read me ramble on about software defined stuff or whatever. But, I do have to say that Citrix has the "consumer" experience first, and this is of course not a new idea. But, this has been forgotten by many. Not that the consumer comes first, but the experience of the consumer must come first.

One other idea that Mark Templeton introduced was the software defined workspace. What makes up the software defined workspace idea is agility, manageability, and predicting what users want before they know.

Below is a quick list of the announcements during this keynote:

XenServer 6.5 - What I have been excited about during the beta testing of XenServer 6.5 is a 64bit dom0!
XenApp online migration tool - There are some powershell scripts to help migrate from XenApp 6.5 to 7.6, but this migration tool will make it that much easier.
Citrix Receiver X1 - A nice new clean interface, that can be branded, and other features like application ratings and bundles (sounds like folders). You can see the new receiver here.
Citrix XenMobile 10 - For more information, click here.
Session recording (a.k.a. Smart Auditor) - Its funny how Citrix had some great features back in the day, then depreciated them, now bringing them back. I do give Citrix great credit in listening to customers and partners, and bringing them back. Again, they are focusing on the experience and this is very apparent.
WorkspacePod - A complete Citrix certified integrated solution from the hardware to deliver workspaces.
CloudBridge Virtual WAN - More information to come.
Linux virtual desktops and apps - I am very excited about this. Now, I don't get very many requests for Linux virtual desktops, but I am a huge Linux fan and this makes me very happy!
Framehawk integration - Where do I start? Framehawk helps with packet loss (yes I am over simplifying this). But to what extent? There was a demo with up to 10% loss over a WIFI connection with the user experience seeming to be unaffected except for the computer without using Framehawk. Nice, OK. Then they bumped up the packet loss to 50%! The computer not using Framehawk was unusable, but the computer using Framehawk was working just fine. Very, very, very impressed!
Citrix X1 Mouse - Finally a mouse for iPad users!

After the keynote, off I went to partake of the many offerings of Citrix Summit 2015. First on the agenda was an instructor led lab about using the NetScaler 10.5 NITRO API. Now, I'm not really a developer, even though I have and currently working on some custom solutions. This was the first time I was introduced to this method and using REST interfaces. It was very interesting learning how to manipulate NetScaler outside the CLI and GUI. For more information, click here.

I finished out the day working on some more labs, like WAN optimization using CloudBridge. For more information, click here.

Next I will be posting a summary of the final day of Citrix Summit 2015 minus the NDA stuff.

Citrix Summit 2015: Day 0

2015-01-12T23:02:00.000-08:00

One flight delayed, and the airline pilot announcing "what happens in Vegas will live with you forever".... Not really the exciting journey I was hoping for. But, once in Las Vegas, dropped our luggage off at the hotel (My wife got a special sticker on her baggage. I really think she packed some kettle bells in some hidden compartment, that suitcase was HEAVY!). Once I found my way to The Venetian (A quick hop on the monorail, and a not so quick walk.), I made my way to the check-in to grab my badge and NEW BACKPACK!

Because of the late arrival, I wasn't able to get two self paced labs. No matter, as I am here to learn, not to regret as this is Vegas! I enter the self-paced lab area, a large room, with about half-full of like minded engineers and find my assigned seat. After perusing the catalog of courses, I settled on "Upgrading Legacy XenApp To The New XenApp 7.6".

What was nice about this lab, was it was centered on end user experience and of course... acceptance which is sometimes very hard. They stepped through a simple upgrade process:

Verify XenApp legacy functionality
Configuring StoreFront for both XenApp versions
Enabling application de-duplication in StoreFront
Enabling a Web Interface type feel in StoreFront by disabling user subscriptions
Exporting legacy farm data, then importing this data into XenApp 7.6
Upgrading XenApp 6.5 servers with the new XenApp 7.6 virtual desktop agent (VDA)
And of course verify
Plus a bonus exercise

The whole takeaway is that the user experience is a focus during an upgrade and as well, ease of upgrade. For those that are still on XenApp 6.5 (or heaven forbid XenApp 5, of which I still see around) no need to fear an upgrade, only benefits to gain. Definitely looking forward to tomorrow morning!

Citrix Summit 2015

2015-01-07T12:16:00.001-08:00

2015, a new year and time to get in shape! I'm not talking about the gym and doing who knows how many reps of burpees (an evil vomit inducing exercise). No, I'm talking about building up technical skills, shedding those unwanted legacy solutions, and gaining the business strength and endurance we all want at Citrix Summit 2015. For those of you who don't know, Citrix Summit is an event for Citrix Partners to grow their technical skills, businesses, and have fun (this year it is in Vegas!).

The event really starts on Monday 1/12/15 (Citrix lists 1/13/15 as the start date) and ends on Wednesday afternoon with a partner appreciation party which is always fun. There are lots to choose from, from sales, business and various technical tracks.

Monday is really "on your own" day. They have self paced labs and other stuff. Not much to mention here, but definitely worth attending. Tuesday starts off with the Vision Keynote delivered by the ever so great Citrix leader CEO Mark Templeton and the VP of Sales Al Monserrat. After an always great keynote, they will let us loose to find our way in the web of sessions. I always find it hard to choose what sessions I want to attend. But, I do have a backup plan, well several. One, my colleague Brian McCarty is attending as well, so hopefully what I don't have a chance to see he will get the info and hopefully give me a brain dump. Two, Citrix usually posts some of the sessions on line later on.

Wednesday kicks off with another keynote, Tech Talks Keynote delivered by Tom Flink (Vice President, Worldwide Channels and Market Development Citrix), Jess Lipson (Vice President & General Manager, Documents Cloud Citrix), Sunil Potti (Vice President and General Manager, NetScaler Product Group Citrix), Dan McCall (Vice President, Product Management and Product Marketing, Client Virtualization Citrix), and Brian Dye (Vice President and General Manager, Mobile Platforms Group Citrix). Once again, we are let loose to pick and choose our own sessions. There are a couple of session on this day, that I am especially looking forward to attend.

All in all, it look like a great event that I am excited to attend. Check back soon, because I plan on sharing what I learn (minus any NDA stuff). You can follow me on twitter during this event as well (https://twitter.com/chris_keim).

Sources:
Citrix. Citrix Summit [Web Page]. Retreived from http://www.citrixsummit.com

How to Force Sessions through NetScaler Gateway

2014-12-31T19:01:00.000-08:00

It always happens. You start a project with a clear direction and wham, you get a curve ball. Something new pops up out of no where and you have to quickly scramble to address this well timed [sarcasm] addition and try to stay on schedule. Better yet, have the schedule already very aggressive based on a customers deadline of which you cannot go past or the gates of hell, otherwise known as the project managers fury come raining down and... OK, I'm being a bit over dramatic, but you get the idea.

The above scenario happened to me (minus the project managers fury) not too long ago during a project that had an unusually aggressive time line. I had to deploy a full XenApp environment to several hundred users spread across 3 (maybe more) continents. This in itself is not complicated or hard, it was the time line that provided the stress as there was little wiggle room for surprises.

Sure enough, as with most projects, there are surprises. This surprise was a bit more than what I wanted. I discovered, that the VLAN housing the XenApp environment, created by the client, was not accessible by any other location and was not able to be so because of an internal configuration they had. Not only this, they wanted to direct all sessions through NetScaler Gateway on the public side, but keep all the benefits of pass-through authentication, and pretty much everything else that makes sure an shortcut is presented on the users desktop with the published application and all they have to do is launch the shortcut.

My requirements were:

Have all sessions directed through NetScaler Gateway on the public Internet.
Keep pass-through authentication in place.
Have users access a VLAN that they cannot access.
Be able to view network metadata in Director per session.

My first thought was how in the world was I going to keep pass-through authentication? I knew that not too long ago NetScaler Gateway does have the ability for pass-through authentication using kerberos. But, because of the time line, we did not have time to deal with that solution. Next, I came across StoreFront optimal gateway feature which fit exactly with what I was trying to accomplish as well as all my requirements could still be kept and it was simple to implement. The work flow for this setup is as follows:

Citrix Receiver launches and contacts StoreFront for single-sign-on.
StoreFront retrieves the published resource list from a Citrix Delivery Controller and forwards this to the endpoint.
Citrix Receiver now sees the published resources available.
The user clicks on the published resource and the application is launched over NetScaler Gateway.
All session traffic runs through NetScaler Gateway.

The StoreFront optimal gateway feature allows the Citrix Reciever to connect to StoreFront and then when the user launches a session, StoreFront directs the session through NetScaler Gateway of your choosing. Pass-through authentication works as you are authenticating against StoreFront and STA's are used when sessions are started through NetScaler Gateway. To combat the problem of users unable to access the XenApp VLAN, all I had to do was move the load balanced virtual server on NetScaler to a VLAN which all users had access. Problem solved, and quickly.

To configure StoreFront optimal gateway:

Get the following information:

The name of the farm as found in the StoreFront "Manage Delivery Controllers" section. Remember that XenApp used to have farms and not sites? Don't confuse this with the site name.
Name of the NetScaler Gateway appliance as found in StoreFront "NetScaler Gateway" settings. I am talking about the logical name, not the URL, so whatever the name column has.
The NetScaler Gateway URL for users to use. To direct users to the public IP, I had the internal DNS A record for the NetScaler Gateway site point to the public IP.
And of course, the STA URLs. I would hope at least two.

You need to modify the web.config file which is by default in C:\inetpub\wwwroot\Citrix\[store]\web.config. Keep in mind it is the store name, not the storeweb directory. Make a backup of the web.config file. Did I mention to make a backup of the web.config file?
Open the web.config file with a text editor (notepad or whatever) and search for optimalGatewayForFarmsCollection. This is the section you want to modify.
Modify the text below with the information collected found in bold:

Save the file and perform the same steps on any other StoreFront servers you use and you should be set.

This post was written in reference to the following platforms and versions:

StoreFront 2.6
XenDesktop 7.6
NetScaler 10.5 Build 53.9

Sources:

Citrix Systems, Inc.. (Jul 21, 2014). How to Force Connections through NetScaler Gateway Using Optimal Gateways Feature of StoreFront [Article]. Retreived from http://support.citrix.com/article/CTX200129

How to Reset Redirected Folder NTFS Permissions with PowerShell

2014-06-04T15:10:00.002-07:00

I have been dealing with user redirected folders ever since Windows Server 2000. This is a great feature as many of you know, especially in Citrix environments where you do not want to keep data on XenApp servers or read-only images. Generally, you set it up "correctly" and it usually just works as long as you don't touch it much. Then you start to get requests to get into the users folders and you need to do so as an administrator, or you are wanting fix the security settings because someone has modified the NTFS permissions for several users to gain access, but failed to properly set the permissions back to the way it needs to be based on what Microsoft recommends. To fix a redirected folder store for a few users, not a big deal. But, to fix a redirected folder store for many users, you can imagine the millions of clicks that have to be done which usually scares people off.

A couple of years ago, I had to fix permissions on a clients redirected folder store which contained about 1000 users. Instead of wasting my time and the clients money, I decided to create a script that would do what I needed. After I built, this script, we ran it against the clients environment and everything went as planned. All permissions were fixed as the customer request of adding administrator groups to the existing store so that they would not need to modify permissions to get into users folders which caused the problem in the first place. This script (and modifications of this script for various clients requirements) have been successfully run in many environments, which in turn has saved countless hours and money.

Before I go over the script instructions, I want to go over the permissions as recommended by Microsoft that the script modifies (Note: This script does not modify share permissions):

NTFS permissions for the root folder:

Creator Owner - Full Control, Subfolders and Files Only
Administrator - None (the script will give you the option to modify this to allow full rights to administrators)
Security group of users that will be using folder redirection - List Folder / Read Data, Create Folders / Append Data - This Folder Only
Local System - Full Control, This Folder, Subfolders and Files

NTFS permissions for the users' redirected folders:

%Username% - Full Control, Owner of Folder
Local System - Full Control
Administrators - None (the script will give you the option to modify this to allow full rights to administrators)

To successfully run this script, the following is required:

Before doing anything, backup your data. I take no responsibility of this script when you run it in your own environment.
Test the script in your environment, take a snap shot of the data and verify the results are what you want before running the script on your production data.
Takeown.exe is required as part of the script. This will probably already be on the system that will run the script, but just make sure.
The domain name of the domain you will be running this script in (e.g. domain.local)
A UNC path to the redirected folders (e.g. \\server\redirfolders)
An Active Directory administrative security group. This group is used as part of the process to reset the permissions as well as if you want to have administrative access, this group will be left, otherwise it will be removed once the permissions are set.
An Active Directory user security group that is using the redirected folder feature.
PowerShell run with administrative rights.
The user that will be launching this script to be part of the administrative group mentioned above.
For better performance, disable antivirus when running this script.
Make sure to disable any replication that may be setup for this data while you run this script (please note, if you are using DFSR, this will cause the algorithm used by DFSR see the files and folders as updated and copy according to your DFSR configuration).
Do not run this script while users are accessing the system.
Did I mention to backup prior to running the script.
When running the script against the test data, make note of the amount of data as well as how long the script took to process the data to help make a calculation of how long the script will take on your production data.

To run the script:

Download and place it in a directory of your choosing. It is recommended to run this on the same server as where the files reside.
Open PowerShell as an administrator.
Since this is really a PowerShell function, you need to add the function to your PowerShell session with the following dot sourcing:

". ./set-redirectedfolderpermissions.ps1"
Do not include the "
There is a space between the 2 periods in the beginning

Once you dot source the script which now adds the function to use in your PowerShell session, to run the function:

set-redirectedfolderpermissions
If you use auto complete, make sure to remove the .ps1 at the end.

You will be prompted for the information mentioned above in the requirements:

DomainName - Enter the domain name (e.g. domain.local).
RootProfileUNCDir - Enter the UNC path to the root folder (e.g. \\server\redirfolders).
AdminGroup - Enter the admin group that will be used to set the appropriate permissions as well as which group you want to assign administrative rights to the users folders (e.g. Domain Admins).
UserGroup - Enter the user group that uses redirected folders (e.g. Domain Users).
GiveAdminAccess - Specified in either Y or N to allow the administrators group access to users folders (e.g. Y)
GiveLocalAdminAccess - Specified in either Y or N to allow local administrators rights to users folders (e.g. N)

After you enter the above information, you will be asked to confirm if everything is correct, use Y or N to confirm.
The script will run, and depending on the amount of data, it might run for a long time. You will see output in the PowerShell screen of what is happening.
In some instances, the script might have to run a couple of times to get everything set correctly.

To download the script, please go to my scripts page or click here.

Please let me know what you think, or if you have any questions or issues.

Book Review: Implementing NetScaler VPX

2014-05-30T15:20:00.001-07:00

Recently, I had the pleasure of reading "Implementing NetScaler VPX" written by Marius Sandbu and published by Packet Publishing. Packet Publishing had asked me to read the book and provide a review. Before I begin, I want to give you a bit of my background to help understand my point of view. I am a consultant and have been architecting, implementing, and administering Citrix products since MetaFrame 1.8. In most of my projects, NetScaler is involved and I am architecting the integration and/or implementation which touches on many different aspects of the client environment, not just their XenApp or XenDesktop environment. NetScaler can be a complex subject as it bridges between systems and network.

Author

"Implementing NetScaler VPX" is written by Marius Sandbu who is a Consultant and Trainer in Norway. He has been heavily involved with Microsoft for over 9 years, during that time he was awarded a Microsoft MVP title for his involvement in the Microsoft community.

Overview

Again, NetScaler is a complex subject, and depending on what you are trying to accomplish, it can be very complex. But most clients that I run into initially start of with NetScaler because they want secure remote access to their XenApp or XenDesktop environment. With this in mind, I was wondering how the book would be laid out, and Marius Sandbu used the most common approach many of my clients take.

Marius starts out with an overview of NetScaler, platforms, editions, features, and modes. Brief scenarios are used to help identify when you would use a certain platform or edition. In the same chapter he walks you through a base setup. Then he proceeds to review networking components. One of the bits I really did like is that Marius opted to not use the wizards, and used command line instead. Running through wizards is great and easy, but it doesn't give you the same understanding when you have to perform the steps in order on your own. And of course, I am a command line junkie, so I was glad he opted for this input method.

Now, NetScaler Gateway makes its appearance in the book. In implementing NetScaler Gateway, you can gloss over some nice features, and just get it up and running. But, Marius decided not to go that route. He first does an overview of the features and dives right in to deploying ICA Proxy using StoreFront. Most deployments I have done use ICA proxy, but there are a few that needed a SSL VPN and Marius goes over these steps as well. One bit of information I was glad to see included is the NetScaler out-of-the-box SSL vulnerability fix as well as how to test this for this vulnerability.

Up next is load balancing. Oh boy do I love load balancing. To help the reader get a better understanding of the subject, Marius starts of with load balancing of a generic web application. This is a good primer before heading into the next sections of load balancing Citrix products. Prior to NetScaler 10.1 load balancing TFTP, namely for Provisioning Services, was a task and not easily understood. But after NetScaler 10.1 came out load balancing TFTP became as easy as load balancing DNS. Marius of course included the section on how to load balance TFTP, as well as other topics outside the realm of Citrix that are commonly configured with NetScaler. Second to load balancing Citrix services and setting up NetScaler Gateway is almost always load balancing Exchange. Now, Exchange load balancing changes with each version of Exchange that is released. Marius goes over what is needed to load balance an Exchange 2013 environment. He also touches on load balancing SharePoint 2013 and SQL.

The next subject covered is compression and caching. He does a great overview of these subjects. Now, if you have seen caching at work, give it a try as it can be eye opening. For example, a query that takes 60 seconds to process can be cached and returned to the client within seconds. Compression is a must read, especially if you are front ending web services to clients.

High availability (HA) and global server load balancing (GSLB). These are simple ideas to grasp, but GSLB in particular can be difficult to implement if you have never done so before. Now Marius does show you how to configure HA, but only does an overview of GSLB. Next, Marius goes on to explain how to perform traffic analysis. I really like that Marius included this in his book, although it doesn't take up much room, it is a must know for anybody who implements or administers NetScaler. Then finally, Marius touches on app firewall.

Impressions

I honestly did enjoy this book. The way Marius laid out the subjects, even the order he chose, and the level of depth of the subjects was just right. NetScaler goes much deeper than this book, but for the intended audience, the amount of depth is perfect. I highly recommend this book, if you are just starting out with NetScaler, or even if you have been working with NetScaler.

Updated: Provisioning Services TFTP Load Balancing on NetScaler

2014-03-28T01:31:00.004-07:00

To be able to provide Provisioning Services (PVS) High Availability (HA), you need to setup TFTP load balancing with NetScaler. This is because of DHCPs inability to provide multiple TFTP hosts to a client in a smart way. NetScaler overcomes DHCPs limitation. The process for a typical request is as follows:

A DHCP request is sent by a client, at which the DHCP server responds with an IP address and 2 DHCP options, 66 and 67. Option 66 holds the TFTP server IP, and option 67 holds the boot file name.
The preboot execution environment (PXE) on the client then makes a request to the TFTP IP.
NetScaler now makes a load balancing decision and will forward the request accordingly.
After the TFTP server receives the request, it then sends the client the initial segment of its boot file.
The client will then boot, and start talking directly with the Provisioning Servers.

Prior to NetScaler 10.1, load balancing TFTP services took a bit of effort and the process is explained in a previous post here. There are other unsupported methods that some have used like using HTTP to distribute the boot file. Now load balancing TFTP is quick and easy. Also, an actual TFTP monitor is available to verify the health of the service, not like last time where you had to rely on the basic ping monitor. You do not need to setup Direct Server Return (DSR) anymore as well as no need to add loopback adapters to the Provisioning Servers. And, of course, you don't need to distribute the boot file via HTTP.

The basic overview of what you need to do:

Create a TFTP monitor on NetScaler.
Create a virtual server on NetScaler pointing to your Provisioning Servers.
Configure DHCP options 66 and 67.

For those that need a bit more help in navigating how to perform the above:

Make sure the NetScaler appliance has 10.1 firmware or better.
Open the NetScaler GUI and login.
Create the server objects:

Navigate to Traffic Management\Load Balancing\Servers.
Click Add.
Enter a name and FQDN or IP address, then click Create.
Repeat step 5 for additional Provisioning Servers that are acting as TFTP servers.

Create a new monitor:

Navigate to Traffic Management\Load Balancing\Monitors.
Click Add.
Give the monitor a name.
Set the Type to USER.
Click Special Parameters.
Click Browse and select nstftp.pl for the Script Name.
Click Create.

Create the service group:

Navigate to Traffic Management\Load Balancing\Service Groups.
Click Add.
Give the service group a name.
Select TFTP for the protocol.
Select Server Based
Select both server objects created earlier and type 69 for the port.
Click on the Monitors tab.
Add the monitor you created earlier.
Click Create.

Create the virtual server:

Navigate to Traffic Management\Load Balancing\Virtual Servers.
Click Add.
Give the virtual server a name.
Select TFTP for the protocol.
Give the virtual server an IP address.
Click on the Service Groups tab.
Select the service group create earlier.
Click Create.

Configure DHCP:

Add DHCP option 66 on your DHCP server with the value of the TFTP virtual server IP address assigned above.
Add DHCP option 67 on your DHCP server with the boot name file (e.g. ARDBP32.bin).

Test:

Install the Windows TFTP client and run the following:

tftp [IP of TFTP virtual server] GET [name of boot file] [name of boot file]
E.g. tftp 10.1.16.10 GET ardbp32.bin ardbp32.bin

This post was written in reference to the following platforms and versions:

Provisioning Services 6.x +
NetScaler 10.1 +

IT Reading Material

2014-03-24T19:46:00.000-07:00

If you are like me, I devour reading material. I do a tremendous amount of reading for my career as well as hobbies, and just for fun. I have read books from Microsoft press, O'Reilly Media, Packt Publishing, and others.

The one publishing company that I have read as of late is Packt Publishing. They have been able to produce books on a wide breadth of technology subjects (a few years ago, their book subjects were lacking for my taste, but not so anymore). They have many great books, like:

Citrix Access Gateway VPX 5.04 Essentials by Andrew Mallet
Windows Server 2012 Hyper-V: Deploying Hyper-V Enterprise Server Virtualization Platform by Zahir Hussain Shah
Windows Server 2012 Automation with PowerShell Cookbook by Ed Goad
Windows Server 2012 Hyper-V Cookbook by Leandro Carvalho
Microsoft Application Virtualization Advanced Guide by Augusto Alvarez
And many more

They are now celebrating 2000 titles and have some great deals to offer, right now they are offering buy one get one free on all ebooks. This offer won't last long (I feel like an infomercial), so if you have thought about purchasing from them or you have been thinking about buying a book on a particular technical subject, now is the time (again, the infomercial thing, what is happening).

Updated: XenServer Virtual Machine Error on Boot "The VDI is not available"

2014-03-23T01:50:00.001-07:00

Last year, I had wrote about this issue in regards to particular case I was working on, which you can find here. I am updating the troubleshooting methods and techniques not based on a specific scenario. Hopefully this makes it more useful to others.

When trying to boot a VM (virtual machine) residing on XenServer, you may get the error "The VDI is not available". This error can present itself for different reasons, but there are 2 common reasons why this happens:

The VDI (virtual disk image) is missing.
The VDI is locked to a host where the VM was running.

1. Get basic startup error information - To help narrow down the cause of the issue, we need more information. We can do this by trying to start the VM from the CLI (command line interface). To start the VM from the CLI run the following command either through the console of the XenServer host or through a SSH session to the XenServer host:

xe vm-start vm='VM name' on='XenServer host name'

2. Get detailed startup error information - To get more detailed information about this error, review the log file. You can do this from the CLI by running the following command:

less /var/log/SMlog

3. Verify if the XAPI database thinks the VM is still running and if the VDI is locked - For more information, you can see if the XAPI database thinks the VM is still running. This can happen if a host goes down with the VM running on it and the XAPI database isn't updated accordingly. To view the power state of the VM, run the following command:

xe vm-list name-label='VM name'

To find out if the VDI is locked open in the XAPI database, run the following command:

xe vdi-list params=all uuid='VM uuid'

If the VDI is locked you will see something similar to sm-config (MRO): host_OpaqueRef:6685cde1-9f08-f16b-aecc-c4e13df9c772: RW. The OpaqueRef line is a host reference, so the uuid will be different for you.

4. If the VM is not running and the VDI is not locked - If the VM is not running and the VDI is not locked, one possibility is the VDI has been removed. You will need to verify the VDI location and files. The other possibility is if the LUN where the VDI resides is having issues. If you are not running StorageLink, you can try to create a VM using that same storage repository (SR) to verify if there are any issues. If you are using StorageLink, run the following to help determine the name of the LUN on the SAN:

xe vdi-param-list uuid='VM uuid'

Look for the line that starts with location (RO):. Look for the following number on your SAN for the LUN names, it may not be the whole number showing, but you will be able to perform a partial match with the number and also size of the LUN. For example, XenServer shows 6233ac13-1a4c-49a9-8041-1b2b9c16b579, and the SAN shows 6233ac131a4c49a980411b2 for the LUN name. Once you locate the LUN on the SAN verify if there are any issues on the SAN.

5. If the power state is running, but you know the VM is powered down - If the power state is running and the VM is powered down, try resetting the power state on the VM. First on each host that is still up, run the following command to verify the VM is not running on one of them:

list_domains | grep 'VM uuid'

If a result is returned, then the VM is running on that host. When you are sure that the VM is not running on a live host, run the following command to reset the power state:

xe vm-reset-powerstate uuid='VM uuid' --force

6. Power state is not running, VDI is accessible, but VDI is locked - If the VDI is locked and the VM is verified off, you can reset the lock on the VDI. To do this, you will need to forget the VDI. To start you will need the UUID of the VDI:

xe vdi-list name-label='VDI name'

Once you get the UUID of the VDI you want to forget, run the following command:

xe vdi-forget uuid='VDI uuid'

After the command finishes, re-scan the SR and locate the VDI. Once the VDI has been located, re-attach it to the VM and try to start the VM.

If you are running XenServer 6.1, you can run the resetvdis.py script which will perform the reset operation for you. For previous versions of XenServer, the script exists, but all VMs on the SR that you run the script against must be shut down. To run the script in a XenServer 6.1 environment (always double check to make sure if the VM is running somewhere else using the command list_domains | grep 'VM uuid' on each host):

/opt/xensource/sm/resetvdis.py single 'VDI uuid'

Hopefully the above steps will help you if you run into this particular error. If you have any comments, questions, or criticisms, please leave them below.

This post was written in reference to the following platforms and versions:

XenServer 5.6 - 6.2

Updated XenServer Bash Script

2014-02-22T23:25:00.000-08:00

Originally I had written a script to eject all ISOs from every VM that has an ISO attached as well as insert an ISO into every VM in a XenServer pool. The purpose was to assist in attaching a boot ISO to Provisioning Services (PVS) Target Devices, or removing the ISO image from all VMs in a pool. You can find the original script here. I have updated the script to provide more functionality, namely to assist in transitioning away from PVS boot ISOs to network boot using TFTP, and back again if you need to roll back for any reason. Below are the features of the updated script:

List VMs with an ISO attached in a XenServer pool.
List VMs with no ISO attached in a XenServer pool.
Eject all ISOs and set the VMs to network boot in XenServer pool. Only VMs with ISOs will be affected.
Insert an ISO and set the VMs to boot from ISO in a XenServer pool. Only VMs with no ISO will be affected.
Eject all ISOs from all VMs in a XenServer pool.
Insert an ISO to all VMs in a XenServer pool. Only VMs with no ISO will be affected.

Normally, to transition from ISO boot to network TFTP boot, you need to remove the boot ISO and then set the boot order on the VM to network. Instead of thousands of clicks for hundreds of desktops, this script automates this task. It will search all VMs with ISOs attached, eject the ISO, and switch the boot device to network. Warning, this script does this for every VM in the pool that has an ISO attached. So, if you have some VMs that you don't want this to run against, make sure to remove any ISO attached to them. If for some reason, a VM does get altered, its an easy fix through XenCenter GUI to set the correct boot device and attach an ISO if so desired. As part of any migration, a roll back plan is always necessary, and this script delivers. If for some reason you need to roll back to a boot ISO, this script will set the boot device to the ISO as well as insert a named ISO into every VM that does not have an ISO attached. Again, please be cautious if you have other VMs that you don't want to alter by adding an ISO to them or change them back after the script finishes.

During a XenServer upgrade, the upgrade process likes all ISOs to be ejected from all VMs in the XenServer pool. If you only have a few servers, going to each one in XenCenter is not a big deal. But, what if you have a lot of VMs that you need to eject the ISO from ahead of time? This script automates the process, so you don't have to go to each VM and figure out if there is an ISO attached and eject if found. I recently used this as part of a XenServer 5.6 FP1 to 6.2 upgrade which worked flawlessly.

To run the script:

Upload the script to a XenServer host using WinSCP (or some other method) to /usr/local/bin (or whatever other location you want).
From the XenServer CLI type the following to allow execution of the script:

chmod +x xenserver.sh

From the XenServer CLI type the following to run the script:

./xenserver.sh

Once the script executes, you will see the following menu:

To navigate, just type the number of the option you want and press enter. The only input required is the name of the ISO dependent on the option you choose.

Download the script here.

This post was written in reference to the following platforms and versions:

XenServer 5.6 FP1 - 6.2 SP1.

XenServer Virtual Machine Error on Boot "The VDI is not available"

2013-09-01T16:57:00.001-07:00

3/23/14 - This post has been updated and you can found the updated version here.

Recently, a fellow engineer was working on an Exchange environment late one evening for a client. While he was working on the Exchange server (all virtual machines running on XenServer), the machine froze and he had to force a restart. He attempted to boot the machine but received the error:

"The VDI is not availabe"

After some initial troubleshooting by the engineer, I received a call from him seeking assistance. After continually narrowing down and isolating the problematic VDI (Virtual disk image) I was able to resolve the issue. Below are the steps I took to narrow down and ultimately resolve this issue:

First I checked for a possible issue with the ISO repository, I verified that there were no ISOs attached to the VM.
I then reviewed the log /var/log/SMlog on the XenServer host that is trying to boot the VM to see if there were any other underlying issues.
In reviewing the log, I saw error 46, which correlates to the error message "the VDI is not available".
I now need to determine the UUID of the SR that holds the VDI for further troubleshooting:

You can get the SR UUID from XenCenter by clicking on the SR and navigating to the General tab.
Or, you can use the CLI with the command:

xe sr-list name-label=[name of the SR]

Now we need to find the UUID of the VDI(s):

From the CLI run the following command:

xe vm-disk-list name-label=[name of VM]

Once you get the UUID of the VDI(s) we need to verify if the VDI is stuck open:

From the CLI run the following command:

xe vdi-param-list uuid=[UUID of the VDI]

Look for the line that starts with "sm-config (MRO):"
If that line has "RW" in it and the VM is turned off, then the pool has placed a lock on the VDI, not allowing anyone else to use it. In my case the VDI was not locked, but in case it is for you, all you need to do is the following:

You can reboot the XenServer host or try the following:
From the CLI run the following command:

xe vdi-forget uuid=[UUID of the VDI]

Run a SR scan, you can either do it from the CLI or from XenCenter:

CLI:

xe sr-scan uuid=[UUID of the SR]

GUI:

Click on the SR with the troublesome VDI.
Navigate to the Storage tab.
Click the Rescan button.

Now you might be able to start the VM. Again, I did not go through the above procedure since the VDI did not have a lock on it.

If the VDI is not stuck open and you are not using Storage Link, check yourSAN to make sure there are no issues with the LUN.
If you are using StorageLink, to find the LUN:

From the CLI:

xe vdi-param-list uuid=[UUID of the VDI]

Look for the line that starts with location (RO):
Look for this number in your SAN, the whole number will probably not be showing, but you can match most all of the numbers. Also, to help narrow down which LUNs you are looking at, sort by LUN size according to the VDI size.

For example, XenServer shows: 6233ac13-1a4c-49a9-8041-1b2b9c16b579
The SAN shows for the LUN name: 6233ac131a4c49a980411b2b
Notice how the SAN LUN name only shows the first 24 characters of the UUID

The issue this time around for me ended up being a SAN issue. The LUN was set to thin provisioning and had reached its max threshold, and the SAN set the LUN to offline, thereby creating the issue in XenServer.

How to Update The Provisioning Services (PVS) Agent or Hypervisor Tools The Easy Way

2013-08-19T23:41:00.000-07:00

Either you are updating the Provisioning Services (PVS) client on a target device or you are updating the hypervisor tools, there are a few methods to choose from. One of the quickest and least error prone (in my opinion) methods to perform this is by using the VHD attach method. This method works with XenServer, Hyper-V, and VMware. I have also used this method using PVS 5.6 and 6.1. Instead of reverse imaging, or keeping a master VM to re-image from, all you need is the latest merged VHD. I say merged because you will need to perform a merge (versions + base) into a single VHD if using PVS 6.1. Below are the steps to perform this in a XenServer or VMware environment. Hyper-V is almost self-explanatory, as you can boot to the VHD without much effort.

VMware

I have used this method to migrate PVS images from VMware 4.x to 5.x, updating the VMware tools and hardware versions as well as applying PVS agent hotfixes. This method is a bit more involved than using Hyper-V or XenServer, but it works well.

Merge all versions and the base image into one VHD from within PVS.
Download and install WinImage. There is a 30 day trial for WinImage, which should be fine to complete this process.
Using WinImage, convert the VHD file to VMDK.
Copy the VMDK file to the VMware datastore.
Create a new VM using the VMDK you just copied.
Log in with the local administrator account (you may have to rejoin the domain).
Uninstall the PVS agent and reboot.
Install any VMware tools updates or VMware hardware version updates.
Install the PVS agent.
At this point you can either copy the VMDK image and use WinImage to convert the image back to VHD, or use the PVS agent wizard.

XenServer

Using XenServer is a bit quicker than using VMware as you don't have to perform any VHD conversions.

Create a NFS share on the PVS server:

Windows 2003:

Using WinSCP, copy the following files from XenServer to the desktop:

/etc/passwd
/etc/group

Install NFS on Windows:

Launch the Add/Remove Windows Components Wizard in the Control Panel
Select the following:

Other Network File and Print Services | Microsoft Services for NFS
Other Network File and Print Services | Microsoft Services for NFS | User name mapping

Configure NFS:

Open Microsoft Services for NFS.
Right-click "User name mapping" and click "Properties".
Select "Use password and group files".
Browse to the passwd file you downloaded to your desktop for the password file.
Browse to the group file you downloaded to your desktop for the group file.
Click "OK".
Right-click "User maps" and click "Create map".
Verify the domain and select an administrator account.
For the Unix user specify "root".
Click "Add".

Create a NFS share:

Create a new directory.
Right-click the new directory and select "NFS Sharing" tab.
Select "Share this folder".
Check "Allow anonymous access".
Click "Permissions".
Check "Allow root access".
Set the "Type of access:" to "Read-Write".
Click "OK".
Click "OK".

Windows 2008:

Install the file role service "Services for Network File System".
Create a NFS share:

Create a directory.
Right-click the directory and select "NFS Sharing" tab.
Enable sharing and specify a name.
Click "Manage NFS Sharing".
Click "Permissions".
Set "Type of access" to "Read-Write"
Check "Allow root access".
Click "OK".
Click "OK".
Click "OK".

Create a new SR in XenServer and point to the NFS share you created earlier. Remember, the NFS share is case sensitive.
Create a new VM in XenServer with the same specifications as the existing target devices. Choose the new NFS SR to hold the vDisk for this VM. Do not start this VM automatically.
Within PVS, set the image you want to update to private mode.
Copy or cut the VHD to the NFS share directory. You should see another VHD in the NFS share directory with the UUID of that VHD.
Rename the VHD you just copied into the NFS share directory with the same name of the VHD that was created when you created the VM within XenServer.
Boot the VM within XenServer.
Uninstall the PVS agent.
Restart the VM and update any hypervisor tools.
Install the new PVS agent.
Shutdown the VM and cut or copy the VHD back to the PVS store and rename it appropriately back to the original name.
Boot to the image using one of your target devices to make sure all is working and then close the image as you normally do.

Windows Server 2012 Automation with PowerShell Cookbook

2013-05-27T12:00:00.002-07:00

Recently, I read the book "Windows Server 2012 Automation with PowerShell Cookbook" by Ed Goad and published by Packt. This book starts out with some PowerShell primers, terminology, and structure as well as sample code. After that, the book focuses on separate typically Windows Administration tasks with examples of how to automate those tasks with sample code. For example, the 5th chapter "Managing Storage with PowerShell" goes over the various bits of managing storage on Windows Server 2012 starting out how to manage NTFS file permissions. Then the next chapter flows nicely with "Managing Network Shares with PowerShell".

I like how this book is laid out, you can read straight through or pick your topic of what you are currently working on. Also, this is a great book for PowerShell scripters to get great examples of tasks to be done through PowerShell. If you are new to PowerShell, this is a great resource to dive in, although you might want to spend some time on chapter 1 "Understanding PowerShell Scripting" to get some of the basics down. If you are new to scripting in general, this may be a tough read, but not impossible.

As a PowerShell scripter myself, I am definitely keeping this book in my library as a reference and I suggest you do as well. You can find the book here http://www.packtpub.com/windows-server-2012-automation-with-powershell/book.

Eject / Insert an ISO to All Guest VMs in a Resource Pool at Once

2013-01-02T12:29:00.000-08:00

3/28/14 - This post and script has been updated and you can find it here.

In a XenDesktop / XenServer (5.6 - 6.1) environment, there are a couple ways to boot virtual desktops using Provisioning Services. I usually setup a load balanced TFTP virtual server on NetScaler and load balance between multiple Provisioning Servers. I have written a post on configuring load balanced TFTP via NetScaler here. But, I do run across some environments where they are using boot to ISOs for all their virtual desktops. This works fine, but what happens if the virtual desktops loose the ISO mapping because of an issue with the ISO store. This isn't a big deal if you are only dealing with a few virtual desktops, you just re-add the ISO through XenCenter. But, what if you have hundreds or more of virtual desktops? Without an automated way of either ejecting or inserting ISOs you will waste probably hours and end up with some really sore wrists.

I wrote a bash script to handle this type of situation. The script is menu driven for ease of use. The following are the features of the script:

Able to list all VMs in a resource pool with an ISO attached. This does not include the name of the ISO, just the name of the VM.
Able to list all VMs in a resource pool without an ISO attached.
Able to eject an ISO from every VM in the resource pool.
Able to insert an ISO to every VM in the resource pool.

To be able to run the script, please do the following:

After you download the script, upload the script to the XenServer host. I recommend uploading the script to /usr/local/bin. To upload the script you can use WINSCP.
Once the script is uploaded, you will need to enable the script to execute. From either the console or a Putty session, type the following:

cd /usr/local/bin
chmod +x iso.sh

To run the script, from either the console or a Putty session, type the following:

./iso.sh

Once the script executes, you will see the following menu:

To navigate, just type the number of the option you want and press enter. The only other input required is when you want to insert an ISO. This option will insert the ISO to every VM in the resource pool that does not have an ISO currently attached, so be careful. To insert an ISO, perform the following:

Type 4 and press enter.
Enter the file name of the ISO you want to insert. This must be the full ISO name, like xs-tools.iso. This ISO must also be present in your ISO repository. If you mistype the file name or the ISO does not exist in your ISO repository, you will see the error "Error: CD not found".

This is a basic automation script, but also has a lot of potential for added functionality. Let me know if you have any questions or comments.

Download script here

This post was written in reference to the following platforms and versions:

XenServer 5.6, 6.02, and 6.1

Windows Server 2012 Hyper-V Cookbook Review

2012-12-21T18:42:00.001-08:00

I recently read "Windows Server 2012 Hyper-V Cookbook" from Packt Publishing written by Leandro Carvalho. The book starts off with server requirements and how to determine if the hardware you are using is compatible. Then it goes on to enabling and installing Hyper-V and then performing basic configurations as well as integrating several different Windows components to help manage the system. The format is an overview, describe how to perform a task, and then describe a bit more in detail.

This book is good for someone who is beginning their virtualization journey. The book is full of how-to and overviews. It does a good job on describing how to perform tasks. If you are wanting to setup a lab with Hyper-V for testing and more discovery, this book will help you get there. Also, in the appendix, there is a good overview of hypervisors and how they work in relation to actual hosts.

There is no design or integration with enterprise-level components besides clustering and Hyper-V Replica in this book, so if that is what you are looking for, then you will need additional texts in addition to this book. The book does briefly mention a comparison to VMWare but does not include XenServer, of which all 3 should be considered if embarking and evaluating hypervisors. Some of the methods mentioned for managing the hypervisor including monitoring and backing up is geared more towards small business when there is not a lot of systems to manage or lack of funds to acquire enterprise type tools.

All-in-all, Microsoft Hyper-V is a good option to help build your cloud whether public, private or hybrid. And if you are just getting started in testing Hyper-V, this book is a good resource to pull from.

"Could not log on" or "Unexpected Response" Error While Using Citrix Receiver through Access Gateway

2012-12-10T01:51:00.000-08:00

Scenario

You have a Citrix XenApp 6.5 farm setup behind Access Gateway with Web Interface installed on the NetScaler. Users access the Web Interface from their workstations through Access Gateway just fine. But, for mobile access, users receive either a "could not log on" or "unexpected response" error on their mobile device and they are not able to log on.

Troubleshooting Steps

Verify authentication is being handled properly, look at the logs on the NetScaler and for Access Gateway.
Verify your session policies for Citrix Reciever are setup properly with the correct policy rules and order.
Check to see that "Clientless Access" is set to allow, in either the global defaults for Access Gateway, or in the session policy itself for mobile devices.

VM Does Not Respond to Restart or Shutdown Commands

2012-07-30T12:59:00.000-07:00

In XenServer, not too often you may have a VM that is not responsive to shutdown or restart commands through XenCenter and most likely has the yellow icon on it indicating that it is in process of doing something. You may have even tried to restart the host, but the host is waiting for the VMs to shutdown but they won't so you cannot restart the host except by pulling the plug in which you do not want to do. Below are some steps to try and resolve the issue starting from easy to last resorts.

SSH or go to the console of the host that houses the troubled VM and perform the xe-toolstack-restart command. If this does not fix your issue go to step 2.
The next possible culprit may be a stuck task. Perform the following commands to cycle through any tasks that may be keeping the VM stuck:
1. To list all tasks: xe task-list
2. To cancel a task: xe task-cancel uuid=[uuid of task found from the previous step]
After canceling any problematic tasks, check to see if your VM is still unresponsive. If still unresponsive, proceed to step 4.
If you made it this far, then the problem most likely is that the dom-id for the VM in XenServer control domain is unresponsive and needs to be terminated:
1. Find the UUID of the VM. You can do this through XenCenter, the UUID is found on the General tab of the VM.
2. Connect to the host that houses the VM through the console or SSH.
3. Run the following command: cd /opt/xensource/debug
4. Run the following command: list_domains | grep [UUID of the problematic VM]
5. The output format is [Dom ID] | [VM UUID] | [VM state]
6. Run the following command: ./xenops destroy_domain -domid [Dom ID found in previous step]
7. Run the following command: xe-toolstack-restart
8. Give it a few seconds and go back to XenCenter, the VM should go to a shutdown state (again give it a few seconds to refresh)
The last and not recommended method is to power-cycle your host. You shouldn't have to do this step if you follow the above correctly (at least I haven't ever had to do this for a stuck VM).

Enable SSH Access on a Citrix License Appliance

2012-06-27T15:50:00.000-07:00

A customer recently started to get not enough license errors while connecting to their XenDesktop environment. The customer uses a Citrix License Appliance, hosted in their XenServer pool. I verified they were out of licenses by going to the web interface of the license appliance. I then went to the console of the license appliance and quickly verified there are users listed as having a license but do not exist anymore. So, instead of trying to go through each user line by line through the console, I wanted to export that information so the client could review the list and then we could take the appropriate steps. Trying to copy almost 500 users listed did not work. So, instead I needed to enable SSH access so I could then copy the output file generated and send it off for review. Below are the steps taken to enable SSH access on the Citrix License Appliance:

Connect to the console of the Citrix License Appliance through XenCenter.
Login with root access.
Open the following file with a text editor like vi: vi /etc/sysconfig/iptables
Add the following line: -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
Save the file and exit the text editor.
Run the following command: service iptables restart
To make the SSH service start every time you boot the appliance, run the following command: chkconfig sshd on
To start the SSH service, run the following command: service sshd start
To verify the license appliance is listening on port 22, run the following command: netstat -tulpn

After performing the above, you should be able to access your license appliance through SSH. At this point, I ran the udadmin -list -a > liclist.txt command to save the list of users with licenses to a text file. Then, I used WinSCP to copy that text file over to send to the client.

Microsoft Application Virtualization Advanced Guide

2012-06-24T23:13:00.002-07:00

With virtualization, there are multiple solutions that can be combined to create a personlized architecture for a company. One of those options is application virutualization. Augusto Alvarez does a good job in explaining the architecture and components involved in Microsoft's App-V as well as the overall lifecycle and architecture of an App-V solution.

For those that have a little experience, the second chapter is where they might want to jump to. The second chapter goes into sequencing applications, this is where App-V engineers want to pay attention to make sure the process is done correctly and Augusto goes over this very well. Chapter 3 talks about deploying the package just created. The next bit that is very important for an App-V engineer is troubleshooting and chapter 5 handles this nicely. What happens next depends on your environment, but Augusto has this handled as well. Whether you need to scale out your deployment, integrate SCCM, or integrate it into your VDI environment, the information is well layed out.

You should have looked into App-V or have some experience prior to reading this book as it hits the ground running, but for those that want to get the most out of App-V, you should read this book. To read more about this book, please click on the link below:

http://www.packtpub.com/microsoft-application-virtualization-advanced-guide/book

NetScaler DataStream and DataStream Caching

2012-05-13T14:09:00.000-07:00

There are many awesome features in NetScaler, DataStream and DataStream caching add to the gambit to help bring NetScaler into a new environment, or leverage an existing implementation and add to the value already experienced. There are reasons why you would want to use DataStream and DataStream caching together, or by themselves. To help parse the use cases, below are a few:

Load balancing multiple SQL servers is a no-brainer use case scenario. If you need to leverage multiple SQL servers for performance, NetScaler is the solution. Within this category, there are a couple ways you can configure NetScaler based on your SQL design.

First method in configuring a load balanced solution is in a SQL master / slave database architecture. In this scenario, you have a SQL server(s) for writes, and other SQL servers for reads. NetScaler will parse the query and determine based on policies, whether to send the traffic to the master SQL server(s) for writes, or send the traffic to the slave SQL servers for reads. To accomplish this, you would need the following objects created on the NetScaler:

Load balancing services - One service for each SQL server.
Load balancing master virtual server - This virtual server will be bound to the master SQL server services.
Load balancing slave virtual server - This virtual server will be bound to the slave SQL server services.
Content switching virtual server - This virtual server will be used for client connections. The virtual server will then forward the SQL traffic to the appropriate load balanced virtual server (master or slave) based on policies.
Content switching policy - This is where you define how to forward your traffic. You can create a policy that listens for "select\" and forward that traffic to the slave virtual servers for read actions. Then all write actions will by default go to the master virtual server.

The second method in configuring a load balanced solution is the token method. With the token method, you create a token on the NetScaler and the NetScaler will gather the token value from the client. Thereby, sending all like tokens to the same backend SQL server. For instance, if you create a token on the NetScaler to listen for database names, all client requests that are going to the same database will be forwarded to a SQL server, the next database (different database name) requested will then go to another SQL server. Below are some sample expressions that can be used to create tokens:

.REQ.QUERY.TEXT
.REQ.QUERY.TEXT(n)
.REQ.QUERY.COMMAND
.CLIENT.USER
.CLIENT.DATABASE
MYSQL.CLIENT.CAPABILITIES

To accomplish the token based load balanced method, you will need the following objects on your NetScaler:

Load balanced services - One load balanced service per SQL server.
Load balancing virtual server - One load balanced virtual server for client requests with the load balanced method set to "token" and the rule expression of your choice. The load balanced services will be bound to this virtual server.

With either of the 2 load balanced options above, or if you only have a single SQL server you can add DataStream caching on reads. With DataStream caching, the main advantage is to take queries that take a long time to process, to a mere fraction of a second to send back to the client. To configure DataStream caching, you will need the following objects:

Load balanced services - One load balanced service per SQL server.
Load balancing virtual server - Minimum, one load balanced virtual server for client requests.
Cache Selector - A selector is a filter that locates particular objects in a content group to reduce any possible duplicate cached content.
Content Group - Minimum, one content group. This is where the query cache will be stored.
SQL Cache Policy - This is where you define your expression on when to cache.

In testing, I have seen requests that take around 80 seconds, down to .03 seconds. There is some obvious questions in regards to caching. What happens if you update the record, how do you let NetScaler know to invalidate the cache? There are a couple of methods that you can take advantage of. First, you can set timeouts on the cache in seconds. Second, you can create a policy so that if the NetScaler processes a write action, the policy will invalidate the cache. Once the cache is invalidated, the system will wait for a query that matches the configured policy and cache the response. Any subsequent querys to the same data will be retrieved from the NetScaler cache instead of the SQL server. Then, either the cache timeout or the policy that invalidates the cache will take action and the process starts over.

So, whether you have a single or multiple SQL servers, with DataStream and/or DataStream caching you will definitely see an improvement with performance. As always, please let me know what you think.

NICs Disappear in XenServer After Reboot or Hotfix Installation

2012-04-24T11:48:00.003-07:00

During a XenServer reboot or hotfix installation when there are multiple XenServers in the pool, you may run into an issue where the NICs seem to disappear. Also, if you try to run XE commands, you may get the error "The host is still booting". In the cases I have seen this issue, the problem is what the problematic XenServer thinks is the pool master when in fact the pool master is a different host. Below are the steps I went through to diagnose and resolve this issue:

Go to the hosts command line interface (CLI).
Type ifconfig and verify the underlying system sees the NICs and that they are up.
Navigate to \var\log\xensource.log and review the log entries. In my case, it was stating that it was trying to contact the pool master, but was not receiving a response. I knew my pool master was up and functional as the other XenServer hosts did not have an issue.
Navigate to \xensource\pool.conf and modify the IP address found inside the file to the current pool master IP.
At the CLI, type xe-toolstack-restart.

Let me know if you have any questions or comments.

TFTP Load Balancing on NetScaler using Direct Server Return

2012-04-04T23:01:00.001-07:00

3/28/14 - A new post with updated information can be found here.

To be able to provide Provisioning Server (PVS) High Availability (HA), there are a few options. One option stands out, direct server return (DSR). With DSR, NetScaler provides the initial load balancing to an appropriate TFTP server, and then the TFTP and the client talk directly freeing up bandwidth on the NetScaler. The process of the request is as follows:

A DHCP request is sent by a client, at which the DHCP server responds with an IP address and 2 DHCP options, 66 and 67. Option 66 holds the TFTP server IP, and option 67 holds the boot file name.
The preboot execution environment (PXE) on the client then makes a request to the TFTP IP.
NetScaler now makes a load balancing decision. NetScaler uses the MAC address and forwards the request while not changing the destination IP. The frame arrives at the TFTP server with the same destination IP as the VIP configured on NetScaler. The TFTP is able to process this frame because of a loopback adapter with the same IP assigned.
After the TFTP server receives the request, it forwards the request to the loopback adapter. It then sends to the client the initial segment of its boot file.

The advantages of DSR for TFTP load balancing is that it provides robust scalability and availability. The disadvantages of using DSR is that it requires a bit more effort in configuration and also requires a loopback interface on the TFTP servers.

Now on to the fun stuff. Below you will find instructions on how to configure TFTP load balancing using NetScaler DSR. In this scenario there are 2 PVSs with the TFTP service installed on each. The PVSs have initially 2 network adapters. The first network adapter is used to connect to the server VLAN. The second adapter is to connect to the PVS VLAN for streaming images. We are using 1 NetScaler (or you could use 2 in a HA pair) using subnet IP (SNIP) instead of mapped IP (MIP). There are 3 VLANS connected to the NetScaler. First, the management interface which is where the NetScaler IP (NSIP) is allocated. Second, the server VLAN. Finally, the PVS VLAN So it logically looks like:

Now for the configuration:

Open the NetScaler GUI and login.
Navigate to "System" | "Settings"
Click on "Configure modes".
Select "Use Source IP".
Select "MAC Based Forwarding".
Create the SNIP for the PVS VLAN if not already created.
Create load balancing servers in NetScaler:

Navigate to "Load Balancing" | "Servers" and click "Add".
Enter a name and IP address, the click "Create".
Repeat this for each TFTP server.

Create a new service group:

Navigate to "Load Balancing" | "Service Groups" and click "Add".
Select "ANY" for Protocol.
Select "Server based".
Select the TFTP servers created earlier.
Enter * for the port.
Add a ping monitor, or create your own TFTP monitor.
Navigate to the "Advanced" tab.
Select "Use Source IP".
Select "Client Keep-Alive".
Select "TCP Buffering".
De-select "Surge Protection".
Click "Create".

Create a new virtual server:

Navigate to "Load Balancing" | "Virtual Servers".
Type in a name and IP. This is the IP that needs to be used in DHCP option 66. This is also the IP address to be used for the loopback adapters.
Set the protocol to "Any".
Set the port to *.
Navigate to the "Services Group" tab.
Select the service group created earlier.
Navigate to the "Method and Persistence" tab.
Select "SOURCEIP" for persistence.
Navigate to the "Advanced" tab.
Set redirection mode to "MAC Based".

Add the loopback adapter to the TFTP servers:

Navigate to the device manager.
Right-click the TFTP server name in the middle pane and choose "Add legacy hardware".
Click "Next".
Select "Install the hardware that I manually select from a list (Advanced)".
Click "Next".
Select "Network adapters".
Click "Next".
Select "Microsoft" for the manufacturer.
Select "Microsoft Loopback Adapter" for the network adapter.
Click "Next".
Click "Finish".
Navigate to the properties of the new loopback adapter and uncheck IPv6.
Go to the properties of IPv4 and type in the IP address and subnet mask. This is the same IP address when you created the virtual server earlier. Do not enter a gateway or DNS servers.
Disable DNS registration on this adapter.
Disable NetBIOS on this adapter.
Open a command prompt as an administrator.
Enter the following commans for the loopback adapter and PVS VLAN adapter:

netsh interface ipv4 set interface "[name of adapter]" weakhostreceive=enabled

Enter the following command for just the loopback adapter:

netsh interface ipv4 set interface "[name of adapter]" weakhostsend=enabled

Set the TFTP service to listen on the new loopback adapter:

Navigate to C:\Program Files\Citrix\Provisioning Services.
Open tftpcpl.cpl as an administrator.
Click on the "TFTP Network" tab.
Select the loopback adapter created earlier and de-select any other adapters.
Restart the Citrix TFTP service.

Test TFTP load balancing with NetScaler DSR:

Install the TFTP client feature on a server that is on the PVS VLAN but is not a TFTP server.
Open a command prompt and enter the following:

tftp [IP of TFTP virtual server created earlier] GET ardbp32.bin ardbp32.bin

Let me know if you have any comments, questions, or suggestions.