Happy SysAdm

Testing vSphere 5 FT in a VMWare Workstation lab

2012-02-27T05:59:00.000-08:00

Studying for VCP 5 requires a home lab for walking through the installation steps, learning to manage every single feature of vSphere 5 and getting real hands-on experience.

If you wanted a cost effective solution for your home testlab, you have probably chosen to run everything in a VMware Workstation environment.

Though nesting your vSphere environment inside VMWare Workstation has let you test ESXi installation, vCenter appliance configuration, vMotion, Storage vMotion and much more, there certainly is something you are struggling to enable: Fault Tolerance (FT).

In fact, even if you could get a VM configured for FT, you probably get the following message when powering it on:

'Record/Replay is not supported on this CPU for this guest operating system.'

To work around this issue, you'll have to use BT-based record/replay, which means adding the following option to your FT-enabled VMs:

replay.allowBTOnly : true
replay.allowFT : true
replay.supported : true

These settings are found at VM-level under 'Edit Settings / Options / General / Configuration parameters' (note that this tab can be accessed only with your VM powered off).

The 'replay.allowFT' and 'replay.supported' switches must just be set from false to true while 'replay.allowBTOnly' must be added as a new row.

Of course this setting can be added directly to the vmx file, but for sure you knew that if you are heading to be a VCP.

For more information on Binary Translation check this and this. And for a VCP 5 study guide, check my other blog post here.

VCP5, my study notes

2012-02-24T06:36:00.000-08:00

These days I pushed myself to study to become a VCP5 at last. So, after attending the appropriate (and mandatory) course 'VMWare vSphere 5.0 Install, Configure, Manage', and after spending many days in the lab disassembling and reassembing the whole virtualization solution, and going over my study books and almost every possible Internet resource, I (think I) am finally ready to sit for this exam.

Here follow the notes I have taken while studying. They are a bit crammed, many things are probably missing, maybe because I didn't feel I needed to write them down, many things are there but I suppose I knew them before. It doesn't matter. These are my personal study notes and that's the way it is. Of course if you, reader, wish to contribute and send me your opinion or suggest corrections/improvements, whatsoever, feel free to do so and I will be most happy of updating this blog post.

And in case these notes helped you, please, let me know and share you score!

ESXi general config:

ESXi supported platform: only 64 bit hosts with LAHF and SAHF instructions in long mode
Auto-Deploy order: PowerCLI image builder, Auto Deploy (anwer file accessed via NFS, SFTP, HTTP),Host Profiles
Requirements for kickstart ESXi: root password and install location
Protocols to access kickstart file for scripted install/upgrade: DVD,USB,NFS,HTTP,HTTPS,FTP
Evalutation period: 60 days
ESXi logs: hostd.log and vmkernel.log
ESXi memory footprint: less than 70 MB
Vpxa: vCenter agent on the ESXi
Hostd: daemon for direct VMWare vSphere Client connections
/var/log suggested size: 2000MB
Backup of ESXi: vicfg-cfgbackup
Lockdown mode: forces all operations to be performed through vCenter Server, using the vpxduser. Remote access for root is forbidden, but root can continue to use DCUI
ESXi shell: enable/disable local access to shell
SSH: enable/disable remote SSH
vNUMA: virtual non uniform memory allocation, enabled by default if more than 8 vCPU

VM:

VM overhead memory: determined by number of vCPU and configured memory
.vswp size: equal to the difference between the amount of physical memory assigned to the VM and the reservation it has
VM customization requirements: sysprep on vCenter and Perl on Linux
Shares: low, normal, high, custom
Expandable reservation: ask the parent if it has free resources
VM independent disks: no snapshots, no sDRS
Typical VM: Name, inventory location, resource pool, dtatastore, guest OS, NIC, Disk size and provisioning
Custom VM: same as typical VM + Hw version (7/8), vCPU, memory, SCSI controller
Quiescing virtual machine snapshot operation: Requires VMware tools, May alter the behaviour of applications within the virtual machine, Ensures all pending disk I/O operations are written to disk
Using templates: no possible if vSphere client is connected directly to the ESXi or if the template is orphaned

Scripting:

vCLI: vSphere command line
vMA: vsphere Management Assistant, it is a 64 bits virtual appliance (it contains vCLI)
PowerCLI: Powershell snap-in composed of 200 cmdlets

Minimum, Maximum and Default values:

1 LUN: 1 VMFS
Max VM per ESXi host: 512
Min number of cores per ESXi host: 2
Max logical CPU per ESXi host: 160
Max vCPU per ESXi host: 2048
Min RAM per ESXi host: 2GB
Max RAM per ESXi host: 2TB
Max number of swap files per ESXi host: 1 per virtual machine
Max ESXi host swap file size: 1TB in VMFS5
Max iSCSI LUNs per ESXi host: 256
Max NFS mounts per ESXi host: 256
Max Fiber Channel LUNs per ESXi host: 256
Max software FCoE adapters per ESXi host: 4
Max VMFS3 volume size: 64TB
Max virtual or physical RDM size on VMFS3: 2TB minus 512 bytes
Max file size on VMFS3 with 1MB block size: 256GB
Max file size on VMFS3 with 2MB block size: 512GB
Max file size on VMFS3 with 4MB block size: 1TB
Max file size on VMFS3 with 8MB block size: 2TB
Max VMFS5 extent: 2TB
Max VMFS5 volume size: 64TB (32 extents)
Max virtual RDM size on VMFS5: 2TB minus 512 bytes
Max physical RDM size on VMFS5: 64TB
VMFS5 block size: 1MB
Max file size on VMFS5: 2TB minus 512 bytes
Max VMDirectPath PCI/PCIe devices per host: 8
Max VMDirectPath PCI/PCIe devices per VM: 4
Max distributed vswitches per vCenter: 32
Default number of ports per standard switch: 120
Max host per vCenter: 1000
Max powered-one VMs per vCenter: 10000
Max registered VMs per vCenter: 15000
Max vCPU per VM: 32 (virtual SMP)
Max RAM per VM: 1 TB
Max floppy devices per VM: 2
Max vNIC per VM: 10
Max USB devices per VM: 20
Max USB3 devices per VM: 1

Storage:

RDM: raw device mapping
RDM on NFS: no
Virtual compatibility RDM benefits compared to physical RDM: VM cloning and template creation
Hardware compatibility RDM benefits: guest operating system can access the hardware directly
sVmotion of RDM: if virtual compatibility mode, the RDM becomes a VMDK (thin or thick). If hardware compatibility mode, only the mapping file is migrated
DAS: direct attached storage
Boot from SAN: no boot from DAS or NFS
DAS: no vmotion, no HA, no DRS
Supported NFS: version 3 on TCP (compatible with openfiler 2.99, incompatible with freenas 7)
SCSI NAA: Network Address Authority
SCSI Runtime name: vmhba n:c:t:l where N = hba, C = channel, T = target, L = LUN
IQN: iSCSI qualified name
iSCSI initiators: software, hw dependent or assisted, hw independent
iSCSI software initiator CHAP auth: one-way and mutual
iSCSI software CHAP level: initiator level or target level
iSCSI software initiator CHAP sec level: do not use CHAP, do not use unless required by target, use unless prohibited by target, use CHAP
iSCSI hw dependent initiator: one-way
iSCSI hw dependent CHAP level: initiator level or target level
iSCSI hw dependent CHAP sec level: do not use CHAP, do not use unless required by target, use unless prohibited by target, use CHAP
iSCSI hw independent initiator: CHAP one-way
iSCSI hw independent CHAP level: initiator level only
iSCSI hw independent CHAP sec level: do not use CHAP, use unless prohibited by target
LUN masking: at HBA level or storage process (SP) level
Zoning: at fiber channel switch level
WWN: World Wide Name
FCoE configuration: nothing, it appears as a hba adapter
CNA: Converged Network Adapter which contains hba + NIC
Storage multipathing policies: FIXED (better with active/active arrays), MRU (better with active/passive arrays), Round Robin (this last one makes load-balancing on all physical paths and I/O throughput/sec is optimized, so performance is increased)
NPIV: n_port ID virtualization, Fiber Channel facility allowing multiple virtuzal ports ot share one physical port. No FT or sVmotion with NPIV
PSA: Pluggable Storage Architecture (PSA) is an open modular framework that enables third-party storage multipathing solutions for workload balancing and high availability
To manage storage placement by using virtual machine profiles: Create user-defined storage capabilities, Associate user-defined storage capabilities with datastores, Create virtual machine storage profile, Associate a virtual machine with a profile

Networking:

Vlance: old 10Mbps AMD NIC for 32 bit guests
VMXNET: only available if VMWare tools are installed
Best NIC: vmxnet3 paravirtualize adapter (HW version 7 at least)
VSS: vSphere Standard Switch
VDS: vSphere Distributed Switch
CDP: Cisco Discovery Protocol
NIC Trunking: 802.1q
NIC Teaming: 802.3ad
VSS security policies: Promiscous reject, Mac address change accept, Forged transmits accept
VSS traffic shaping: outbound only
VSS traffic shaping: avg bandwidth (Kb), max bandiwidth (Kb), burst size (KB)
VDS traffic shaping: egress and ingress
VDS security policies: same as VSS plus port blocking
VSS NIC Teaming – Load balancing: Originating port ID, sourced MAC hash, IP hash (this one good if Etherchannel is implemented on physical switches), use explicit failover
VSS NIC Teaming – Network failure detection: link status only and beacon probing
VSS NIC Teaming – Notify switches: yes/no (if yes, the VMkernel sends a RARP packet each time certain actions occur—for example, a virtual machine is powered on, experiences teaming failover, performs certain VMotion operations, and so forth. The RARP packet informs the switch of the MAC address of that virtual machine)
VSS NIC Teaming – Failback: yes/no
SplitRX: uses multiple physical CPU to handle and speed up VM network traffic
NETFLOW: network analysis tool (only in vDS), required to analyze traffic from a vDS
Network I/O control: Isolate and Prioritize (shares) VMtraffic, FT logging, iSCSI, NFS, Management traffic, vMotion. It does enforces limits and does load-balancing on dvUplinks

vMotion:

vMotion of VM across datacenters: only if powered-off or suspended
vMotion shared storage required: yes, the datastore must be available to all the hosts participating in the migration
Successful vMotion blocking by: VM connected to internal switch, ISO mounted, CPU affinity, swap inaccessible to destination host
NX/ND: same settings required for vMotion

sVmotion:

Svmotion: performed by vmkernel data mover ot VAAI (vmware API for array integration)
VM state for vMotion and sVmotion together: powered-off

HA:

HA restart condition: restart VM on another cluster node if current node has failed, restart VM if VMWare tools heartbeat stopped, restart VM if application fails (need VMWare tools + application monitoring agent)
HA slot: CPU + memory + overhead
VM restart priority: disabled, low, medium, high
Host isolation response: shutdown, power-off, leave powered-on
FDM: Fault Domain Manager (for HA)
HA hierarchy: 1 master, multiple slaves
HA nodes: max 5 (first 5) primary and max 27 secondary
Do not power on virtual machines if they violate availability constraints: strict admission control
Allow virtual machines to be powered on even if they violate availability constraints: guaranteed admission control

FT:

FT: Fault Tolerance, based on vlockstep technology to keep VM synchro
Max FT VM per host: 4
Max vCPU per FT VM: 1

DRS:

DRS: Distributed Resource Scheduler
DRS automation levels: disabled, partially automated, fully automated

DPM:

DPM requirements: ILO configuration and WOL (wake on lan)

sDRS:

SDRS: Storage DRS, used for long term load balancing of datastores, it requires Storage I/O control on all datastores

EVC:

EVC cluster requirements: CPU form single vendor, ESX 3.5u2 or later, vCenter, Intel VT, NX/ND, vMotion

vApp:

vApp IP allocation policies: fixed, transient, DHCP

vDR:

vDR: VMWare Data Recovery backup appliance: schedule, snapshot, deduplicate
VADP: vStorage API for data protection; it allows to backup VMs from a central backup server without backup agents
CBT: Changed Block Tracking, vDR use this technology for incremental backups of VMs
Deduplication processes: Integrity check, Recatalog and Reclaim

Performance monitoring:

VM constrained CPU indicator: %ready (%RDY)
VM constrained Memory indicator: memory balloon, guest swapping
Host constrained Memory indicator: host level swapping
Counters for diagnosing ESXi memory bottleneck: MEMSZ, METCTL, SWAP
Monitoring disk latency: Kernel commands latency <4ms and Physical device latency <15ms
VM constrained network indicators: dropped RX/RT packets

Ports:

Port 22: SSH
Port 80: web, FT
Port 123: NTP
Port 389: LDAP
Port 443: vSphere Client to host, host to host
Port 636: Linked-mode
Port 902: host to host, vsphere client to vmconsole, heartbeat ESXi to vcenter server
Port 3260: iSCSI
Port 5480: vCenter web configuration
Port 8000: vMotion requests
Ports 8100 and 8200: FT traffic
Ports 8182 : HA traffic

Update Manager:

Update Manager: hosts, VM hardware, VMware Tools, Virtual appliances
Update Manager baselines: Host Patch, Host Extensions, Host Upgrade, VM Patch, Virtual Appliance Upgrade
Default VMs/VAs upgrade baselines: VMware Tools Upgrade to Match Host, VM Hardware Upgrade to Match Host, VA Upgrade to Latest
Update Manager can update virtual appliances but cannot update the vCenter Server Appliance.

vCenter server:

Vpxd: vCenter management daemon
Backup of vCenter: Database, SSL certificate, vpxd.cfg
To make vCenter server available: use heartbeat
To make vCenter appliance available: use HA
Additional modules installable from vCenter installer: ESXi Dump Collector, Web Client, Update Manager

vSphere client:

Hardware Status tab: based on CIM Data Feed in vCenter Service Status and vCenter Hardware Service in the Plug-in Manager
Resource pools: present on standalone ESXi or Cluster (vCenter managed) - a vApp is seen as a resource pool on standalone ESXi
General alarm actions: send email, send trap, run command
Specific VM and host alarm actions: power-on VM, power-off VM, suspend VM, reboot host, shutdown host
To export diagnostic log for ESXi: Select Home, Under Administration, click System Logs and click the export systemLogs button. Select the effected ESXi host. Select `Select All'. Select a location and click Finish / In the vSphere Client, select the affected ESXi host. Select File, Export and Export System Logs. Select a location and click Finish.

vCenter Linked mode:

Linked mode: allow multiple vCenter servers to share information and the admin to view and manage the inventories of the linked vCenter Server systems. Linked mode between ESX4 and 5 is not supported.
Linked Mode prerequisites: DNS, two-way trust between domains, the installer must be admin on all vCenter server machines, NTP must be set up., port 636 open

vSRM:

vSRM: vCenter Site Recovery Manager requirements: ESXi, a vCenter server at the protected site, a vCenter server at the recovery site, array-based replication

OVF:

OVF: Open Virtualization Format: open, secure, portable, efficient and extensible format for the packaging and distribution of software to be run in virtual machines. It allows a VM to be transported.

Other:

A few useful scrrenshots to better memorize things:

vCenter server appliance configuration interface

vCenter server installer options (such as Dump Collector, Web Client and Update Manager)

ESXi console

ESXi configuration options

ESXi logfiles

For any additional information on vSphere 5, visit http://www.vmware.com/

You could also check the following excellent resources:

Forbes Guthrie vSphere 5 documentation notes
Andrea Mauro's blog (one of my favorites!)
Brownbag videos
Jason Langer study notes
Gregg Robertson website
Simon Long practice exam
Preetam Zare VCP510 preparation guide/

Touching a file in Powershell

2012-02-02T07:29:00.000-08:00

Although 'touch' being one of the most useful Linux commands, it is still missing in Powershell. The 'touch' command is important for developers and sysadmins alike because it allows you either to update the timestamps of a file, either to create temporary empty filenames.

So here's my Powershell transcription of the bash 'touch' command for those of you who might need it:

param([string] $filetotouch)
if(test-path $filetotouch)
    {
    Set-ItemProperty -Path $filetotouch -Name LastWriteTime -Value (get-date)
    “File $filetotouch timestamp succesfully updated”
    }
else
    {
    Set-Content -Path ($filetotouch) -Value ($null);
    “File $filetotouch succesfully created”
    }

You can save this file as touch.ps1 then call it from the Powershell command line as follows:

.\touch.ps1 test.txt

I hope you liked this script.

Running SSH commands from Powershell

2012-01-31T02:32:00.000-08:00

There is a really simple way of running ssh commands on unix/linux boxes from a Powershell script. In fact, altough Powershell does not natively support running ssh commands, it can rely on external third party tools to get the job done. The tool I am talking about today is Plink.

Plink (Putty link) is a Putty command line tool similar to ssh that you can get from here.

The Powershell script can call the Plink.exe executable this way:

$sshcommand = & .\plink.exe unixhost -load unixhostsession "mkdir testfolder/testsubfolder;"

or:

$sshcommand = & .\plink.exe unixhost -load unixhostsession "chmod 2750 /testfolder/testsubfolder;"

or even:

$sshcommand = & .\plink.exe unixhost -load unixhostsession "useradd testuser -d /testuser/workshop/home"

As you can understand any command can be fired with Plink.

Of course you can use Powershell variables inside these commands:

$unixhostname = "sysx.yourcompany.com"

$folder1 = "testfolder"

$folder2 = "testsubfolder"

$sshcommand = & .\plink.exe $unixhostname -load unixhostsession "mkdir $folder1/$folder2;"

In these examples we are using the pretty useful -load switch, which is used by plink to load a saved Putty session. In this case the credentials (username and password, or username and key) are retrieved by Plink from the session named 'unixhostsession'. The session parameters are stored in the Windows Registry under the following registry key:

HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\unixhostsession

Remark also the use of the Powershell Call operator (the ampersand, &), which is used to lanch any exe/script.

Last but not least, know that you can concatenate commands using a semi-colon. Just be sure to enclose everything in quotes.

vMotion of MSCS cluster nodes running Windows 2008

2012-01-30T06:46:00.000-08:00

Being able to vMotion MSCS cluster nodes is something that is quite difficult to achieve and that need some fine tuning of Windows cluster parameters. The modifications I am going to show you are meant to increase the cluster heartbeat timeout and to decrease the cluster sensitivity to network connection interruptions.

By default MSCS will fail your node if five pings are lost and will initiate a failover.

Unfortunately 5 seconds is sometimes an insufficient time slot for VMWare to complete the vMotion process because while the contents of the guest's memory are copied from one physical host to another, the guest is queisced for a few seconds in order to allow the synchronization of changed blocks of memory. Typically you may lose up to 3 pings.

You need then to change the heartbeat values to their maximums by issuing the commands below on just one of your cluster nodes:

cluster /prop SameSubnetThreshold=10:DWORD

cluster /prop SameSubnetDelay=2000:DWORD

Here's the explanation of these parameters:

SameSubnetDelay: The value in milliseconds of the cluster heartbeat frequency. By default, this value is 1,000 milliseconds. The maximum possible value is 2000.
SameSubnetThreshold: The value represents the amount of missed heartbeats that will be tolerated before a failover event occurs. The default value is 5. The maximum value is 10.

Setting these values to 2000 and 10 means that the cluster service will wait for 20 seconds before initiating a failover.

The commands above are a new feature of the cluster service under Windows 2008. There have been in fact many improvements to the Windows Server 2008 failover clustering service. One of this improvements concerns exactly the cluster heartbeat mechanism.

If these modifications don't resolve your failover problem, then you might also play with some more parameters:

check the cluster resource health check policy for each cluster resource

increase the value of the Timeoutvalue of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Disk registry key, as shown here.

I hope this helps.

Setting up an account for the antivirus agent on a NetApp

2011-12-16T05:37:00.000-08:00

When you install an antivirus server like Trend Micro ServerProtect or McAfee VirusScan Enterprise for Storage or a backup agent (such as HP Data Protector) and you want to plug them on your NetApp, there is one action which is necessary to allow the Trend or ePO agent to communicate with the filer.

This action is to set up a user account which can bypass file security to scan or backup the shared files wherever they are stored on the NetApp qtrees.

So, the first step to accomplish this action is to create an Active Directory user account named yourdomain\youravuser (if you don't have one already). Then you have to add yourdomain\youravuser to the local backup operator group on the NetApp.

The commands to use are shown below.

Start by opening a ssh session on the filer then run the following command to add yourdomain\youravuser to the Backup Operators group:

useradmin domainuser add yourdomain\youravuser -g "Backup Operators"

The output of this command is:

SID = S-1-5-21-2008546643-30345388-3495930542-111619 successfully added to Backup Operators

To double check that your configuration is good, run the following command:

useradmin domainuser list -g "backup operators"

The SID of the user you just added should be listed inside the members of this group. For sake of completeness, do a reverse lookup of the SID:

cifs lookup S-1-5-21-2008546643-30345388-3495930542-111619

The expected output is:

name = yourdomain\youravuser

I hope this post helped you. For additional NetApp commands check this.

Celebrating 20 years of Linux

2011-12-13T23:13:00.000-08:00

Understanding Windows Services Recovery features

2011-12-13T04:53:00.000-08:00

As you probably know Windows has the ability to automatically perform some predefined action in response to the failure of a Windows Service. The Recovery tab in the Service property page let you in fact define the actions that the system has to perform on first failure, second failure, and subsequent failures.

Valid options are "Take No Action", "Restart the Service", "Run a Program", and "Restart the Computer".

In my case I have configured my test Trend ServerProtect service to restart after the first and the second failure, then a system reboot is executed the next time this service fails.

To test this I have written a basic batch script which recursively kills the service. Doing so I have just discovered that, with the default setting, Windows always performs the action defined for the first failure (in my case my TREND ServerProtect test service is restarted) and will never go through successive actions.

Furthermore I see that the event log reports all the time the same diagnostic message, even in case of recurring service failures:

Log Name:      System
Source:        Service Control Manager
Date:          07/12/2011 10:54:25
Event ID:      7031
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      servername
Description:
The Trend ServerProtect service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

The "It has done this 1 time(s)" sentence looks problematic to me because I am recursively killing this service and the failure counter should increase.

If I double check the recovery parameters with sc.exe I am happy with the output:

sc qfailure spntsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: spntsvc
   RESET_PERIOD (in seconds)    : 0
   REBOOT_MESSAGE               :
   COMMAND_LINE                 :
   FAILURE_ACTIONS              : 
     RESTART -- Delay = 60000 milliseconds.
     RESTART -- Delay = 60000 milliseconds.
     REBOOT -- Delay = 60000 milliseconds.

So, why does the failure counter does not increase? Cleary it looks like there is a bug in the way the Service Control Manager reads or understands the parameters I have set.

After deep investigation, and a after many searches throughout technet.microsoft.com, I found that setting the "Reset fail count after:" option to 0 means that the failure counter will not be stored at all. So I completely misunderstood its meaning. At first I was lost for words when I discovered that this parameter did not do what I expected from it.

Anyway, once you know that keeping this option set to 0 disables both the "second failure" and "subsequent failure" actions, the solution is pretty simple: set its value to 1 (or whatever you like) and you'll get the desired behavior upon service failure (in my case the server will restart upon third failure).

I hope this post will help you and, if so, do not hesitate to comment!

VMware vMotion and the CPU incompatibility problem

2011-12-02T05:34:00.001-08:00

By default, VirtualCenter only allows migrations with vMotion between compatible source and destination CPUs. So if you have been trying to move a VM from one host to another, and you got stuck with a error message telling you that the CPU of your destination host in incompatible with the CPU configuration of your Virtual Machine, then this usually means one of the following:

a) you did not mask the NX/XD bit in the settings of the VM or...
b) you did not enable the "No-Execute Memory Protection" on both your source host and destination host or...
c) you did not have your cluster of ESX hosts configured for Enhanced VMotion Compatibility (EVC)

The complete error message you get is:

CPU of the host is incompatible with the CPU feature requirements of virtual machine;
Problem detected at CPUID level 0x80000001 register edx

There are different methods to get past this blocking point.

1st method: hide the NX flag from the guest VM
2nd method: enable a DEP mechanism on your hosts
3rd method: enable EVC

The first method is to change the configuration of the VM to migrate in order to prevent it from checking the NX flag in the BIOS. This can be done either via the interface, either with a Powershell script. Let's explore both ways.

First method option A: to mask the Nx flag from the VI client, follow this procedure:

select the virtual machine from the Inventory
click Edit Settings
click Options
click Advanced
select "Hide the Nx flag from the guest".
OK

First method option B: If you want to accomplish this same task with Powershell, just customise and run the followjng ps1 script:

Add-PSSnapIn VMware.VimAutomation.Core

Connect-VIServer virtualcenterhost

filter Mask-NX {

$view = get-view $_.id

$vmConfigSpec = new-object VMware.Vim.VirtualMachineConfigSpec

$featureMask = new-object VMware.Vim.VirtualMachineCpuIdInfoSpec

$featureMask.info = new-object VMware.Vim.HostCpuIdInfo

$featureMask.info.ecx = "---- -0-- ---- ---- ---- ---- ---- ----"

$featureMask.info.level = 1

$vmConfigSpec.CpuFeatureMask = $featureMask

$view.ReconfigVM($vmConfigSpec)

}

Get-VM vm_name | Mask-NX

With a simple modification you could also use this script for modifying all the VMs inside a given cluster and taste your coffee while the job gets done. Just use Get-Cluster | Get-VM | Mask-NX instead of Get-VM vm_name | Mask-NX and your Powershell script will quickly cycle through each member of the cluster.

A second method is to have the "No-Execute Memory Protection" option enabled on both your source and destination host, so that they are at the same level. For your information, enabling this feature will protect your systems by marking all memory locations in a process as non-executable unless the location explicitly contains known executable code, and this will prevent against the execution of malicious code. This feature is also called DEP (Data Execution Prevention). To activate this option, do the following::

Reboot the server and access the BIOS
Select "Advanced Options"
Enable "No-Execute Memory Protection" (this is what is called on HP servers)
Press "F10" to save and the server will restart.

The third method, which is valid only for recent ESX versions, is to enable the EVC (Enhanced vMotion) mode, which is also useful you want to vMotion around all your VMs even if the source and destination hosts are not running the same processor family (Intel, AMD). Here's the procedure:

Right click your cluster and choose Edit Setting
Click on the VMware EVC in the left panel
Select the option "Enable EVC for Intel Hosts" or "Enable EVC for AMD Hosts".
Now choose your VMWare EVC mode: you can raise the EVC mode to expose more CPU features, or lower the EVC mode in order to hide CPU features and increase compatibility with older hardware
Click Ok

Your problem should now be solved whatever method you used. The method you will choose is just a question of approach. Any administrator will choose differently depending on his environment/constraints.

I hope you have found the answer you were looking for and, if so, do not hesitate to comment!

Disabling Auto Restart After Windows 7 Update

2011-11-18T01:59:00.001-08:00

I have recently choose Windows 7 as the Operating System for my home NAS. After testing FreeNAS, Ubuntu, Linux Mint, Windows XP and Windows 2003 Server, I must say that there are many reasons that pushed me to this difficult choice and there are a lot of advantages to use Windows 7 as a File Server.

However I am not going to talk about this right now.

What I wanted to talk about is NAS availability: if there is one thing I expect from my NAS, it is it to be on and ready to serve all the time. Not a minute less.

Unfortunately this Microsoft OS is too often trying and sometimes succeeding in rebooting my home server in the middle of the night, when I less expect it. And this is something I don't like at all, not even to apply critical security patches that clever people at Big Brother Microsoft have crafted for me.

That's why I want to share a not-so-secret hint on how to stop Windows update from restarting your system once and for all. It is a easy painless method which, as usual under Windows, consists of adding a registry key.

Here's the procedure:

Open up regedit.exe through the start menu search box or run dialog, and navigate down to the following key: HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
In the right pane, right-click into the white area and select New – DWORD (32-bit)
Enter the name NoAutoRebootWithLoggedOnUsers
Double-click on NoAutoRebootWithLoggedOnUsers and enter the value 1
Close the Registry Editor

It's done. Easy, isn't it? Windows Update restarts have gone forever. My NAS can live peaceful and untroubled. I'll take care of restarting my system when I, and only I, will think it necessary.

Windows 2008 R2 folder security issue and UAC

2011-11-15T06:58:00.001-08:00

It is incredible how many Windows system administrators have been impacted by the introduction of UAC in Windows 2008 R2. These days I have been asked how to solve general security issues with folder security in 2008 R2. These issues weren't present in previous Windows versions such as Windows 200/2003, that's why many of us were surprised by new unknown behaviors.

In particular people were facing a situation in which on some folders or drives, when opening the Properties window as a member of the local Administrators group and selecting the Security tab, they had to click on 'Continue' before they could see the folder NTFS permissions.

The particular message shown was:

"To continue, you must be an administrative user with permission to view this object's security properties. Do you want to continue?"

and they were supposed to click the 'Continue' button.

If they explicitly granted the very same user account Full Control access to the folder, the NTFS permissions showed up without any further hassle.

In the same context, they got an 'Access Denied' error on the same folders even if they were members of the local Administrators group. Enabling Auditing on these folders showed up many 4656 events telling that their access was not granted.

If you have this problem also, the solution is simple: lower UAC to 0, following the procedure I have posted here:

How to disable UAC

How to disable UAC for System Administrators only

UAC is a major change (or 'improvement' if you wish..) in Windows 2008 R2, but it can be a real obstacle to everyday sysadmin tasks. So getting rid of it can sometimes be the only possible solution.

Do not hesitate to comment if you find this post useful or if you wan to share your point of view on UAC.

Disabling automatic KMS to DNS publishing

2011-11-08T06:36:00.000-08:00

If for some reasons you want to stop your Windows 2008 R2 KMS server from publishing everyday its Resource Record (RR) to the DNS, you have to use the built-in Software Licensing Management Tool (slmgr.vbs).

To do so, open an elevated command prompt on the KMS server and run:

slmgr /cdns

A pop-up will appear telling to you to reboot the KMS Service:

From the same elevated command prompt, run the following command to restart the KMS Service:

Net Stop sppsvc && Net Start sppsvc

If you are running your KMS service on a older Windows version (not R2), run the following command instead (the service executable has been renamed in Windows 2008 R2... don't know why...):

Net stop slsvc && Net start slsvc

Now there are two ways to check that your KMS server has stopped trying to register its Resource Record in the DNS.

The first one is to open the Registry and see that the DisableDnsPublishing DWORD key has been added under :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

The value of this key has also been set to 1.

The second way to check that KMS publishing to DNS is off is with the command:

slmgr.vbs dlv

I hope this solution helped you. If you have any question or any comment do not hesitate to post.

Cluster Validation Error due to duplicate NIC GUIDs

2011-11-04T03:43:00.000-07:00

If you are running a Windows 2008 R2 Failover Cluster, you may see the following error when running the Failover Cluster Validation tests:

It tells:

Validate Windows Firewall Configuration
Validate that the Windows Firewall is properly configured to allow failover cluster network communication.
Validating that Windows Firewall is properly configured to allow failover cluster network communication.
An error occurred while executing the test.
There was an error verifying the firewall configuration.
An item with the same key has already been added.

The last line is telling us that two elements have the same value. These elements are the Network adapters and the offending value are the adapter GUIDs. These GUIDs should be unique but if you have cloned your servers or if your Cluster servers are cloned VMWare Virtual Machines, this error might occur.

To solve this issue, start by running a Powershell session, then run the following command on every Cluster node and compare the GUID of your Network adapters:

Get-WmiObject Win32_NetworkAdapter | format-list Name,GUID

You should see that the Network adapters have the same GUID on different servers.

If this is your case, uninstall all of your Network adapters from Device Manager from all the Cluster members except one (but first note your IP address configuration!). Reboot them, re-run the Powershell command and you should find that your Network adapters are back with brand new GUIDs (thanks Plug and Play!).

Re-run the Cluster Validation Report and everything should be OK.

Please leave a comment if this post helped you!

Setting DisableStrictNameChecking in Windows 2008 R2

2011-11-02T08:53:00.000-07:00

I recently faced a problem whereby I had to install a Windows 2008 R2 Failover Cluster Server and make a CNAME alias point to it but I was unable to get to the CNAME network share from remote clients.

Fortunately this wasn't a difficult problem to solve as I was aware of the existence of the DisableStrictNameChecking registry key under previous Windows versions. This key tells the server to allow inbound connections which are not explicitly directed to its main hostname, so it is a protective feature, not a bug.

So, to loosen security a bit allowing proper network access to a Windows server using a DNS alias, fire an elevated command prompt, type regedit and move to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Right-click Parameters, click New, and then click DWORD (32-bit) Value.

Type DisableStrictNameChecking and press ENTER.

Double-click the DisableStrictNameChecking registry value and type 1 in the Value data box, click OK and close the Registry Editor.

This should solve your issue with accessing a Windows 2008 R2 server with a CNAME.

Windows 2003: extending the Schema to R2 for DFS-R

2011-10-27T06:15:00.000-07:00

Recently I have been trying to install a DFS Replication Group on two brand new Windows 2008 R2 Enterprise boxes belonging to a pretty old Windows 2003 Active Directory Domain.

Nothing specially tricky in this activity, apart the fact that the AD Schema must be extended before we define a new replication group. This is due to the fact that DFS-R stores its configuration info in the domain partition. The aim of this blog post is to share my quick procedure to do it, in case somebody should face the same situation, as I am sure there are still many Windows 2003 Domains around.

First thing is "Don't panic". The Schema extension is pretty straightforward and it doesn't need you to reboot any of your precious DCs. You can do it without actually upgrading the Operating System on your DCs.

Just keep in mind that some parameters will be added to you Active Directory in order to DFS-R to work. These are, for instance:

msDFSR-DfsPath
msDFSR-ReplicationGroupGuid

If you don't update the Schema, you won't be able to set-up any Replication Group and you will receive the following error when trying to create a Replication Group:

"domain.com: The Active Directory schema on domain controller DC1.domain.com cannot be read. This error might be caused by a schema that has not been extended, or was extended improperly. See Help and Support Center for information about extending the Active Directory schema. A class schema object cannot be found."

DFS-R R2 error when the Schema has not been updated

Furthermore, on your DFS-R Servers you will have the two following event-IDs telling you that something is wrong with your Active Directory configuration:

Event ID: 1202

The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.

Event ID 1202

Event ID: 6012

The DFS Replication service detected an incompatible Active Directory Domain Services schema version while trying to read configuration objects from server dc1.domain.com. The service disconnected from this server and will try again in the next polling cycle.

Event ID 6012

Now, to upgrade the Schema, we need to use the get the second disk of Windows Server 2003 R2 and load it on the Schema Master. If you don't remember which Domain Controller is the Schema Master, connect to any DC and type the following command:

netdom query FSMO

Here's a sample output indicating the Schema Owner:

Output of the NETDOM command

On the same Domain Controller, in order to verify Active Directory functionality before you apply the Schema extension, execute the following command:

repadmin /replsum /bysrc /bydest /sort:delta

All domain controllers should show 0 in the Fails column, like in the following screenshot:

Getting Active Directory Replication status

Verify also that the Schema Master has successfully performed inbound replication of the Schema directory partition with the following command:

repadmin /showrepl

Now that you know which is the Schema Master and that you are sure that replication is performing properly, get on the Schema Master and run the "adprep.exe /forestprep" command from the Windows Server 2003 R2 installation disk 2.

To do this, insert the Windows Server 2003 R2 installation disk 2, move to D:\CMPNENTS\R2\ADPREP\ folder and then type the following command:

adprep.exe /forestprep

Press C to confirm that QFE 265089 has been applied and wait a few seconds for the command to finish.

Output of adprep /forestprep

Ok, it's done! Two things to know:

1. When you change the Schema on the Schema master, the changes are automatically propagated to all other domain controllers in the forest. Therefore, it is not necessary to perform this operation on other domain controllers.

2. When you run adprep /forestprep to add the Windows Server 2003 R2 Schema updates, you do not have to upgrade your existing domain controllers to Windows Server 2003 R2; they can continue to run Windows NT® Server 4.0, Windows® 2000 Server, or Windows Server 2003.

The last step is to verify the Schema extension by inspecting the objectVersion property of CN=Schema,CN=Configuration,. To do so use a tool like dsquery:

dsquery * CN=Schema,CN=Configuration, -scope base –attr objectVersion

Here's the possible values for the Schema version and their translation to OS names:

AD version == objectVersion
Windows Server 2000 === 13
Windows Server 2003 == 30
Windows Server 2003 R2 == 31
Windows Server 2008 == 44
Windows Server 2008 R2 == 47

If you have done everything alright, the objectVersion should be 31 for a Schema updated to Windows 2003 R2.

It is time to RDP onto the DFSR servers and verify that you have an event 1206 telling that the Replication Service has been able to access the configuration information on the Schema Master:

Log Name:      DFS Replication
Source:        DFSR
Event ID:      1206
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Description: The DFS Replication service successfully contacted domain controller
\\dc1.domain.com to access configuration information.

Event ID 1206

At this point, if you want, you can also upgrade the OS of you Domain Controllers to R2. It's very easy. On the same CD2, just run R2AUTO.EXE and follow the instructions. It will take three clicks and five minutes and no reboot will be required.

I hope you liked this article.

Solid State Drives, some theory and a selection of videos

2011-07-11T07:21:00.000-07:00

Today I have been looking for information about SSD disks because I am probably interested in using them for my future home-made NAS solution. Having found this SSD topic pretty interesting, I have decided to write a post about it.

Let's start form the acronym: SSD means Solid State Drives, which is a new technology spreading very fast and finally reaching the end-user. In general terms, SSD can be defined as a hybrid device which stores your data (as well as your Operating System, of course) in a semi-conductor device known as flash memory with no mechanical parts (no moving heads or spinning disks).

Thanks to their construction, SSDs have rock solid advantages over standard mechanical hard disk drives. These advantages can be summarized as follow:

No spin-up time
Extremely low random access time (about 0.1ms)
Consistent read time throughout the SSD (while on a HDD if the data is written in a fragmented way, read ops will have varying response times)
Zero defragmentation
No noise (great for a home NAS)
Very light (SSDs size is 2,5" with SATA connectors)
Lower power consumption (Excellent for the environment and for your monthly bill)
Unaffected by magnetic fields
Very robust

As you can see some of this advantages are exactly what can be found on everybody's wishlist for a consumer NAS, that is no noise, low power consumption (for instance only 2,5 watts for the Corsair Force GT 120GB - 0,6 watts when in standby) and really high performances. As an example, let's have a look at some scores:

The Intel 510 Series 250 GB is by far the fastest SSD around with 476MB/s read throughput and 325MB/s for write operations. Such speed require SATA III intrerface of course, being SATA II limited to 300MB/s.
The Crucial RealSSD M4 256 GB is also a fast model, with 310MB/s for read ops and 273 for write ops.
The Plextor PX-128M2S can read at 287MB/s and write at 195MB/s.
Other models are a little slower with an average read throughput of 220MB/s and an average write throughput of 155MB/s. These scores are in any case much higher of those of mechanical hard drives, which have a average read throughput of 105MB/s and and an average write throughput of 103MB/s, plus the extra spin-up time.

There are of course some disadvantages in this new technology that SSD designers and constructors are trying to workaround.

The first inconvenient is the cost per GB, even for cheap Multi Level Cells drives, and this is driving most end-users away from buying 512GB SSD drives. The 2$/GB makes these hard drives very expensive, especially if compared with mechanical disks, which are sold at 0,05-0,10$/GB. Let's see some selling prices for well-known 120GB models (128GB for the Samsung 470 and the Crucial m4) to better catch how pricey SSDs are:

199$ - OCZ Technology 120 GB Vertex 2 Series SATA II 2.5-Inch Solid State Drive MLC OCZSSD2-2VTXE120G (a video review is here)
210$ - Corsair Force 3 120 GB SATA III 2.5-Inch Solid State Drive CSSD-F120GB3-BK
217$ - Kingston SSDNow V100 128GB SATA II 2.5 Inch Solid State Drive SV100S2/128GZ
229$ - Lexar Media Inc Crucial 128 GB m4 SATA III 2.5-Inch Solid State Drive CT128M4SSD2 (video here)
240$ - OCZ 120 GB Vertex 3 SATA III 2.5-Inch Solid State Drive MLC VTX3-25SAT3-120G based on the SF-2200 series controllers from SandForce (video review here)
240$ - Corsair 120 GB Force Series Ultra Fast TRIM Supported Solid State Drive MLC CSSD-F120GB2-BRKT
248$ - Samsung 470 Series 128GB SATA II Solid State Drive MZ-5PA128
258$ - Intel 320 Series 120 GB SATA II 2.5-Inch Solid-State Drive Retail Box
266$ - OWC Mercury Extreme Pro 120 GB 2.5-inch SATA SSD based on SandForce 1200 controller
275$ - Intel X25-M 120 GB Solid State Drive with Internal SATA and Power Cables MLC Flash Technology, 2.5-Inch (here the Intel announcement for one of the best value SSD of the moment)
280$ - Intel 510 Series 120 GB SATA II Version 3 2.5-Inch Solid-State Drive
370$ - Transcend 120 GB SATA II Ultra Series 2.5 Inch SSD with DRAM Cache TS120GSSD25D-M

Quite expensive for a NAS where you just wanted to store many TB of data, isn't it? Maybe better used as Operating System disk, even though you can already use a cheap USB key to start an OS like Freenas.

OCZ Vertex 3 120GB SATA III

Let's continue. The second weakness of a SSD is the Mean Time Between Failure (MTBF): the longevity of this type of drives is shorter than the one of standard HDD because of the fact that the number of write cycles to any memory cell is limited and once you have consumed your quota for that block the disk starts to become unreliable. This second longevity problem has definitively slowed down the adoption of SSDs in production environments where reliability is everything. As reported by Portman Wills, who made the experiment, the reliability of SSDs over time is very low: he bought 8 SSDs two years ago and all of them failed pretty soon as reported here:

Super Talent 32 GB SSD, failed after 137 days
OCZ Vertex 1 250 GB SSD, failed after 512 days
G.Skill 64 GB SSD, failed after 251 days
G.Skill 64 GB SSD, failed after 276 days
Crucial 64 GB SSD, failed after 350 days
OCZ Agility 60 GB SSD, failed after 72 days
Intel X25-M 80 GB SSD, failed after 15 days
Intel X25-M 80 GB SSD, failed after 206 days

Of course these were consumers SSDs with cheaper MLC technology but the outcome of the experiment has scared away many of us, I can tell.

Another general concern is SSD maximum available size in GB. RunCore (a Chinese company) has released in December 2010 a big 3.5-inch SSD with a capacity of 1TB (2 x 500GB SSD drives and 2 x SandForce SF-1200 controllers). This SSD supports SATA III at 6.0 GB. The price? You better not to ask.

RunCore 1 TB SSD

So much for the theory. I spent some days watching videos explaining the advantages of SSD drives over HD and I am happy to share them with you, and maybe this will help you to decide whether to buy a SSD or just wait for 2012, year in which SSD are supposed to massively enter the consumer marketplace.

The first video is Samsung SSD Awesomeness, where Paul took 24 Samsung SSD drives and put them in RAID-0 to test their speed and reliability to heavy stress. This video is very exciting for those interested in computer hardware assembly and, believe me, it is very very very funny.

Another interesting video about SSD is the one by Samsung where the performances of SSDs and HDDs are compared. Seeing this video, it looks like Samsung is willing to become a big actor of the SSD industry.

Intel has also made its video advertising the advantages of Intel SSDs, mainly for corporations looking to lower their Cost of Ownership. Another video from Intel showing the differences between SSDs and HDDs can be found here.

A more technical video giving an insight of the technology is the one by Explaining Computers. In particular, the difference between Single Level Cells SSDs (faster but expensive) and Multi Level Cell (slower but cheaper) SSDs is explained in simple terms.

Robustnesswise, you have to watch the Intel commercial video showing you that SSD drives are karateproof while HDD are not! Ok, you aren't probably going to your server room, pull out the disk bay and kick your hard disk drives as shown in the video, but it is a good robustness test indeed.

Digging even more, a video I enjoyed watching is the Consumer SSD Solid State Drive Buyer's Guide by Linus where three generations of OCZ Vertex SSD drives are compared to each other and a technical description of each is given. Linus does also a good job of explaining that RAID-0 SSD arrays are less risky than RAID-0 arrays made up of standard HDDs because SSDs are less prone to fail (even if nobody can guarantee that your raid controller will never fail...).

Getting back to the technology behind, I appreciated this other video by Linus explaining with a good example how the TRIM operation speeds up cell deletion in SSD drives. As an added benefit, the TRIM operation does help SSDs reduce wear by eliminating the need for many merge operations to occur. Today TRIM is supported only by Windows 7 and by Linux starting from kernel 2.6.33.2.

For the ones of you who like DYI and have some spare time, have a look at this pretty cool video where you can learn to change your old HDD in a fast performing SSD drive by raiding USB keys. Astonishing and pretty simple at the same time, even if it does not explain how to remove the "removable bit" from the USB keys in order to convert them in dynamic disks.

This is all for SSD disks for the moment. I will start testing them pretty soon. In the meanwhile, if you have already tested some of them, please do not hesitate to share your opinion and to report performance, problems or whatever you fell like to share.

Installing Linux Mint 11

2011-06-30T07:03:00.000-07:00

If you are a beginner computer user wishing to learn something different from Windows 7 and don't want to wait for Windows 8 next year to improve your computer knowledge, then you could probably be interested by Linux. Yes, Linux, you heard right. Linux is a powerful Operating System which Windows users sometimes hesitate to install because of its mystical aura of an OS for nerds and geeks. But this is not true today. No more. New Linux distributions are quite easily installed and run without ever touching to its obscure features (the Kernel, the Terminal and so on).

Today many Linux distributions exist. Some are harder to use, some are definitively easier (maybe easier then Windows I daresay). Some are for the IT expert wishing to have full control on its installation (like Slackware, Fedora or Debian, the grandpa of Ubuntu), some are oriented to please the common person using its personal computer for Internet browsing and listening to music.

Easy desktop distros are, for instance, Ubuntu (mainly for its wide hardware compatibility and its ease of installation) or Linux Mint (mainly due to its familiar GNOME interface).

If I were to define in a few lines the Linux distributions as I see them today, I would say:

Ubuntu 11.04, Mandriva, Linux Mint is for real beginners
Fedora 15 and Slackware 13.37 is for skilled geeks
Puppy Linux 5.2.5 or Xubuntu 11.04 (based on Xfce) is better for installation on older hardware
Linux Mint 11 or Ubuntu 11.04 is good for your home computer
Jolicloud 1.2 or MeeGo 1.2 is good for your brand new Netbook
Debian 6.0.1 is for sysadmins
OpenSUSE 11.4 is the right one for office automation
CentOS 5.6 is good for enterprise servers and web servers
Ubuntu Studio 11.04 or PureDyne 9.11 is for your multimedia station and for creativity

None of these distros is perfect, but they will fulfill various purpose, as you will learn using them. Picking a first Linux distribution to use isn't always easy so I have chosed for you: install Linux Mint 11. The reason for this choice is that Linux Mint is the Linux distribution of the moment, having just pushed Ubuntu (and its Unity interface) out of DistroWatch’s No. 1 spot.

So, let's start the installation. The CD, 64-bit version, which you can download from here, contains the Ubuntu's Ubiquity installer, which then can guide the user through the permanent installation process.

The following procedure is going to be executed in a VMWare environment (specifically on a Proliant DL370 G6 running vSphere 4) where I have configured a new virtual machine with the following settings:

1024 MB of RAM
2 CPUs
a video card with 16 MB of video RAM
a controller LSI Logic SAS
a small 8 GB virtual hard disk
a E1000 network adapter

Let's now see all the steps to install Linux Mint 11 in a Virtual Machine.

Choosed Virtual Machine version 7 for ESX 4.0

Select Linux kernel 2.6 for Linux Mint 11

Configure virtual processors

Specify the amount of RAM - I suggest 1 GB for the 64-bit version

Add a virtual network adapter

Add a LSI Logic SAS adapter, improved for virtual machines version 7

Create a virtual hard disk drive

Choose the size of your hdd

Attach the hdd to a SCSI virtual device

Review your VM configuration

Once your virtual machine is ready, mount the 64-bit ISO of Linux Mint (filename: linuxmint-11-gnome-dvd-64bit.iso) and start the VM. Linux Mint will load as a Live-CD and be ready to use withing two minutes as you can see from the following screenshots.

Linx Mint preparing to load

Casper generating an initramfs capable to boot live systems

Linux Mint 11 running from the CD

At this point you have to click on 'Install Linux Mint' to shift to quit the Live CD and start the real installation process. Beware, if you are trying to install the 64bit version and configured your VM with just 384 MB of RAM, you could get an error message saying "MINTMENU has quit unexpectedly". If so, just increment the amount of RAM for the VM up to 1 GB and this problem will be solved. Some Linux distros are not so light as they say... If you have a PC with so little RAM then you should use 32-bit version... or go for PuppyLinux.

Once you click on 'Install Linux Mint' the process will effectively start the installation.

Choose your language

Double check your basic configuration

Allocate drive space

Ready to install

Choose your time zone

Configure your keyboard layout

Configure your user account

Wait for the installation process to complete

While waiting discover how you can run Windows software in you Linux Mint box with Wine

Restart and disconnect the ISO image

Welcome to Linux Mint 11

Once the installation is completed you might have to configure your LAN connection in order to fully use your new Operating System. Nothing easier on Linux Mint thanks to the easy interface. Click on the lower right network icon and select 'Edit Connections'. Set your IP address and confirm by entering your account password.

Edit Network Connection

Enter your IP address, netmask, gateway and DNS servers

Confirm... Ehy, but this looks so much Windows UAC, guys!!!

Now that you are on the network if have to face the last big step: configure VMWare Tools! This is a little bit more tricky than with a Microsoft Windows virtual machine. In the main menu of the VMware Console, click Inventory, Virtual Machine, Guest and select "Install/Upgrade VMware Tools". This action will mount the image of the DVD containing the file VMwareTools-.tar.gz.

VMwareTools-8.3.7-341836.tar.gz

Extract the source archive to /var/temp then open a Terminal and navigate to /var/temp/vmware-tools-distrib. Once there run

sudo ./vmware-install.pl

The Perl script is very friendly although very chatty. It asks questions, with default answers already selected. Just read and then hit 'Enter' each time you are asked to.

Running vmware-install.pl

The script will end with the following message:

The configuration of VMware Tools 8.3.7 build-341836 for Linux for this running
kernel completed successfully.

You must restart your X session before any mouse or graphics changes take
effect.

You can now run VMware Tools by invoking the following command:
"/usr/bin/vmware-toolbox" during an X server session.

There we are. The basic installation of Linux Mint in a VMWare environment is completed. The system is ready to entertain you.

Enjoy and leave a comment if you have found this tutorial easy to use or if you want to share any customization, hint or improvement to this procedure. Feel also free to suggest packages to install to make the system smarter.

Unix joke

2011-06-27T08:20:00.000-07:00

Having just published a joke about Windows Drag & Drop feature, I feel obliged, in fairness, to publish a funny joke about Unix/Linux OSes too:

Unix admin asking for a sandwich

I hope you like it! :-)

Drag and drop...

2011-06-27T08:08:00.000-07:00

I really couldn't resist publishing this funny joke about Windows most known feature: drag and... drop!

A Windows admin troubleshooting Windows 2008

Windows sysadmin will surely understand! :o)))

Clean up Winsxs on Windows 2008 R2 after SP1 install

2011-06-18T01:18:00.000-07:00

Last year I wrote a post where I explained what the Winsxs folder was and which were the possible solutions to contain its bad habit of eating free space on your hard drive. Some days ago I have discovered that, starting from Service Pack 1, Windows 2008 R2 (... and Windows 7) finally has a built-in tool to reduce the size of the Windows Side-by-Side DLL repository and free up some GBs on your server storage. This tool is DISM.exe.

Cool news isn't it? Personally I am happy to know that someone at Microsoft has finally decided to make it possible to reclaim a few GBs on the system partition and to partially solve this major bug.

The procedure is the following:

Install Windows Service Pack 1 then ...

Start and elevated command prompt (run 'CMD' as administrator) and ...

Run the DISM command, which replaces the old VSP1CLN and COMPCLN we used on previous Windows versions: DISM.exe /online /Cleanup-Image /spsuperseded

Wait 10 minutes before the task completes ( it ends with “Service Pack Cleanup operation completed. The operation completed successfully”)

Normally you should have been able to reduce the Winsxs folder size by 1 or maybe 2 GBs, sometimes more. Saved space may vary a lot.

Just know that after using DISM you will not be able to uninstall the Service Pack 1 anymore.

Let's have a look at the used switches for DISM.exe:

The /online switch tells DISM to work on the running OS installation

The /spsuperseded option removes the backup files created during installation.

Optionally you could use the /hidesp option which will remove SP1 (KB976932) from the “Installed Updates” section of Programs and Features, to ensure that users do not try to uninstall the Service Pack.

I hope this helps. Please let me know how much disk space you were able to free up using the given command.

Using Ethtool to configure your nic on CentOS

2011-06-10T08:02:00.000-07:00

We are introducing a certain amount of CentOS computers and I am often asked by regional IT people how they can check and change the configuration of their network cards to reflect the configuration of the attached network Switches. That made me think of this post (my first one on CentOS) in which I will explain how you can determine the current Ethernet connection link speed of your CentOS system.

To do that you can take advantage of ETHTOOL, which is an easy utility that can be used to display and/or change settings of your Ethernet Network cards.

In the following example I will assume that you are willing to change the parameters for your first network card (usually eth0).

The syntax to show the NIC parameters is very simple, just enter:

ethtool eth0

and look for the Speed parameter:

Supported ports: [ TP ]

Supported link modes: 10baseT/Half 10baseT/Full

100baseT/Half 100baseT/Full

1000baseT/Half 1000baseT/Full

Supports auto-negotiation: Yes

Advertised link modes: 10baseT/Half 10baseT/Full

100baseT/Half 100baseT/Full

1000baseT/Half 1000baseT/Full

Advertised auto-negotiation: Yes

Speed: 100Mb/s

Duplex: Half

Port: Twisted Pair

PHYAD: 1

Transceiver: internal

Auto-negotiation: on

Supports Wake-on: g

Wake-on: d

Current message level: 0x000000ff (255)

Link detected: yes

Other interesting parameters you could have a look at are the Duplex mode and the Auto-negotiation mode, of course. But, before you can configure this two parameters, you have to better understand what they are used for. The difference between Half-duplex and Full-duplex is straightforward. In Full-duplex communication, the two systems can communicate with one another in both directions at the same time. On the contrary a half-duplex NIC provides also communication in both directions, but only one direction at the time (not simultaneously I mean). Auto-negotiation is an optional Ethernet function that enables devices to automatically exchange information over a link about Speed and Duplex capabilities.

To force your NIC to 1000mb in Full-Duplex and the same time turn off Auto-negotiation on 'eth0' just enter:

ethtool -s eth0 speed 1000 duplex full autoneg off

To disable Auto-negotiation and switch back to Half-Duplex enter the following command:

ethtool -s eth0 duplex half autoneg off

You can play with all these parameters as long as you like until you find the network performance that best suits you. Just remember that under CentOS any change made through the command line is lost at the next reboot. To make the changes permanent, edit your network card configuration file which is located under the /etc/sysconfig/network-scripts directory. Inside this folder, each interface will have a file called 'ifcfg-ethX'. So for 'eth0' look for the file 'ifcfg-eth0' and add the following line to force your card to transmit at 1Gbps:

ETHTOOL_OPTS="autoneg on speed 1000 duplex full"

If you don't have ETHTOOL, know that it can be downloaded from SourceForge.

Here's the possible switches you can use with ETHTOOL for your reference:

-a queries the specified ethernet device for pause parameter information.
-A change the pause parameters of the specified ethernet device.
autoneg on|off: Specify if pause autonegotiation is enabled.
rx on|off:Specify if RX pause is enabled.
tx on|off:Specify if TX pause is enabled.
-c queries the specified ethernet device for coalescing information.
-C change the coalescing settings of the specified ethernet device.
-g queries the specified ethernet device for rx/tx ring parameter information.
-G change the rx/tx ring parameters of the specified ethernet device.
rx N Change number of ring entries for the Rx ring.
rx-mini N Change number of ring entries for the Rx Mini ring.
rx-jumbo N Change number of ring entries for the Rx Jumbo ring.
tx N Change number of ring entries for the Tx ring.
-i queries the specified ethernet device for associated driver information.
-d retrieves and prints a register dump for the specified ethernet device. When raw is enabled, then it dumps the raw register data to stdout.
-e retrieves and prints an EEPROM dump for the specified ethernet device. When raw is enabled, then it dumps the raw EEPROM data to stdout. The length and offset parameters allow dumping certain portions of the EEPROM. Default is to dump the entire EEP-ROM.
-E Changes EEPROM byte for the specified ethernet device. offset and value specify which byte and it’s new value. Because of the persistent nature of writing to the EEPROM, a device-specific magic key must be specified to prevent the accidental writing to the EEPROM.
-k queries the specified ethernet device for offload information.
-K change the offload parameters of the specified ethernet device.
rx on|off: Specify if RX checksumming is enabled.
tx on|off: Specify if TX checksumming is enabled.
sg on|off: Specify if scatter-gather is enabled.
tso on|off: Specify if tcp segmentation offload is enabled.
-p initiates adapter-specific action intended to enable an operator to easily identify the adapter by sight. typically this involves blinking one or more LEDs on the specific ethernet port.
N Length of time to perform phys-id, in seconds.
-r restarts auto-negotiation on the specified ethernet device, if auto-negotiation is enabled.
-S queries the specified ethernet device for NIC- and driver-specific statistics.
-t executes adapter selftest on the specified ethernet device. Possible test modes are offline|online
-s option allows changing some or all settings of the specified ethernet device. All following options only apply if -s was specified.
speed 10|100|1000 Set speed in Mb/s. ethtool with single argument will show you the supported device speeds.
duplex half|full Set full or half duplex mode.
port tp|aui|bnc|mii Select device port.
autoneg on|off Specify if autonegotiation is enabled. In the usual case it is, but might cause some problems with some network devices, so you can turn it off.
phyad N PHY address.
xcvr internal|external Select transceiver type. Currently only internal and external can be specified, in the future further types might be added.
wol p|u|m|b|a|g|s|d... Set Wake-on-LAN options. Not all devices support this. The argument to this option is a string of characters specifying which options to enable.
p Wake on phy activity
u Wake on unicast messages
m Wake on multicast messages
b Wake on broadcast messages
a Wake on ARP
g Wake on MagicPacket(tm)
s Enable SecureOn(tm) password for MagicPacket(tm)
d Disable (wake on nothing). This option clears all previous options.
sopass xx:yy:zz:aa:bb:cc Set the SecureOn(tm) password. The argument to this option must be 6 bytes in ethernet MAC hex format (xx:yy:zz:aa:bb:cc).
msglvl N Set the driver message level. Meanings differ per driver.

I hope you found reading this post useful. If so, please do not hesitate to tell.

DFS Target refers to a location that is unavailable

2011-06-09T07:44:00.000-07:00

Today I have encountered a strange problem with some of my Stand-Alone DFS Targets. Many users using old Windows versions, such as Windows XP pre-SP2, were no more able to browse DFS file shares after I had updated some referrals to reflect an infrastructure change (new folder targets) happening at my company.

The funny thing is that most of the end-users running Windows XP SP2 or Windows 7 had no problem at all in browsing the DFS links from their Windows Explorer.

This problem pushed me to dig inside DFS behavior, design and architecture more than I hadn't done any time before.

After checking that no alerts where reported Server-side, I went to one old XP box and tried to browse the DFS \\dfsserver\root\link. The error I got was a generic "\\dfsserver\root\link refers to a location that is unavailable"...

I then tried to map the DFS link using the good old "net use", hoping for a error code a little bit more specific... but all I got was a "System error 2 has occurred The system cannot find the file specified".

I closed my eyes five seconds, waiting for inspiration and then the first thing that came to my mind was a DNS problem, but I was wrong. I was wrong because I was able to resolve and ping the DFS server as well as the real file server hosting the data. I was also able to access the fileserver directly without passing through the DFS name resolution. The fact that I could access the target path told me also that wrong NTFS permission were not the cause of the problem.

As I always do when I meet weird communication problems, I fired my good old Network Monitor for Windows 2008 (ah yes, DFS server is running on a Windows 2008 Server). After one minute spent putting in place the required filter based on the IP address of the test PC running Windows XP, I started a Network Capture.

What surprised me was that I wasn't seeing the XP box coming in and asking to the DFSSVC the referral target as I had expected. It looked clear to me that some sort of cache had stored the wrong referral target somewhere in the Windows meanders and that the PC was stuck with this wrong old information.

I know that windows uses a Multiple UNC Provider (best known as mup.sys) which stores in memory (yes, not in the registry, nor on some file on the disk) the information about the redirectors used, be it a DFS path, a WebDav path (such as a SharePoint library) or a SMB path.

Inside MUP there are different caches. Concerning DFS, there is one cache for type of distant resources (webdav, dfs or smb) and one cache for referral targets. This last cache, known as PKT (Partition Knowledge Table) Cache or Referral Cache, stores (for as long as defined in the DFS link configuration) the DFS target.

The standard TTL for a DFS target in the Referral Cache is 30 minutes (1800 seconds) but in my configuration the TTL is 300 seconds.

DFS TTL set to 300 seconds

So, I imagined that the problem was with the PKT cache not being properly flushed. But why this problem was happening on old Windows XP SP1 clients and not on Windows XP SP2 or Windows 7 clients it was still a mystery to me.

Not knowing how to proceed, I tried to launch the only existing tool that could give me an insight of the MUP cache: dfsutil /pktinfo... but, unfortunately, this executable was missing from my test XP computer. At that moment my understanding was that Windows XP systems have a MUP cache for DFS targets but they have no built-in tool to check its content. Cool isn't it?

I said myself that if I restarted the Workstation service the MUP cache would be flushed... but I was wrong this time too, as the PKT Cache stayed untouched. I thought that if I could restart the Windows XP box the problem could get solved, but I didn't want to go straight to that point and confirm all the bad hype about Windows like "Windows has detected that you have moved your mouse, please restart...".

So I decided to drop a visit to technet.microsoft.com and after some wandering in their huge document library I found out the following sentence:

"For DFS clients that are not running Windows XP with SP2 or Windows Server 2003 with SP1, the Time to Live for a referral determines the earliest time that a client will request a new referral, but only if the existing referral expires before it is accessed again. Clients that use a cached referral will renew the Time to Live of the referral and thus use the referral indefinitely until the client’s referral cache is cleared or the client is restarted. This behavior has changed for clients running Windows XP with SP2 or Windows Server 2003 with SP1. Specifically, the Time to Live value is not reset each time a client accesses a target using a cached referral. Instead, the referral expires after the Time to Live value lapses. This change has several effects:

Clients running Windows XP with SP2 or Windows Server 2003 with SP1 will request referrals more frequently than other DFS clients, which can cause moderately increased load on the domain-based DFS root servers and domain controllers.
Because they request new referrals more frequently, clients running Windows XP with SP2 or Windows Server 2003 with SP1 will discover namespace updates more quickly than other DFS clients. "

So this was a really good piece of information. The behavior of the cache had apparently changed with XP SP2 and I should be able to reset the PKT cache on older systems just rebooting. Ok, but this was not a solution to me, just a workaround.

I was a little stuck here. Therefore I decide to fetch the Windows Support Tools for Windows Server 2003 then to copy dfsutil.exe on the XP workstation and view the contents of the referral cache by using the famous /pktinfo switch. As imagined, the PKT cache was still keeping the old referral in memory. I decide to run a dfsutil /pktflush to forcibly flush the Referral Cache and the problem was immediately solved.

Notwithstanding the fact that I have found a workaround I still don't know what to do at enterprise level to flush the MUP cache of all the Windows XP clients. I will keep investigating for a solution to this problem and if I can get any real solution I will update this post. Meanwhile I will tell people to restart their Windows XP clients, or to update them to Windows 7 if they fell like they long for a better designed MUP cache...

If you are a DFS expert or if you are a Desperate Sysadmin and have encountered this same problem, please do not hesitate to share your hints, findings and, hopefully, solutions. Microsoft people are obviously invited to say something too.

Here a few links I have found interesting to read while investigating:

Closing network files on a remote fileserver with PSFile

2011-06-06T07:34:00.000-07:00

These days I am migrating some data from our old network file server to a new network storage. The plan is to migrate one folder at the time, and I have found out that in such a situation it can be useful to know how to to close all the open files in a specific directory before migrating in order to evite open files conflicts.

As I do not want to migrate all the data at once (this would be pretty much unpractical with so many gigabytes of data), I cannot simply adopt the solutions of shutting down or restricting access on the fileshare for everyone.

PSFile.Exe from SysInternals is our best friend in this case. Using this small utility, it is possible to retrieve all the open files in a given remote directory and close them altogether.

This is the way it should be used:

psfile \\fileserver.yourcompany.com "t:\folder\subfolder" -c

This command will close all open network files which match the expression "t:\folder\subfolder" on the file server \\fileserver.yourcompany.com.

The output will look like this:

Closed file t:\folder\subfolder\testfile1.xlsx on fileserver.yourcompany.com.

Closed file t:\folder\subfolder\testfile2.docx on fileserver.yourcompany.com.

Please note that when you close file handles based on their path, it is important to know that if the path contains spaces, it must be enclosed in quotes, like I did ("t:\folder\subfolder").

Let's have a look at the details of this operation.

When running psfile \\fileserver.yourcompany.com "t:\folder\subfolder" -c PSFile does connect to the remote fileserver through its IP address and asks the remote System process (PID: 4) to enumerate the open handles on the BasePath t:\folder\subfolder. The used protocol is a poorly known Server Service Remote Protocol (SRVS), which is a remote procedure call (RPC)–based protocol that is used for remotely enabling file and printer sharing and named pipe access to the server through the MSRPC, SMB2, SMBOverTCP and finally TCP protocols.

The method used to enumerate the open handles is NetrFileEnum, which returns information about some or all open files on a server, depending on the switches used with PSFile.

The fileserver answers to NetrFileEnum with a NetrFileEnum Response indicating the number of entries (read: open files) found. In the SRVS network packet each open file is inserted in a Coni1UserName variable which contains the open file path and the corresponding owner (the person who actually remotely opened the file).

So, for each open entry, PSFile starts a new MSRPC binding to the SRVS Service and sends out a NetrFileClose Request indicating the FileId to close, to which the fileserver answers with a "ReturnValue: 0x00000000 - ERROR_SUCCESS - The operation completed successfully" message.

The SMB2 session is then closed, the files are unlocked and the migration can be accomplished without ever getting any "The process cannot access the file because it is being used by another process" error message.

Here's the complete syntax for PSFile for your reference:

PsFile lists or closes files opened remotely.

Usage: psfile [\\RemoteComputer [-u Username [-p Password]]] [[Id | path]

-u Specifies optional user name for login to remote computer.

-p Specifies password for user name.

Id Id of file to print information for or close.

Path Full or partial path of files to match.

-c Closes file identified by file Id.

Omitting a file identifier has PsFile list all files opened remotely.

We could have also locally used "net file ID /close" but that would require us to log on the fileserver and to manually enter the file ID, which would take a bit more work because the operation should be repeated for each file.

I hope you enjoyed this article. Do not hesitate to leave a comment if so!

Taking file ownership

2011-05-30T03:25:00.000-07:00

There are many reasons you could need setting file and folder ownership on a Windows file server. In my case I had to take care of the file ownership because I have been migrating our users' home folders to a NetApp volume with user quotas set. A quota is intended to limit the amount of disk space and the number of files that a particular user or group can consume. As far as I have understood, Netapp quota application mechanism is not based on home folders size but, and this is new to me, on real file ownership.

In fact, as stated on the NetApp website, quota calculation of NTFS qtrees is always allocated to the user’s Windows SID. This means that the NetApp is aware of all the files that belong to a user no matter where they are located on the volume. So, even if these files are scattered about your file system and not located in a single place, the NetApp will be able to tell you exactly how much space is allocated to a Windows user (through his SID) via the "quota report" command.

Unfortunately, in my case I had robocopied all the contents and ACLs from our old Windows file server to a brand new NetApp filer and discovered that the NetApp wasn't reporting any user quota. This is due to the fact that I did not had copied the owner flag when I used Robocopy and so the filer reported that every file was owned by builtin\administrators... and that no user quotas where enforced...

File ownership tab under Windows Security

After a short investigation I found out that I had to re-apply correct file onwership for the filer to be aware of real user quota usage.

So, lets see which is the option I've chosen to set file ownership when Robocopy had already been done. For its simplicity I decided to use Fileacl.exe which is a wonderful tool when you have well learned its syntax. You can find it here and it is free...

To change the ownership with Fileacl use the following command line:

fileacl.exe "\\netapp\drive\users-home\billy bob" /O "your_company\Billy BOB" /sub /files

The /O switch gives ownership to the trustee (it requires TakeOwnership privilege - use "whoami /all" to check you have it). Using the /sub switch will force Fileacl to run through all the subfolders and the /files switch will ensure that ownership is sent down to each single file.

So the output of this command will be: OwnerShip GIVEN TO TRUSTEE your_company\Billy BOB on \\netapp\drive\users-home\billy bob

Simple, right?

Of course I could have used powershell but in this case I was struck by the simplicity of Fileacl and decided to stick to it.

I hope this helps. Do not hesitate to leave a comment on this post if it was useful to you!

Critical Patch for ESX and ESXi 3.5 Hosts

2011-05-23T06:39:00.000-07:00

If you are the happy owner of ESX or ESXi 3.5 boxes, the time has come to apply a specific patch to your hosts in order to be able to continue updating these after June 1st, 2011.

The patch is not exactly the same for ESX or ESXi hosts.

For ESX apply patch ESX350-201012410-BG as indicated here. This patch for ESX hosts is a small one with a size of 11KB and it does not require you to reboot anything.

For ESXi, the situation is different. You have to install a bigger (238 MB) patch (found here) named ESXe350-201012401-I-BG and to do so all the VMs on the ESXi host must be shutdown or migrated to another host. A reboot of the ESXi host is also mandatory.

Again, this patch MUST be installed to continue patching hosts after June 1st, 2011.

Welcome to a virtual world with physical reboots.