Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Wicaeed
Feb 8, 2005
Doing an inplace upgrade from 4.1 to 5.0 is actually extremely simple. It's been a few months since I did it on 3 of our hosts, but it worked fine each time.

I can't remember if you have to recreate your vm storage from scratch to upgrade it to vmfs5 though

Adbot
ADBOT LOVES YOU

Wicaeed
Feb 8, 2005
It might be a long shot, but does anyone here use GhettoVCB as a temporary backup solution?

My workplace runs three ESXi servers all running the latest release of ESXi 5.0 Update 1.

We had GhettoVCB in place until we installed the latest patch, which seems to have broken it.

The last time GhettoVCB ran it stalled when removing the snapshot after successfully backing up a host.

So far I've been unable to find much of anything online relating to this problem, which leads me to believe that perhaps not-so-many people are using GhettoVCB any more.

What would you guys use for a free, automat-able backup solution for ESXi?

Wicaeed
Feb 8, 2005

Corvettefisher posted:

Wow I can't believe I just found this out...
http://www.veeam.com/virtual-machine-backup-solution-free.html
Might help some people here

I just found out that they don't "officially" support Free ESXi either. As of 5.1 it wont work at all because Vmware has removed all of the backup API's from the free version.

Fuckers.

Wicaeed
Feb 8, 2005

Corvettefisher posted:

Yeah but is 560 MSRP for the essentials kit really that bad? I mean you get VUM and vCenter + licencing for 3 hosts.

Wait it's only 560 bucks? :psyduck:

Why was I under the impression it was ~5 grand for the Essentials kit? Holy gently caress we could have upgraded MONTHS ago :suicide:

Wicaeed
Feb 8, 2005

Corvettefisher posted:

Essentials PLUS is 5 grand, that gets you the vmotion and HA
http://store.vmware.com/store/vmware/en_US/DisplayProductDetailsPage/productID.233860600?resid=UFoBZAoBAlkAABEFtT8AAABo&rests=1348075876336
I am sure a reseller will have it a little cheaper.

Nice little matrix here, with pricing at the bottom


Also anyone running 5.1 on Windows Server 2012? I realize quite a few companies in my area have expressed that they are skipping the 2012/8 lineup and staying with 2008 r2. Will post results.

Wait so Essentials doesn't include vMotion? Haha gently caress that noise. Does it still allow you to one click-xfer offline vm's to another host or is it all manual?

Wicaeed
Feb 8, 2005
So, quick question on some of the features included in the vSphere Essentials kit:

I know that it doesn't include any of the awesome features such as vMotion, Storage vMotion or the VSA, but does it include the ability to transfer powered off (cold) VM's to datastores on other VMware hosts in the cluster while keeping them thin provisioned?

Wicaeed
Feb 8, 2005
I've built up 4 test VM's for a new project on a subdomain of our parent domain. I am JUST now finding out about this stupid child-domain auth bug (which prevents authentication for accounts if you are in a parent domain) in the new VMware 5.1 Update 1 software.

Every fix that I've seen is for vCenter, and not standalone vSphere (currently running free license).

Does anyone know if VMware has provided a resolution for that product?

Wicaeed
Feb 8, 2005
Well, this bullshit is apparently related to our inept Network Administrators who take 3 days to create a firewall rule that doesn't work :cripes:

I log in as root and still get that error.

edit: I also blame VMware as they seem to be unable to create a straight forward document that simply lists the required ports for JUST the management access from the vSphere client to an ESXi server (NO I'M NOT RUNNING VCENTER PLEASE DONT TELL ME THE PORTS I NEED FOR VCENTER) :cripes:

Wicaeed
Feb 8, 2005
I just got approval for vSphere Essentials from my boss, for the loving first time ever someone listened when I said that running 40 physical machines that were in our test environment would be the perfect use case for VMware. :woo:

A question:

These 40 physical machines are broken up into 4 computer nodes, which all need to talk on separate private networks within themselves. Without touching on DV Switches and the like, what is the best way to manage separate private networks across multiple VMware hosts? As far as I know the easiest (and really only way) to do it is to create a new vSwitch that doesn't have any network adapters attached to it, and label it as you want.

Is there any better option?

Wicaeed
Feb 8, 2005

Corvettefisher posted:

You are correct, Virtual Standard Switches attached to NICs that are tagged or uplinks tagged to different networks.

Set servers that need to talk to each other(same network) on the same hosts, what you need to do is make Virtual Standard Switches bound to nics that. Using VMXnet 3 you will have 10gb/s second(assuming the CPU can accommodate).

haha dude, I wish I could use VMXnet3, however these servers run a very custom linux kernal. We are lucky that they had Intel E1000 networking support.

Wicaeed
Feb 8, 2005
Does anyone have experience with VMware's SSO?

I'm trying to give the web services a shot, however I'm noticing that I can't authenticate with my domain credentials. I checked the SSO Configuration tab from the web client and saw the following:



What would cause the configuration information to not even be present in the web client side? I'm pretty much straight from installing vCenter Server on a new Windows server after using the VMware vCenter Simple Install procedure.

I'm having a hell of a time finding any documentation on how to troubleshoot SSO, short of reinstalling it...

Wicaeed
Feb 8, 2005

Wicaeed posted:

...pretty much straight from installing vCenter Server on a new Windows server after using the VMware vCenter Simple Install procedure.

Indeed I did, which is the strange part. Most frustrating (in my mind) is that I can't seem to find any local components (other than restarting in services MMC snapin) to manage SSO from (if there are even any).

Wicaeed fucked around with this message at 05:09 on Jun 8, 2013

Wicaeed
Feb 8, 2005
Quick vCenter Licensing question:

Are there any license levels that allow you to simply hook up multiple, standalone clusters to a single vCenter server?

We have plans for three standalone VMware clusters running on vCenter Essentials kit (the cheap one), each running separate environments that don't really need any of the advanced management features. What I'm really looking for is the centralized management for security purposes.

Does VMware offer any vCenter licenses that would fit the bill, but at the same time not break the bank?

Wicaeed
Feb 8, 2005
Man VMware really likes to rape my wallet :(

Wicaeed
Feb 8, 2005
No, this is really just a "test" environment case, I just wanted to see if I could get around having to use three separate servers for vCenter for the three environments that I am building.

edit: If it wasn't clear, this is at a single site.

Wicaeed
Feb 8, 2005
Is there any advantage to the vSA?

What does it bring to the table that a cheap (Dell Equallogic) SAN doesn't?

Wicaeed
Feb 8, 2005
Are there still issues going on with vSphere SSO and child/parent domain ESX Admins group permissions not propagating correctly?

We have a child domain that the vCenter server is a member of, with members of the 'ESX Admins' being properly authenticated and allowed to manage the vCenter server/hosts. The parent domain, however, has no such luck. Even after I add the parent domain as an Identity Provider in SSO and assign it's ESX Admins group as a member of Administrators, members of that domain can authenticate, but the permissions don't work correctly and they cannot see any vCenter server at all.

I just went through all the pain (it wasn't really much pain :) ) to update vCenter to the latest release, under the assumption that these issues had been fixed.

Am I doing something wrong?

Edit: So I see what's wrong...when running the 'ssocli configure-riat --verbose -a discover-is -u admin -p password' command as a test, it finds the one local (child) domain, but it can't properly communicate with the parent domain. It knows about it, but all of the information it needs to add it as an IS is blank.

I was under the impression that the child DC actually contains a copy of the GC of the parent domain (which SSO could theoretically use as opposed to connecting directly to the parent domain), is that not the case?

I'll have to talk with our network guys tomorrow to see if we can open access to that DC and fix the issue...

Wicaeed fucked around with this message at 08:46 on Jul 9, 2013

Wicaeed
Feb 8, 2005
For those in the know, how quickly can VMware become prohibitively expensive?

I kicked off a virtualization initiative about three months ago when our parent company decided to come in with a project to build almost 150 new instances of their software for testing, without really giving us a lot of heads up. I'm not really sure what they expected to happen because A: we don't have the power, cooling or data requirements to actually put in 150 new physical servers and B: We don't have 150 new servers to put in for testing.

Fortunately we did have some spare hardware that I was able to build a new VMware cluster on, and spec it out quite beefily (192GB RAM per host in a 3 host cluster). For now we are running on the vCenter Essentials kit (the 500 dollar one), and the higher-ups (my boss) are quite impressed as to what we accomplished on such short notice. There is now an initiative to virtualize most of our office servers (maybe 20-30 other servers) when we rebuild our network.

I understand that it would be quite a leap for them to go from a 500 dollar-per-cluster cost ( we already have hardware, mostly), having not really been paying anything for virtualization at the beginning of this year (we had maybe five or six standalone vSphere servers running a total of maybe 50 VMs), to 3 (planned) standalone vCenter Essentials clusters (w/ 3 hosts each) running in the office.

I'm curious to find out how prohibitive the cost is to go from that single, standalone vCenter Essentials cluster at 500 dollars, to something that would support 3 VMware clusters running on a single vCenter instance. Do the Essentials kits even support upgrading/adding on licenses that would allow you to add hosts or would you have to start at vSphere Standard and start using the scalable licensing?

Wicaeed fucked around with this message at 16:33 on Jul 11, 2013

Wicaeed
Feb 8, 2005

Unfortunately that doesn't tell me anything about the cost to actually use the option to add an additional CPU license, while I'd assume that it's (hopefully) less than the cost of a new vCenter Std instance, I'd be nice to know that ahead of time.

Wicaeed
Feb 8, 2005
Has anyone seen issues with VMware Round Robin path selection when using two separate paths to a single switch?

I have a small setup with two PowerConnect 2724 switches acting as the networking for my VMware cluster, and they both connect using separate (single) interfaces to a Force10 S50 switch. On the S50 switch I have a disk array that has a 4 port Port-Group configuration using LACP. I've tested this using Windows Server 2008 R2 MPIO when directly connected to the Force10 and I get transfer speeds approaching interface maximum (when using Windows MPIO each gig link is at 99% utilization).

My VMware servers, however, have a strange issue, that even though they have separate paths to the Force10 switch, when Vmware Round Robin load balancing is active, I get ~40% of my usual link speeds (for a ~80% utilization overall). When I disable one of the paths, I get almost 100% utilization.

Wouldn't it stand to reason that because there are two separate paths, I should show at least some improvement in the network xfer speed over a single 1Gbit link?

I've attached a graph that shows this.



I'm tempted to say the issue is these switches, but it's just extremely weird behavior that I've never seen before.

Wicaeed fucked around with this message at 03:52 on Aug 17, 2013

Wicaeed
Feb 8, 2005

luminalflux posted:

vSphere 5.5 is released :toot:

Now to wait until others have discovered all the upgrade issues before upgrading myself.

What are the SSO requirements for the new client, or is the vSphere client now replaced by a web ui that uses single accounts still?

Wicaeed
Feb 8, 2005
Does anyone know what might have stopped an otherwise well behaved vCenter server from displaying performance information for a SAN disk? I get the disk space stats just fine, but when I go to load any performance related information from the 'Datastore and Datastore Clusters' tab, I get a 'Could not load data' error across all performance information and performance information time periods.

Wicaeed
Feb 8, 2005

Mierdaan posted:

Probably this bug. You can view Realtime stats, but not historical stats, right?

Yep, that was it. Strange that it's not a 'bug' per se but more of a feature.

Who in the hell thought it would be a good idea historical storage performance logging to just go *poof* at some random time in the future after you build a vCenter server? Kind of makes it hard to estimate your growth....

:psyduck:

On to other topic:

Our company has been beset recently by quite a number of security breaches. 90% of these breaches are coming from an old/insecure network that we are trying to move off of as fast as we can. The fact that we can only move off of the network as quickly as we can procure new hardware is killing us.

The fact is, our company hasn't quite embraced virtualization for our production environments. A few months back I (and a few members of my team) saved the company a ton of money by virtualizing a project that our parent company in Beijing dropped on our lap with almost no warning. Well, that's not quite true; We had some warning, but the scope of the project that they gave us completely blew away any expectations that had been previously set. Long story short we spent a small amount of money to allow us to max out some spare HW and purchased a vCenter Essentials Plus license, enabling us to create something like 100 new VMs in a relatively short amount of time. Without virtualization, we would have had to buy 100 physical machines with almost no warning.

Fast forward to last week, and we've just dropped another small amount of money to max out another 3 servers to finish the project that I mentioned previously.

Battling me every step of the way has been our Network Manager/IT Manager. This guy is somewhat of a 'Security Buff' (he has been tasked with securing our NEW network so that it doesn't get jacked up like our old one did), only his idea and my idea of security don't exactly mesh together. This guy considers almost every aspect of virtualization to be a security vulnerability or flaw. Something about the fact that you have shared storage (ideally) with servers running in (potentially) the same memory sticks (!?!) rubs him wrong. vCenter is a four letter word to this guy. His number one job (it seems to me, probably unfairly) has been to try his damnest to make my teams job (Infrastructure Ops) harder to do. /rant

The most frustrating part about this is that we aren't in a government/SOX/HIPAA/PCI environment, and I KNOW that people in those areas have securely taken advantage of virtualization . It's just our intellectual property (which admittedly has been stolen in the past) that he is concerned about.

What I'm asking is this: Does he have a valid point? Can VMs running on the same host (or storage, or memory, or whatever) be exploited in any way to access the shared resources of another VM, and is it hard to do? The same goes for vCenter. I've tried my hardest to secure it to the best of my ability (firewall, only allowing local login to certain user groups, breaking out ESX Admins into separate groups and creating privileged groups for different teams) but it just doesn't seem to be enough for him.

ehnus posted:

Is there any (legal!) way to get the web client without shelling out for vCenter?

Also (iirc) you don't NEED to use the vSphere Web Client unless you are using the newest Virtual Machine hardware version, at least for now.

Wicaeed fucked around with this message at 11:02 on Nov 20, 2013

Wicaeed
Feb 8, 2005

Nukelear v.2 posted:

VM Escape exploits occasionally show up. For the more paranoid you group your VM's in like security zones and don't share hosts/storage between them, i.e. DMZ, Trusted. I used to do this, but have since stopped.

How do they keep breaking in? 'New hardware' won't really do much for security unless it's say buying a firewall cause this whole network is in public address space.

"New Hardware" in this case is rebuilding everything into a new network that has proper firewall rules in place, with separate physical networking since we have no idea what has been compromised.

The team that created the first network (our company is relatively new, founded in 2008) were a bunch of fucktards that had no grasp of security.

Wicaeed
Feb 8, 2005
I got an email from a coworker today complaining that one of our services was running a bit slow, so I logged into our vCenter server and saw this

Just for giggles, this host has only 16 logical processors (2x Quad Core E5620):







:cripes:

According to my coworker, the 8vCPU configuration of some of the VMs was recommended by one of our Sr. SysAdmins whom I would rate as "brilliant". CPU utilization on the host has been running steady around 80%-90% for at LEAST a few months now and it also appears as if the workload itself is actually taking advantage of multi-threading, at least according to the VM CPU usage chart (each vCPU is showing around 30% utilized).

From my (non-VCP) understanding of CPU scheduling in VMware, the %Ready time is time that a vCPU spent waiting to execute a command, but was unable to because of CPU over provisioning. It also appears as if the %CSTP column would indicate that there is some vast over-provisioning going on here as well. Does a CPUs overall usage have any impact on the %Ready time, or is that specifically a performance metric that is impacted by the number of vCPUs on a host?

Also according to my coworkers, people (testers) have been complaining of slow performance of these machines.

I WONDER WHY

Wicaeed
Feb 8, 2005

Dr. Arbitrary posted:

I've read enough to know that this is bad, but I'm not 100% sure exactly why.
Am I close when I read this as there are 24 VM's, 16 vCPU's available. If you had provisioned 1 to each machine, it'd be splitting 16 vCPU's 24 ways, a bit of a stretch (or not?).
Instead, it's set up as needing 109v vCPU's, so those 16 vCPUs are way overburdened.

From my (albiet) limited understanding, it works somewhat like this:

IF the 24 VMs were all using roughly the same amount of processing power (each vCPU using 2GHz), and only had 1 vCPU assigned to them, then yes, there would be a serious contention of resources on this host, simply because there would not be enough available processing speed to service all those vCPUs. It's not actually something I've seen yet, but I think that the alternative case (many vCPUs being relatively underutilized) is a little worse, simply because you can think that "Hey my CPU usage is low, why are my VMs underperforming so much?! I know, I'll just throw more vCPU's at it to alleviate the problem!" and thereby making the problem a whole lot worse.

If a resource is unavailable to the vCPU when it needs it, this shows up in the %RDY column. The %RDY stat is really a measurement for the time delay between a hardware interrupt request and the time it was actually ready for execution by the physical processor, from what I understand.

Edit:

Just curious, but is it possible that by manually controlling the CPU affinity for each of the overloaded VMs to distrubute the load across all available physical processing cores, it would be possible to reduce the %RDY time?

double edit: haha nope, apparently you can't force a VMs workload to take place on two logical processors when it has 8 vCPUs.

Wicaeed fucked around with this message at 22:39 on Nov 21, 2013

Wicaeed
Feb 8, 2005
Haha it gets better, I got the following from my coworker. He wants me to change the following settings "To speed up the rate of memory exchange on host server":

Mem.ShareScanGHZ = 32
Mem.ShareScanTIme = 600
Mem.ShareRateMax = 32768
Mem.ShareVmkThresholdPct = 100

He's totally convinced that this problem isn't caused by CPU's being over-provisioned.

It's gonna be a long day.

Wicaeed
Feb 8, 2005
What's the general consensus on Xen vs VMware's price/features?

I have a coworker who discovered that the Free version of Xen offers many of the same options that the paid versions of VMware require a license for (HA/vMotion-esque transfers between hosts).

I'm mainly a VMware guy, and had hoped to get our company to start using it in our production environment, however the licensing costs required to use everything we want to use is quite high.

Wicaeed
Feb 8, 2005
Xenserver.

Its got the Citrix logo plastered all over it too.

What was the reason you switched?

Wicaeed
Feb 8, 2005
I'm about to take the dive into vCenter 5.5. The last time I did an installation was on 5.1 when I was running only two vSphere hosts.

Our current infrastructure looks like this (the 1 vCenter server is running on the Essentials Kit license):

6 vSphere hosts (3 running 5.1, 3 running 5.5 (not joined to vCenter atm))
1 vCenter server running 5.1

I've just purchased another Essentials Kit license for 5.5 for now. I think we have some plans to upgrade our Essentials license to a Std license sometime this year, but until then I need to make plans to make sure that if we do that, I can easily transition to a single vCenter server install.

Is it possible (and if so, how hard is it) to have a single Inventory collector for multiple vCenter installation?

Wicaeed
Feb 8, 2005

Dilbert As gently caress posted:

You can't upgrade essentials at this point and time. just FYI

IIRC you could upgrade Essentials with the vCenter Standard Acceleration Kit once in your business, or am I mistaken?

Wicaeed
Feb 8, 2005
Actually IIRC the price difference was quite big.

We actually were looking at it about three months ago (upgrading our vCenter server + licensing for 6 hosts) and the total cost was around 25k WITH support, which I think is quite cheaper than just straight up purchasing licensing+support.

edit: I just wish there was a licensing option that let us join more than 3 servers to a vCenter server, but didn't include VMotion :( It's not really something we need that badly in our test environments, even though we run like 200+ vms and 6 hosts.

Wicaeed fucked around with this message at 21:40 on Jan 13, 2014

Wicaeed
Feb 8, 2005
Well it's not really a requirement in our case, although it would be nice to have. It's really a case of management not seeing the advantage in ponying up $20k+ for a feature that isn't a requirement for our environment.

Since these are all these servers we can just spin them down/up whenever we want, however my difficulty comes from having to manage two separate vCenter instances, thereby doubling the amount of work I have to do in order to get performance info, check permissions, and do any other vCenter oriented work.

Wicaeed
Feb 8, 2005
Is it possible, using a single install of the vSphere web client and SSO client, to manage two separately licensed vCenter server installations?

edit: :woop: IT TOTALLY IS

Wicaeed fucked around with this message at 04:38 on Jan 23, 2014

Wicaeed
Feb 8, 2005
Is there any way to check which vCenter servers are registered an Inventory server?

Not finding anything in the VMware docs that would tell me this.

Wicaeed
Feb 8, 2005
So I'm having a problem with our vCenter server related to permissions.

I'm currently running two vCenter servers, one with the SSO/Web/Other vCenter services running, and the other with just the vCenter Inventory Service and vCenter server service running. It has registered itself to the other vCenter server that that it also shows up in the same Web session. Kind of a funky setup, but it's the only way I can get access to both environments from a single Web UI.

Both systems have the same permissions applied to them for obvious reasons.

There is an AD group with the Administrator role (Engineers), another group with the Power User (our Operations dept) role and another group with the User Role (people that I don't trust know how to do anything in VMware).

I've also put the vCenter servers themselves into folders, each with the No Access role assigned (on the folder itself) to everyone but the Engineers.

It worked for a while, but now I've come across an issue where NOBODY can adjust the networking on the vcenter servers.

The only way I can edit the current settings on the servers is to log into the local administrator@vsphere.local account and do it from there.

The permissions on the VM look like this

What the hell is preventing me from editing the network settings?

Wicaeed
Feb 8, 2005
Looks like it was actually being caused by a nested AD group actually.

Silly that SSO in 5.5 still can't handle those :rolleyes:

Wicaeed
Feb 8, 2005

madsushi posted:

Where are you getting that 100% number from? The guest OS? The guest OS usually can't tell what its actual CPU usage is and will often show 100% even when it's not consuming all of the CPU allocated to it.

Would that only be caused by resource scheduling or just a general rule of VMs?

Wicaeed
Feb 8, 2005
I'm going to be taking a trip in a week or so time, are there any good books on Openstack that anyone could recommend as reading material during my flight?

Adbot
ADBOT LOVES YOU

Wicaeed
Feb 8, 2005
Does anyone know if the vCenter SSO server natively integrates with RSA SecureID or can be made to?

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply