What is VPN and How does it Works

Background

at some commitment of recent clients I faced the problem of creating a large number (100+) of Provisioning services 6.1 XenApp 6.5 based target devices with their write cache placed on the local SSD storage of a VMware vSphere 5.1 host. One might think that this would not be a complicated task, so just make a copy of your master machine of the target device with a second disc placed on SSD storage, converting it into a model and use this model with the assistant Provisioning Services VM configuration StreamD create machines to vSphere. Easy huh? No, because I learned that the PVS wizard does not allow me to use models that include drives hosted on local storage vSphere Hypervisor. This behavior can not be changed easily.

Creating machines by hand via VMware vCenter is not possible to their high number. In addition, they must be evenly distributed on all respective hosts for Dynamic Resource Scheduling (as it is called by VMware) will not work because of local storage. Second step would be to create entries corresponding target devices in the collections of the PVS instrument which would also be time for such a large number of machines.

So when it comes to script a solution. Using three different SDKs (VMware Power CLI, MCLI Provisioning Services and PowerShell module to gain access to Active Directory management) required functionality can be achieved. Scripting the whole process also gave me the opportunity to include a step that should be done manually anyway: move workers XenApp computer objects in two Active Directory groups to monitor the XenApp machine reboot cycle. For reasons of availability, it was always expected that 50% of servers in a PVS site (two sites created for two data centers) will restart every 2 days. So dividing the XenApp machines for this type of restart behavior could also be easily reached by PowerShell scripts

The following process has been implemented :.

1. Interrogate the XenApp vSphere cluster to the host with the smallest number of VMs
2. Determine the free following name for the new virtual machine based on a defined naming convention
3. Create the virtual machine with the drive on the local SSD storage
4. Create the entry of the target device in PVS via MCLI
5. Create the computer object in active Directory common OR
6. Add the computer object for the proper restart group

Sons not complicated, but there were some things to consider that could easily be found in any other client deployment. The vSphere cluster used was a stretched cluster including hosts two data centers in an active / active configuration. To fairly distribute the target devices in the two location data centers host interviewed had to be determined. However, this could not be easily done by a host naming convention, but rather by a custom attribute vSphere client has defined for guests to view the location. So this attribute query is the only opportunity to obtain the correct location for vSphere hosts. Another challenge is to cope with Active Directory response times to create computer objects via MCLI. The following commands to add the computer object often failed to restart groups so I had to implement a short cmdlet that verifies the existence of the newly created object and pause the script as long as the subject does has not yet responded to exist.

Scripting the whole process

prerequisites that must be installed on the machine running the scripts are:

• VMware PowerCLI
• Provisioning Console services (to access MCLI commands)
• Windows Server 08R2 Feature - active Module Directory for Windows PowerShell

script is quite long, so I'll just cover some important excerpts here, you can try to fully adapt script attached below.

Query the XenApp vSphere cluster to the host with the smallest number of VMs

First, we receive all cluster hosts, sort them depending on their location (DC1 and DC2) and calculate the number of currently deployed on each host machine:

 $ hosts = $ bunch |  Get-VMHost  connected -Etat | Select Name, @ {N = "NumVM"; E = {@ (($ _ |  Get-Vm )) Count}}, {L @ = "Location";. e = {$ _. CustomFields | {$ _ Eq Key 'Location'.} | select the value -ExpandProperty}} | Sort Place HostVMsDC1 $ = $ host | or {. $ _ "DC1" -eq $ HostVMsDC2 Location} = $ host | where {$ _. "DC2" -eq Location} 

is an example for the host DC1 with fewer machines on it. Based on what we need to get the name of the local database to create the virtual disk. For the request for local datastores attribute MultipleHostAccess is used which is always set to false for local datastores. $ UsedHost finally designates the host we use to create VMs DC1:

 $ LeastHost = $ HostVMsDC1 | Sort NumVM | -First Select Datastore $ 1 =  Get-VMHost  -Name $ LeastHost.Name |  Get-Datastore  | ? {(. $ _ Eq Type "VMFS") -and ($ _ eq $ ExtensionData.Summary.MultipleHostAccess False.)} | Sort Name | -First Select UsedHost $ 1 =  Get-VMHost  -Name $ LeastHost.Name 

Create the virtual machine

 $ taskTab [( New-VM  -Name $ vm_name -VMHost UsedHost -template $ $ $ Datastore folder template -Datastore $ -Location) .ID] = $ vm_name 

After creation, we increase the counter for the number of virtual machines on that host by (we do not question the number of machines for all guests every time for performance reasons):

 $ HostVMsDC1 | Where {$ _ eq $ LeastHost.Name name.} | {Foreach. $ _} ++ NumVM 

We will also need the MAC address for the creation of the target device in PVS

 $ MAC =  Get-NetworkAdapter  $ -VM vm_name | ForEach-Object {$ _ MacAddress.} | -replace% {$ _ '', "-"} 

Add the target device to its collection of devices and create a computer object

  Add-MCLI  -r deviceName unit = $ vm_name, collectionName = $ collection = $ siteName site_1, deviceMac = $ MAC, $ description = description, copyTemplate = 1  MCLI-Run  AddDeviceToDomain deviceName -p = $ vm_name, organizationUnit OR = $ 

Addition of 50% of each machine a different data center restart groups

the cmdlet custom test XADComputer (see attached) test scripts for the existence of an active computer object Directory. In case the object does not exist sleeps the whole script for an amount of time and continues when the object is created and finally reported to exist:

 do {sleep 5  Write -Host  "." Until} ( Test-XADComputer  $ vm_name) 

The newly created machines to a data center are also distributed to restart groups so that According to the configuration of Citrix restart policies filtered to these two groups only 50% of servers will restart every day. The Get-ADComputer and Add-PrincipalGroupMembership cmdlets are part of the Directory PowerShell module

 if (vm_count $% 2) { Get-ADComputer  $ -identity vm_name |  Add-ADPrincipalGroupMembership  $ -memberof Reboot2  Write-Host  "Restart Computer object added to group $ Reboot2"} else { Get-ADComputer  $ -identity vm_name |  Add-ADPrincipalGroupMembership  $ -memberof Reboot1  Write-Host  "Restart Computer object added to group $ Reboot1"} 

I hope this script can be useful if you encounter similar difficulties when implemented and show what can be achieved by taking advantage of our really powerful SDKs (and other) products 😉

here you can see the whole script, bold settings must be adapted to your environment:

 @ "============ ===================================== ============= ============= ============= Title: CreateTargetDevices with disk on the local SSD storage and imports the devices in Citrix PVS Author: Thomas Fuhrmann version: 1.6 use :.  CreateTargetDevices.ps1 Date: 04/06/2013 ====================================== ============ ====================================== "@

Are you raising the bar for innovative IT mobility, virtualization, networking and cloud computing technologies? Do you have a fascinating history of implementation, best practices or creative solution to share? We want to hear! Submit your proposal speakers for Citrix Synergy 2014, May 6-8 in Los Angeles, California, across the subjects of the appeal process. You might be selected as a session presenter escape and enjoy some well-deserved time in the spotlight.

We hear that Synergy participants valuable technical content and dynamic speakers with diverse viewpoints put the conference differs from other events. That's why we invite guest speakers chosen by our group of independent experts to present their stories to the public Synergy

So -. What types of presentations are participants Synergy ask? Although extreme views and pioneering examples are cool, sessions offering practical advice and best practices for planning, design and implementation are in demand. In other words, participants want to hear how to get projects completed on time, within budget and with excellent results

Examples of potential topics in four solution categories :.

• Mobile: mobile application and device management, application stores, mobile security, collaboration, mobile data access, BYOD and Workshifting
• virtualization :. Desktop and application virtualization, Windows app migration, VDI, client virtualization and RDS
• Network: .. network virtualization, networking software defined , disaster recovery, security, application and multi-tenancy in the private and public clouds
• cloud :. infrastructure cloud and solutions and technology management to use in mobilizing IaaS, PaaS and SaaS

The selection process

All submissions will be judged by a selection committee of analysts, the professional business of IT and other opinion leaders industries. They will be looking for relevant content, innovative and technically rich. sales pitches and marketing hype will not go beyond them. The strongest arguments will include demonstrations and real-world examples - and a speaker with a solid presentation of experience

Meet our judges :.

• Shawn Bass, Solutions Architect, ShawnBass. com
• Stacy Crook, Program Manager, Mobile Enterprise Research, IDC
• Rick Dehlinger, Chief Technology Officer, nGenX Corporation
• Juergen Heinrich, Chief Technology Officer, KIVBF
• David K. Johnson, Senior analyst, Forrester
• Suresh Nagarajan, Director, information technology, Centene Corporation
• Alan Pawlak, head of service to customers, Aetna Inc. .

Dazzle those judges with your memory, you could be part of the agenda of the session Synergy! In addition, the main presenter of your session will receive a free full conference pass.

Submit now!

The appeal due submission Topics is midnight, Monday, December 2, 2013, so do not delay. We will have a microphone, a stage and an attentive audience waiting to hear from you!

and be sure to follow me on Twitter @merisummers for updates to content Synergy.

With each new version of XenDestop comes the inevitable changes to the SDK large enough so would not it be nice if we quickly and easily view the changes ie check what new applets were added and what cmdlets were removed between XD releases?

Of course, the answer is yes and this is something I watched this week as I began to prepare the release of training for XD7 .1.

Through the provision of training, I wanted to be able to inform our support engineers on the changes to the SDK and highlight all that I find particularly useful. With time in short supply, I wanted to do it quickly, but also have fun ...

Example: Tracking Changes to cmdlets available between XD7 and XD7.1 TP

Step 1 .

Export the complete list of cmdlets for each Citrix XD text file version using the following commands :.

get-command -module citrix *> c: xd7cmdlets.txt

get-command -module citrix *> c :. Xd71cmdlets.txt

Step 2.

Use Notepad ++ to remove any unwanted columns so you just left with the NAME column in each text file:

notes : for this you will need to maintain Alt while selecting content the file to delete do ...

Click on screenshot to see the picture

Step 3.

Use a file comparison tool to compare the differences between two files. I prefer to use a tool called WinMerge - It is open source and freely available

Once installed, you can select two files to compare and click OK :.

At first glance, you will notice obvious differences in the listed applets, but the view is pretty crowded and the comparison is not very easy to achieve the cmdlets are not identical ordered:

click screenshot to see the picture

to solve this problem and control applets click correctly on change - options and modify Whitespace settings Ignore all and click OK

Click on screenshot to see the picture

After Whitespace setting was set to Ignore all the cmdlet order will be set correctly and it becomes very easy to compare and see what cmdlets were removed (if any) and what new applets have been added with the 7.1 update to the SDK:

Click for screenshot see picture

now that you know what cmdlets have been added you can now dive in and take a look at the POSH integrated help files to see what these applets are all about.

Why not try to go further and see if you can find all the amendments to the detailed help files for the entire SDK? It will take a little more work and understanding of how to use WinMerge, but it might be worth the effort, especially if find little gems like -Force switch is now available when resetting the DB connection strings.

Note: To export the SDK Inc. complete folders full assistance using the following commands :.

get-command * -module citrix | Get-Help -full | out-file c :. XD7help.txt

get-command * -module citrix | Get-Help -full | out-file c: XD71help.txt

Best regards
Mick Glover (aka Tipster XD)
Senior Specialist of preparation,
Worldwide support [EMEA]
Citrix Systems, Inc.
Follow @xdtipster

Curing of a server system is an omnipresent topic. We all tend to provide the most secure environment (hopefully) to reduce the amount of possible attacks on the system. One measure is applicable to the limitation of user access to the system. There are several ways to restrict user access, but in most environments I've seen, Active Directory group policies were used to achieve this. In addition to prohibiting access to prompt and control of Windows registry, there are thousands of other parameters that could be applied because of safety requirements or user.
As probably known all policy settings configured under "User Configuration Policies Administrative Templates" are applied in the registry hive of the user under "HKEY_CURRENT_USER Software Policies" and "HKEY_CURRENT_USER Software Microsoft Policies ". Unlike other paths of the user registry, the user has full control generally, these registry trees are configured with read-only permission for the user. This fact ensures that the user can not modify the settings applied.

But there is a simple function (actually two) that can be used to easily avoid all of your user group policies configured and use all the applications the user has access to unless the appropriate NTFS permission was deleted

runAs and Run as different user

with the command "runas / user :. domain user application " or the use of" Run as different user "from the context menu of applications (shift + right click) can be started with different user credentials. So far so good, but you're wondering what these functions actually do?

RunAs and "Run as different user" allows a user to launch an application with different user credentials. When one of these functions is performed, authentication occurs and a new process will be created with the specified user account. Unless nothing defined, the user profile, or a temporary profile will be loaded. As this procedure does not include a typical user logon process no political groups of users will be applied and there are few other footprints next to the profile and the registry hive user under HKEY_USERS.
You can double -check that by opening the Task Manager. You can find the correct process running with the specified user account, but the user will not be listed in the menu Users Task Manager. In addition, there will be no Group Policy settings listed in the registry hive of the user in HKEY_USERS SID user or temporary profile Software Policies or Software Microsoft Policies.

And that's the point! This circumstance allows a user to work without any user's policy, namely the likelihood of attacks increases. The user account is a normal user on the system and NTFS permissions still apply to the user. These two factors continue to complicate the possibility of harm to the system. Nevertheless, some doors are open now, and a clever user could take advantage of this situation.

Before continuing with the article, I would like to stress that the use cases, as well as additional explanations and recommendations are related to a user session. The purpose of this article is to restrict users while administrators retain access to this feature.

Imagine the following case use. One of your users is to have two accounts to Active Directory users, which is very common that many users have a normal and a test account in the same field. Both accounts are local users on the system and use RunAs or "Run as different user" is not prohibited. The user is connected with the normal account and is now using the second account to start a program with the RunAs or "Run as different user" method. In these circumstances the user would be able to start any program, it has access.

How to prevent access to programs

In my view, the only way to do the right restriction of application is to use the rules AppLocker or other third-party tools. In general, I recommend to my clients to use AppLocker rules, because they are free and offer the flexibility to configure the restriction to suit your needs. All resident AppLocker settings under "Settings Application Control Policies Computer Configuration Policies Windows Settings Security" and therefore all configurations are applied in the registry under "HKEY_LOCAL_MACHINE Software Policies Microsoft Windows SrpV2". Thus, with the AppLocker RunAs and "Run as different user" method will not work because all the settings are applied on the computer and are not related user.

If you are not willing to use AppLocker rules for any reason, you can always limit the RunAs and "Run as different user" function by removing access.
In the early days, it was very simple. Withdrawal of the authorization of the user from runas.exe was enough to completely restrict access to both functions. But since the release of Windows Server 08 R2, the "Run as different user" command has changed and is not based on more Runas.exe. You must perform two steps to completely remove the RunAs and "Run as different user" functions:

1. Restrict access to Runas.exe. There are two ways to achieve this:
a) Configure an AppLocker rule and deny access to C :. Windows System32 runas.exe to the appropriate user groups
b) delete the user authorization from C: Windows System32 runas.exe

2. The second step is to remove the entry "Run as different user" from the context menu. For this you must remove the following registry key
HKEY_CLASSES_ROOT exefile shell RunAsUser
HKEY_CLASSES_ROOT batfile shell RunAsUser
HKEY_CLASSES_ROOT cmdfile shell RunAsUser
HKEY_CLASSES_ROOT mscfile shell RunAsUser
HKEY_CLASSES_ROOT Msi.Package shell RunAsUser
(This change will affect administrators as well)

Even if you have already restricted access to the application using AppLocker rules or another third tool, I still recommend to delete the entry context menu to provide the safest possible solution.

If you are still looking for a simple way to limit access to functions for everyone (administrators and users), and then disable the Secondary Logon service (thank you Martin for Latteier the entrance).

Let's take a last look at risk management. I agree that this is a rare scenario. However, it is essential not to underestimate the internal danger and its possible negative impact on the system. As you can see, there are only a few steps before you to reduce exposure to risk. I recommend you implement the steps outlined above to ensure the safety of high system.

I hope you have enjoyed reading.

Best regards

Saša Petrović

Introduction

I am writing this on a desktop running Windows 7 computer as a virtual machine on a XenServer pool running a pre-release version of XenServer. XenServer in engineering this system is known as Xenia. It is an example of a so-called system "dog-fooding", whereby members of teams of engineers who create a product are also using this product in their daily work.

Citrix has a long history the use of its own products, usually in one of two ways: as an iT company led the deployment shipping versions of products such as Citrix XenApp, NetScaler, CloudBridge or CloudPlatform, or more local deployments within the engineering teams, often pre-releases. Xènia is an example of the latter. It is managed by the QA team XenServer for use by members of the XenServer engineering group.

empathy

the main objective of Xenia is to provide staff with an overview XenServer in XenServer experience of our customers. in other words, to obtain a measure of empathy with our customers. to do this we need the firsthand experience deploying and administering production XenServer running in the pool live workloads that matter to people. We also want to understand the impacts of our product quality, performance, stability, etc. on the experience of the end user.

We run two pools of XenServer, one containing the latest version of XenServer GA updated with all patches, and a current version of pre-release of XenServer. Various workloads that are essential for the XenServer product group are run on these pools, including virtual desktops. Although Xenia not use a full XenDesktop deployment (RDS or VDI), he re-use the office "brokerage" virtual functionality of XenDesktop to provide easy access to the persistent virtual machines. The members of the XenServer product group are encouraged to use these virtual machines as the main office for the day-to-day, whether in the office or outside.

QA tool

As mentioned earlier, a Xenia key objective is to provide the XenServer product group with an overview of what it takes to administer the pools production XenServer. Our QA team possess Xenia and as such gain experience of installing, upgrading, hotfixing and generally maintain a system of production and supply of a service based on it. Their findings are injected into the maps decisions XenServer, bug tracking and product improvement proposals.When new version of XenServer is imminent, we improve one of the pools to use the new version, validating the upgrade path the previous version of XenServer, and expose the newly installed candidate built for live use and therefore, essentially in real time soak test. When a new patch for the latest version of XenServer GA is imminent, the final validation step is to apply it to the appropriate pool to ensure it runs successfully the first.

Basically, although the system is managed by QA XenServer, members of our development teams and product management are often involved in administrative tasks such as upgrades. We want as many members of the group of products as possible to get a better degree of empathy with our customers, not only end users, but system administrators as well.

Of course, an additional advantage of Xenia is that, by its very nature, it is a living system that must operate 24 × 7. This gives us a degree of soak test that complements our existing tests but more static automated soak. Xenia has various capacities for surveillance and control built into it, including the detection of memory leaks, with more planned (including the use of 3rd party integrated tools for XenServer). This makes Xenia A powerful element of our integration (CI) Suite continues. Examples of defects found by Xenia, before liberation is a nasty bug upgrade from XenServer 6.1 and 6.2 caused by the addition of a new piece of VM metadata, permissions various faults and problems of use.

Citrix Interop

Xenia is run by and for the group of XenServer products and focuses on XenServer largely isolated from other Citrix products.

One of the inspirations for Xenia is another "inner dog-fooding" system known RTST ( "Real Time stress test"). This was managed by our colleagues in the XenDesktop product group for a number of years, providing XenDesktop virtual desktops and XenApp running on a variety of different hypervisors.

The engineering team also manages a XenServer deployment Citrix CloudPlatform on XenServer.

Summary

XenServer personal gain empathy with the experience of the administration and use of XenServer through our use of an internal deployment XenServer with live workloads and strategic to our customers.
results are returned as defects and requests for product improvement, or more generally as context to maps decisions.

即将 过去 的 2013 年 无疑 将 成为 Citrix 技术 创新 方面 的 大年, 众多 关键 技术 都 将 呼之欲出, 并 在明年 的 市场 上将 形成 欲罢不能 的 局面 究竟 有 什么 看点, 客户 和 合作 伙伴 们 需要 重点 关注 如下.

Citrix 的 虚拟 桌面 方案 是 "以 用户体验 为 核心 "这 一点 可以 从 我们 设计 和 实施 一个 项目 的 过程 和 工序 中看 出来.需求 分析 和 架构 设计 过程 中 的 核心 环节 有.用户 调研, 应用 调研 和 FlexCast 发布 模式 匹配 设计;都 清晰 地 体现 出 Citrix 解决 方案 的 优势 和 独特 性 这 和 其它 厂商 宣传 的 "虚拟 桌面 只 需要 一个 稳定 的 后台 足矣" 的 口号 形成 了 鲜明 的 对比, Citrix 同样 注重 稳定 的 后台, Citrix 但 更 注重具有 综合 发布 能力 和 完整 统一 控制力 的 虚拟 桌面 架构 本身, 更 注重 该 基础 架构 核心 中 的 核心, 那 就是 "业务 应用 和 最终 用户"

单一 VDI 方案 的 缺陷 是 显而易见 的.

用 其 Citrix FlexCast 综合 发布 技术 可以 自信 地 应对 任何 虚拟 桌面 项目 的 业务 场景, 用户 场景, 发展 场景, 运 维 场景 和 成本 场景.可以 因地制宜 的 成为 企业 用 的 起, 管得住 和 扩展 的 了 的 方案

言归正传: .. 本文 提供 的 干货 是 "XenDesktop 7 最佳 实践 手册" Citrix 全球 顾问 咨询 团队 版 该 宝典 是在 XenDestop 6.x 的 基础 上 发展 来 的.对 即将 推广 的 有 指导 意义 XenDesktop7.请 前往 下载, 阅读 和 领悟 Citrix 的 精髓.

[Show as slideshow]

此书 的 下载 地址: http: //support.citrix.com/article/CTX139331

Overview

The first part of this article (you should read first if you have not already), I found some interesting results from a deep commitment scalability testing we recently completed a major customer. And I'm sure some of the results are you scratching your head a little ... and maybe you had questions like I did, first as:

• Why 4 vCPUs was chosen as the spec VM? Citrix and VMware does not always recommend 2 vCPUs for XA?!?
• Why do we have only 130 users on each physical host? Andy The article written a year ago said that we should expect 192 users with this material and a medium workload?!?
• Why do we only-commit "half" of the total available CPU (ie 24 vCPUs)? If you are not always use all logical vCPUs available in the box (ie 32 vCPUs)?
• How did NUMA factor in this particular test? Why NUMA same issue at the high sizing VMs these days?
• Why do users "work" much less than we think? (Kidding ... I stay away from it!)

If you have more questions than that, feel free please leave me a comment below. But let's address the above questions first.

CPU Over-Subscription

Whether or not you use 2 vCPUs, 3vCPUs, 4 vCPUs, 6 vCPUs, 8 vCPUs (or another number) for each VM XA is a more difficult question that really requires testing and understanding of NUMA (and I'll get to next). But a question best addressed first is how much CPU oversubscription should you do? It is easier to explain with an example ... so remember for this particular test we had a box with a CPU configuration "2 × 8" (which is kind of my slang for 2-socket and 8-core per socket). And remember we enable hyper-threading. So we have 16 "physical" processors or cores and 32 "virtual" processors or logic. And most people refer to what pCPUs 16 and 32 vCPUs. So the question is do I deploy enough XA VM to use 16 processors, 32 processors or somewhere in between? The short answer is somewhere in between and most of the time the best "sweet spot" will be a report oversubscription of 1.5: 1 meaning 24 vCPUs in this case . So I could deploy 12 XA VMs on each host if I am using a specification of 2 vCPUs, or 6 XA VM if I'm using a specification 4 vCPUs, or perhaps only 3 XA VM if I'm using a specification 8 vCPUs. You basically want the math to add up to 24 vCPUs in case you did not take it. Now the question ... why use a 1.5: 1 oversubscription ratio or "split the difference" between pCPUs vCPUs and generally the best sweet spot? For that, look at some more detailed results of our test, then we will do our best to interpret the data.

We tested different ratios using oversubscription LoginVSI to find the optimal sweet spot. To keep things simple, I will provide test results with 4 vCPUs VM configuration. So in summary, we tested 4 XA VMs, VMs 6 XA and XA 8 VMs (again, while using 4 vCPUs) to see if the use of 16, 24 or 32 total processors give the best results. The VSI Max score for each test was 119, 130 and 122, respectively. Meaning that the 6 XA VMs with 4 vCPUs test resulted in the optimal density while maintaining a user experience (which is measured by LoginVSI in a ton of different ways in these tests). Now the question becomes WHY made the 1.5 :? 1 oversubscription ratio "win" or give the best results

This sort of sense if you think about it. When using only the 16 physical cores in the box, you really do not enjoy hyper-threading (which should give you a bump in performance of 20-30%). So in this scenario with a 1: 1 oversubscription ratio, you really are not making full use of the box. On the other hand, when we try to use the 32 virtual cores in the zone, we stress the CPU scheduler too, so it has an effect of decreasing returns. Remember, hyper-threading only gives you a 20-30% performance increase ... not 100%. In addition, we save some resources (CPU cycles) for the CPU scheduler in ESX itself - the process of determining which logical CPU to place the workload cycle following comes not "free." So in this scenario with a 2: 1 oversubscription ratio, we are really hammering the box and it is not the optimal configuration to be. That's where split the difference between the amount of pCPUs vCPUs and made a lot of sense and really shines - leaving us some valuable resources for the scheduler itself, but we are also taking advantage of hyper-threading. And do not believe me - believe the data ... the scenario with a 1.5: 1 oversubscription ratio gave the best score VSI Max

Another thing I wanted to share is not the first time. I saw this oversubscription ratio yield the best results. In fact, one of our most important partners in industry (which makes the software EMR / EHR) always recommends 1.5: 1 oversubscription ratio And they did more testing with LoadRunner on a variety of hardware configurations than anyone I know. And this test, we did not really validated these results

Now what that means 1,5 :. 1 oversubscription ratio should always be used? Not necessarily. It depends on the participation rate, the hardware, the version of the hypervisor and programmer, etc. For example, I could find a sweet spot slightly different if my participation rate is 50% compared to 85% ... if my equipment is a 4 × 6 versus a 2 x 8 ... if I am using XS versus VMW. The sweet spot might be 1.7: 1 or 1.25: 1 ... and the only way to find out is through proper testing with a tool like LoginVSI or LoadRunner. But what I say is that if you do not know or do not have time to test, then using 1.5: 1. CPU oversubscription ratio for XA is my recommendation

NUMA

It always amazes me how many people do not know what NUMA is or care to understand how it impacts the design of exercises like the one we do. And that is not specific to the XA workload - this concept applies to all levels and you need to consider when virtualizing all NUMA big workload server such as Exchange, SQL, etc. Now I will not explain what is NUMA detail in this article, as it has been done 100 times before the Interwebs. But, it is synonymous with Non-Uniform Memory Access and I want to consider it as "keep things local". The idea is pretty simple - when you have a box with multiple sockets, each socket has local memory it can access very quickly ... and remote memory (on the other taken through a connection bus or inter-socket) that it can access without a goal so quickly. And if the CPU scheduler of a hypervisor is not "aware NUMA" as some say, then bad things can happen - we could be sending processes and CPU Remote son or memory, as opposed to the local CPU or memory. And when we do that, it introduces some latency and ultimately affects performance (user density in the case of XA). How much of an impact on the performance NUMA can really have? We did a study on this a few years ago when we introduced support for NUMA in Xen and it was a success ~ 25% on the user density! Which means we could get 100 users on a box without NUMA awareness ... and 125 with the consciousness of NUMA. Quite significant. Fortunately for you and me, all major hypervisors these days are NUMA aware. This means that they understand how the hardware is configured in terms of underlying NUMA nodes and scheduling algorithms are optimized with NUMA in mind. So it's fantastic - but what the heck does that mean and how do I dimension XA my VMs? 😉

Notice I said above "underlying NUMA nodes" - what do I mean by this is really important things, believe it or not, all Intel chips?. are not created equal. And not all sockets have just one (1) underlying NUMA node. what i mean is a plug with 8 cores (as in our example), could actually be divided into multiple nodes NUMA underlyings. each outlet with 8 cores could probably 4 NUMA nodes, 2 NUMA nodes or one NUMA node. and if the decision is divided into nodes say 4 NUMA, each node has its own "local" resources CPU and memory that it can access the fastest. - in this case, 2 cores each if it is divided into two nodes, each node would have 4 cores each instance, the concept of NUMA concerns not only with multiple socket boxes .... it also applies within each outlet or die! So the next obvious question is how do you know that the NUMA configuration underlying is for equipment that you bought (or are considering buying hopefully!)? Well, there are tools like Coreinfo you can run on Windows operating systems ... and there are commands like info xl -l 'you can run on Xen or " numactl -Hardware 'you could run on Linux. And those spit all sorts of good information on the CPU in the box, but especially the NUMA configuration to help you understand where the "limits" NUMA lie. If you do not want the CLI, you can simply ask the seller or the manufacturer (Intel ... or HP, Dell, IBM, Cisco, etc.). Sometimes the material data sheets even on there. But I can tell you from experience that some years ago, the catches were almost always divided into multiple NUMA nodes. Today (ie the new Intel chips), they are divided less or perhaps not at all. This is one reason why we have always recommended 2 vCPUs per VM XA back in the day - because most of the boxes we were using at the time was 2 × 2 × 2 or 4 and each box quad-socket has been divided into two nodes, respectively (each with 2 cores each). So 2 vCPUs was really the sweet spot and led to optimal performance on older chips / boxes. But fast forward to today ... and catch the last boxes are not divided as much or they are divided into much larger knots. So you might get a 2 x 8 and each socket has only one node, which makes super-awesome and easy to the size of things. I'll explain why it's great to side

XA VM Spec -. How vCPUs

So now that you know a thing or two? about NUMA (and if you're still fuzzy on this, I highly recommend this and this article - they explain it better than me), can you guess what the NUMA configuration underlying was on our box 2 × 8 used in our tests? Well, since I have already said that you 4 vCPUs gave the best results, you might assume that every shot is actually composed of two NUMA nodes within them (with 4 cores at their disposal each). And when I first heard this, I immediately looked up the specific Intel chip we used in the Dell boxes (because I am under the impression that they were newer Intel processors and they would therefore not be divided into multiple nodes in each socket), and of course, we use Intel chips were about 2 years (to 2011). It was therefore logical. But chances are if you buy hardware today with the latest Intel chips, sockets will probably have a single node. And if you have a box that is a 2 × 8 with a single NUMA node in each take, then chances are you'll get linear scalability with 8 vCPUs assigned to each VM XA. Let's dig in a little bit more ...

To better illustrate the concepts of "thrashing NUMA" and "linear scalability," we will again look at the practical results of our tests. To keep things simple, assume that we use a ratio of oversubscription of 1.5: 1 for all three of these scenarios. We wanted to test 2, 4 and 8 vCPUs (with 12 virtual machines 6 and 3, respectively) to see if the underlying NUMA nodes were really a factor and if things brought to the linear scale or not. We achieved a VSI Max score of 125, 130 and 0, respectively. So how should we interpret these results?

Well, these results tell me the difference between a 2 vCPUs and 4 vCPUs VM spec is almost negligible ... and things linear scale (ie we get about 10 users per VM XA with 2 vCPUs and 12 GB of RAM and 20 XA users per VM with 4 vCPUs and 24GB of RAM). And what is really expected, knowing that all these virtual machines can fit well in each NUMA node and are not cross the border NUMA. But what happens when we have larger virtual machines with 8 vCPUs and they do not fit well in these NUMA nodes each with 4 cores? This is when we have to use local and remote resources between NUMA nodes or even made ... or maybe the planner is moving things too often try to compensate locality ... it could lead to something called " NUMA thrashing ". And what that means thrashing NUMA scalability for XA and what we do? This means that latency increases, the planner hungry more often and it results in the density of users quite poor. In our case, it meant not to scale even close linearly - took about a 30% drop in performance when switching with 8 vCPUs XA specification VM! The moral of the story is to try to the size of your VM as a multiple of the NUMA node size of your physical host.

And another fun fact, I wanted to mention this note ... if you have a box 2 × 6 (still popular) and is composed of NUMA nodes each with 3 cores .. . then using a VM XA specification with an odd number of vCPUs could really give the best results! So while 3 vCPUs XA VMs may sound weird ... NUMA is why some people might recommend that apparently spec particular VM. Go with 2 or 4 vCPUs could actually cause more thrashing NUMA and worst response time and user density (and this has been tried and tested by several of our major health care clients, I might add!).

a word about business and LoginVSI Ratio

I know this article is long but stay with me because there one thing I want to quickly address if I can - and that is why we have "only" get 130 XA users on each physical piece of hardware (compared to the number 192 we get there a year on apparently same piece of hardware). Well, this has to do with the new default value or the average workload Login VSI 4.0 (the latest shipping release). The scalability tests that Andy and his team conducted a year ago (and even guys HRV project made it a few years ago) were performed with LoginVSI 3.x ... and the "normal" or average at the time workload was fairly well ... medium'ish! The script was much shorter and less intense. Fast forward to LoginVSI 4.0 and the script is much longer and more intense. In fact, a colleague and I did a quick test and the average bandwidth used by one user was around 260 kbps with the new script v4! And the script is "active" (inactive against) nearly 0% of the time !!! I do not know about you, but I would not say this as a typical worker XA task or even a medium / normal user ... that, to me, is a heavy user that works way more than the average bear. I really hope LoginVSI take this feedback to heart and change their script - most average users still XA 20 kbps today and most of the users' work 'about 50-60% of the time ... so it' is what really skew the numbers in our test with LoginVSI 4. once we have introduced more time to rest (sleep) and "softened" a little test script, we were magically get nearly 0 users box. Again, it is up to you to ensure that simulate what your users are doing - shame on us for using the average script or default comes with the free version of LoginVSI

UPDATE DAY: LoginVSI handed it to me after the publication of this article and let me know that they have some of that documentation on page 9 of their new v4 Upgrade Guide. But it seems they tested XD (versus XA) and only found that the new script increases the use of 22% CPU. It's still a lot, but I think more like 33% in my tests. LoginVSI also reflected on the change in their average workload by default and I will meet in November to discuss further. Good stuff ... cheers LoginVSI listen to our comments and one for the Community!

Wrap-Up and Key takeways

, which was a long article ... I know. So I'll try to summarize main points

• If you can not do tests to find the optimal CPU oversubscription ratio, "split the difference" between . the number of vCPUs and pCPUs
• do not forget to take into account NUMA when sizing your VMs XA - if possible, go with a multiple of the size of the NUMA node of the physical host
• not. be afraid to go with bigger XA specifications, such as 4 or 8 vCPUs each. on the latest Intel chips, we see a linear scalability or even slightly better scalability with the major characteristics VM! and it also means fewer Windows OS license costs and much less overall to manage virtual machines !!! this is a great advantage that I kind of failed to explicitly mention above. I know a customer that can 800 XA manage VMs with 2 vCPUs each - they are now running 0 virtual machines with 8 vCPUs
• Do not be afraid to use an odd number of vCPUs for your XA VMs - on a box 2 × 6, 3 vCPUs could be the best bet. About 2 × 10 boxes with newer procs E7, 5 vCPUs could be better if the industry is divided into two NUMA nodes within them. Or maybe you use 10 vCPUs each and set vNUMA if you use VMware (a topic for another day, but see page 42 of the last vSphere 5.5 WhitePaper best performance practices for information on vNUMA and 8 vCPU VM + ).
• Be careful with the new default / average workload that ships with LoginVSI 4.0 - it is quite heavy and can skew your results by that 22-33%! This means that you could really buy too much equipment -. It is always best to customize your workload or test script to match what your users really are