Virtual Geek

Even MORE reasons to run Oracle on VMware

If I told you that I could do something to make your most mission critical app:

• Perform better.
• Cost less.
• Have higher overall availaiblity.

…you would either: A) assume I’m a vendor trying to sell you something and write it off as such; b) assume I’ve made an error – and ignore my advice; c) investigate, and if you agree, you would consider that deployment model for the app.

Or, you’d be a person who likes “just keep it the way it is” SO much that you are willing to pay more, for less performance, and suffer more downtime.   Ergo, there’s something wrong with you.

Well – here you have it:   If you virtualize your Oracle environment on vSphere on EMC, it can perform better, cost less, and have higher overall availability.   Oh – I’ll throw in better agility through the test/dev/UAT/QA/Prod process while I’m at it.   This is what today’s news is about.

Caveat: Now, admittedly, I do work for a vendor, which by definition I work for someone who is in the business of trying to sell you something.   Our ongoing growth and success at EMC and at VMware (see Q2 results for EMC “EMC Reports Record Second-Quarter Revenue and Profit” and VMware “VMware Reports Second Quarter 2011 Results”) means that we’re doing it and providing value to our customers (thank you customers!).  

But, on the topic of mission critical apps being moved to commodity hardware and virtualized, I feel particularly passionate (and have posted on it here, here, and many other places) – and think the reasons people don’t move forward aren’t technical.   So – forget me as a vendor.  Go ahead and ignore what I say.   Here’s the voice of the customer:

“In a physical server model, cloning our production Oracle database configuration for test and development was time consuming, complex and expensive, leading to an inappropriate environment that was unacceptable.  Virtualizing our Oracle database servers with VMware vSphere® on EMC VMAX and EMC VNX storage system allows us to quickly create as many test and development environments as we need using the same virtual infrastructure in just minutes. In addition, virtualizing our Oracle servers has allowed us to leverage more Oracle instances per physical core with the possibility to run different OS and Oracle software versions on the same host, improving the return on investment in our Oracle software.  After the virtualization of Oracle with VMware, our staff was quite surprised to find that Oracle performed even faster as a virtualized application than it did before. I believe that Oracle runs 10 percent faster within a virtual environment. Our ability to virtualize Oracle has saved the bank hundreds of thousands of euro.” - Andrei Maier, System Architect of Swedbank.

Here’s another:

“Through virtualization of our mission-critical application environments, including Oracle, we have been able to consolidate from fifty physical servers to four VMware vSphere® servers, a nearly fifteen to one consolidation.  I can now deploy an Oracle test database in under an hour and have it ready to test the latest release of our banking application. Through the use of EMC DataDomain, we have achieved a de-dupe ratio of 20:1 during backups allowing us to scale our virtual environment cost effectively,”…“With our EMC and VMware cloud, IT has become an enabler of growth and services.   Accommodating this growth used to be a time consuming and expensive process. Now, we’re able to have server and storage resources ready in a few hours and with no additional cost, when in the past it took weeks. Our agility and responsiveness have improved dramatically.”…

On top of that, they also use VMware Site Recovery Manager and EMC RecoverPoint to support their virtualized Oracle environment – resulting in a much improved recovery time objective (RTO) protects the bank from downtime, taking minutes, instead of hours or longer, to switch over to the recovery location in the event of a disaster.   Remember – Oracle Dataguard is fantastic – but doesn’t provide end-to-end DR for the full app – and you need to protect more than just the database.

…“RecoverPoint with VMware SRM is a lifesaver,” Smithey states. “If I have a recovery situation, we just press a couple buttons and RecoverPoint and SRM do the job. And our IT people are the heroes.” Mark A. Smithey, Vice President, technology services at The Washington Trust Company.

I’ll give you one more:

“Before virtualizing, utilization rates were typically in the range of 15-20% for our Oracle database servers.  Since deploying VMware vSphere® on EMC Symmetrix VMAX storage platform we have almost doubled our server utilization rates through leveraging more Oracle instances on the same infrastructure, increasing our return on investment. In addition, migrating our Oracle database servers to the VMware platform and Linux has led to increased database performance and we can now leverage the functionality of VMware vSphere for faster server failover and high availability,” -  Haim Inger, Chief Technology Officer, CLAL.

So there you have it.   Note – each of the customers – in their own words – after virtualizing Oracle on vSphere (even before vSphere 5!) on EMC, they experienced:

1. Higher performance
2. Lowered costs
3. Improved availability

All these customer stories, plus new reference architectures validating these results and de-risking implementations, all pulled together with standardized services to help you in making a custom case for your environment is the news of the day.

Read on for more performance, best practices, details on licensing, and where to go for help…

VMworld 2011–Records will be broken.

I’m deep (DEEP) in the middle of VMworld 2011 plan execution at this point – with constant goings on.   

We’re holding a “VMworld 2011 Preview” with Bogomil (VP Product Marketing at VMware) on thursday where we’ll talk about some of the things going on, recommend sessions, suggest party/events.  

If you’re going to VMworld 2011 – check it out here.

But – one thing I wanted to tease on a little bit (because it’s pretty darn cool).   With vSphere 5, just like in the vSphere 4 run-up, we did a lot of work with VMware performance engineering to “push the envelope”.   I’m sure some of you noticed in Steve Herrod’s launch webcast the 4x jump in a lot of the core “monster VM” metrics.  

Well, as a teaser for the webcast, and a teaser to come to VMworld – if you want to see records broken….

 

And if you want to see more details on HOW it was done….

…then come to the VMworld 2011 Preview webcast (Thursday 11am ET), and absolutely come to VMworld 2011!

You can register at the link below which gets you the early bird rate (even though time is ticking)

“Hello World” - VMAXe

A busy week indeed… Tuesday, the vSphere 5 details being launched on the world.   Wednesday the most powerful, the most trusted, the smartest array – the EMC VMAX - gets it’s new smaller, simpler, entry-level sibling – the EMC VMAXe!

I wonder what Thursday will hold? :-)

The VMAXe has the same core design as a VMAX, very robust, very scalable, and uses the Virtual Matrix for a scale-out core design principle.

But, it’s also designed to be small, flexible, and designed for the needs of a market VMAX (and VNX) didn’t adequately serve, so has some engineered design changes:

• Designed for standard 19 inch racks (VMAX presumes bigger, VMAX cabinets)
• Designed standard L6-30R power drops  (VMAX takes 50A drops)
• Designed to be installed and in use in 4 minutes
• Scales to 4 engines (an engine is an HA pair of westmere based “brains”, so this is an 8-node “cluster” to handle all storage brains) vs. the 8 in a VMAX.   Remember that each “engine” is analagous to the clustered pair of controllers you see in most mid-range arrays.
• Integrated Recoverpoint Splitter for simple replication
• Focus on ease of use and simplicity throughout

We were fortunate enough to have VMAXe in my basement at Chad’s World – along with a great customer – Doug @ Columbia Sportswear – thank you!

Click on the below to check it out live and in action (and see the customer’s view)

Raising the Bar V = vSphere 5!

Ah – I always love this period :-)   Finally, I can speak freely about things that have been cooking for a long time (years!)   This may sound whiny, but it’s actually hard keep a lid on things this cool, to participate in the alpha and beta cycles, and to be one verbal misstep from getting the NDA police on you is not easy.  One gets good at the NDA tapdance….

Today, July 12th, VMware has launched vSphere 5 and the related wave of surrounding releases: Site Recovery Manager 5, vShield 5, and vCloud Director 1.5!  Note that the GA date is still a little out – but not much.

While I’m sure there will be broad and deep coverage across the blogosphere, Here’s my 2 cents.

You can also see EMC’s vSphere 5 launch site here: www.emc.com/vmware.   It has links to other content you might find useful.   Also remember that if you have any vSphere 5 questions that are EMC related – or ANY VMware/EMC questions – you can always go to the “Everything VMware at EMC” community at www.emc.com/vmwarecommunity

We’ve also updated the popular “Top 10: Why EMC for VMware” one-pager – which you can see here.

With vSphere 5 and the release wave there are 3 macro observations in my mind:

1. The room for anything to NOT run as a VM has shrunk to zero, or close enough that if you’re wasting time arguing about the fraction of a percent that isn’t a fit, you’re really wasting your own time.  Customers have been virtualizing their business-critical apps for some time, but there were always outliers.   An example is EMC’s own Oracle 11i apps.   With vSphere 4.1, we virtualized the whole app tier.  We also moved the database tier from Solaris to a 192-core Oracle 10g RAC cluster running on linux on Cisco UCS.  That project improved performance out the wazoo, and saved $5 million dollars (including lowered Oracle licensing costs).    And that was with the Oracle RAC DB still on physical hardware.   With vSphere 5, we are virtualizing that core Oracle 10g RAC cluster – we’ll be sharing our testing and project results at VMworld.
2. The path to cloud is even more clear.   Cloud (at least at the IaaS layer) is fundamentally about pooling resources, presenting that infrastructure with a multi-tenancy model, making the infrastructure API programmable, and exposing self-service portals.   vSphere 4.x did a good job of making CPU and memory into resource pools, and vCloud director 1.0 did a good job of making network pools and self service portals.   The gaps were that: 1) storage was NOT very “pool like” for many customers; and 2) vCloud Director lacked API completeness (as well as other v1.0 gaps).   With Storage DRS and Policy-Driven Storage in vSphere 5 and the updates in vCloud Director 1.5 – we have a huge leap forward.
3. The virtual world is fundamentally EASIER to secure than the physical one.   There are lots of enhancements in vShield 5, but there is no doubt that what people will latch onto (I do!) is the new vShield App 5.0 Data Security feature.   This is something we’ve been working on between RSA and VMware for some time (if you dial the “wayback” machine – I demoed a prototype at VMworld 2009 :-)   This means that compliance with more than 80 standards (like HIPAA, PCI DSS, SOX, etc…) is as easy as “run it as a VM, and place it in the compliant trust zone”.   The fact that that detailed data-at-rest classification, including complex algorithmic pattern matching and full text extraction happens with NO IN GUEST AGENTS is just one example transformative effect virtualization can have on security.

While the first thing people will lock into will be the new core VM limits of the Virtual Machine version 8 (32 vCPUs and 1TB of RAM) and Storage DRS (count on it) - to me, the details are even more compelling, and where I’m going to focus.   I’m going to cover this as a series of posts to be able to do it justice…

But – before I do, congratulations to all the employees of VMware! 

EMC stands beside you as a technology partner – in full support from an engineering, go-to-market and support standpoint as you folks raise the bar, and change the world, once again!

OK – here are links to my post series on the things that are the standouts to me.  Read on!

vSphere 5 edition of “Top 10 Reasons Why EMC for VMware”

Get it while it’s hot

vShield App 5 Data Security = awesomesauce and free to try…

Well, I’m sure I’m biased, but I think the new security capabilities are potentially one of the biggest parts of the vSphere 5 release wave.

Fundamentally, just like the explosion of data has turned out to be a blessing in disguise (with the emergence of Big Data Analytics) – the fact that virtualization “broke” security models is a similar blessing.  

What do I mean when I say virtualization “broke” security models?  Consider the diagrams below.

Well – on the left you have the traditional security model:

• AV runs on hosts.  
• Firewalls provide 5-tuple session level network perimeter security where you physically “clamp” them on key network points.   Of course this can be someone logically virtualized using VLANs – but this has real practical limits that are associated with the physical infrastructure and it’s location.
• Likewise, key things like IDS and Data Loss Prevention are implemented at key network “choke points”.

Well – on the right you have the NEW security model.

• Workloads are encapsulated and very mobile – at any given point, they could potentially move across the network.   Today, this is generally in the walls of the datacenter, but  that is NOT explicit in the model – and over time, more dispersed and hybrid cloud use cases will continue to stretch the definition of what’s in this model.
• This demands that control functions need to be enforced and applied as part of the virtualization platform – and that policy can be applied against logical constructs – grouping of VMs, tenants.

… This demands change….

If you look at that picture, and layer on what RSA has been working on with VMware for the last 2 years, you can see material progress against that picture.

1. RSA Envision is integrated with vCenter, ESX, vShield, vCloud Director (along with a ton of physical infrastructure – for example, all the EMC and Cisco components in a Vblock) for integrated Security Events and Information Management (SEIM)
2. Likewise, RSA Archer can pull that all together, and inspect and report against the Governance, Risk and Compliance state of a virtualize environment – including things like geographic distribution of VMs and ESX hosts, integrated with Intel TXT. This all possible today, via API-level integration.
3. SecurID can harden ESX and View.
4. The new Cloud Trust Authority can provide a federated view of trust across cloud models.

What’s new today is the addition of Data Loss Prevention via embedding RSA technology in vShield App 5.0.   This new capability, called Data Security can:

• Classify data within VMs
• Built-in classification against policies
• No agents or 3rd party software
• Comes “out of the box” with 80+ policies for classification
• Complete visibility into data
• Be integrated with enterprise DLP for a single end-to-end physical/virtual DLP solution.

Yes – this means that without any agent, it cracks open documents, scans their contents for all sorts of juicy stuff (scary at the same time that it’s needed):

• General keywords
• Specialized keywords
• Patterns and strings
• Proximity analysis
• “negative” rules

As an example, here, DLP can examine a PDF in a VM.  Here, it’s a prescription – and it can associate the fact that there is a name in near proximity to a personal identifier, finding patterns like credit card numbers and patient IDs

One interesting “story behind the story” is just how long we’ve been working on this.   If you go back and take a look at what I demonstrated at VMworld 2009 here, you can see me demonstrating a VERY early prototype of this idea.    That’s one example of what I mean when I say: a) come to VMworld!; b) watch what we do/say – not everything will come to fruition, but we don’t say stuff lightly; c) imagine how hard it is to “sit” on really cool face-melting stuff like this for 2 years :-)   If you look at that slide deck, you can see things that eventually made it into vCenter Operations, FAST VP/SDRS and other neato stuff…   Oh what will we do in Vegas this year?!?! :-)

The other interesting “story behind the story” is the team that develops the DLP scanning engine and policy – not only making sure that vShield App 5 Data Security ensures compliance against the standards NOW, but also ensuring that as the standards are updated, that the software itself also continues to evolve to match. 

It’s a bizarre mix of skills, experience and training - Knowledge Engineering Team profile:

• Work Exp: 12 years
• Certifications: 18 regulations
• Languages : Four
• Background: Linguistics, artificial intelligence, search technologies
• Education: Library sciences, Computer Science

So there you have it – compliance against standards, including data at rest – now can be embedded as a control in the cloud infrastructure itself, and that policy can be enforced/governed, and compliance against risk (including other sources of info, like Envision logs, and integration with the vSphere security and hardening best practices) can be pulled together in a single dashboard report in Archer.

If you want to give it a whirl – check it out!  IF you click on the below, VMware is running a promotion of this where you can get a 50-VM pack license for vShield Data Security (thru Sept 15th!)

vStorage APIs for Array Integration (VAAI) –vSphere 5 edition

The vStorage APIs for Array Integration (VAAI) have had a huge impact in the VMware and Storage landscape.   One of the truest tests (this was actually one of my MBOs in 2010!) was to see how many RFPs started to ask specific questions about VAAI support and roadmaps.   Needless to say, most large storage RFPs that cross my desk these days do exactly that.

Why?

The answer is simple.  VAAI remove bottlenecks, and offload tasks that are “expensive” (i.e. place a heavy load on ESX resources) data operations to storage arrays which in many cases can be in a better spot to support them.   This has the effect of improving performance, scale, and efficiency – which is fundamentally a good thing.  

A great proof point is this doc (click if you want the PDF) that shows the effect of the vSphere 4.1 APIs on a VMAX.   I’ve pulled out a couple of the graphs – which show 3-8x improvements in time to complete tasks, and as importantly, a HUGE offload on the network and the ESX host.

Now – I do want to call attention to the fact that this hasn’t been perfectly smooth (new things rarely are).   There have been issues, and missed opportunities:

1. Implementation bugs (fixed) and optimizations we could have taken but haven’t (still underway).   For more on these – I would HIGHLY recommend checking out this blog post.
2. The vSphere 4.1 VAAI calls made little use (and had no material awareness of) array thin provisioning, which is rapidly becoming the “defacto” provisioning model – as it is not only more efficient, but also because it enables people to minimize provisioning tasks and simplify storage provisioning to macro “pool level” operations.
3. The first round of VAAI APIs were block only (no NAS) and also in some cases, the SCSI T10 standard hadn’t “settled” by the time of the vSphere 4.1 GA – resulting in extra “plugins” needed to match the various states of implementations across the vendor community.

So, what’s new?

• in vSphere 5, not only is vSphere/VMFS “thin aware”, but it actively exploits and leverage thin provisioning at the array level for both Block and NAS storage models.  
• Wherever possible, “more standard” approaches have been used – with the goal of not needing any vendor plugins for block storage models.
• There is now support for NAS hardware assists which not only help with Thin Provisioning, but can leverage array functions (like file-level snapshots/versions).

And yup, this will be supported on EMC’s portfolio: VNX has the next VNX OE beta called “Franklin” underway right now (which has all the new VAAI assists, including both block and NAS);  VMAX has core support is already in Enginuity – after the VAAI vSphere 4.1 experience, is undergoing heavy testing; VNXe has VAAI support (along with VASA and SRM 5 support) targeted at a Q4 software update, and Isilon has a Q4 target.

Read on for more details!

VMFS-5–what you need to know in a nutshell….

It’s new, and it’s good :-)

• VMFS-5 increases limits (without increasing extents) to 64TB. 
• It enables 2TB+ RDMs. 
• It uses a common allocation size of 1MB.
• It increases the small block allocations available for total use.
• It is a dependency for SCSI UNMAP
• It uses the VAAI HW accelerated locking more extensively.

A couple things that it doesn’t do:

1. Increase the maximum LUN counts.   Although frankly, with the fact that people should be using larger datastores with VAAI and VMFS-5, that should help with this.
2. While it can non-disruptively be upgraded from VMFS-3 to VMFS-5 – this doesn’t net you all the goodness.  IMO, if it were my environment – I would tend to create new datastores and svmotion.   If I were large, I would still do it that way – but would do it programmatically.

VM HA – Laying a foundation for today and tomorrow

With vSphere 5, VM HA gets a ground up re-write – which is, IMO long overdue.

I can remember the first time I was playing in a home lab with VMware Infrastructure – the VM HA configuration wouldn’t work, and it SUCKED to troubleshoot.   3 guesses on what my problem was… well, only 1 guess needed… DNS :-)   The “rule of 4” around DNS was super-important for the oh-so-super sensitive VM HA agents to play nicely.   And OH, the error messages and logging always was a source of frustration.

Ironic of course – as this was built on the EMC Autostart code :-)

VMware has given it a ground-up re-write.  While on the surface, you may not immediately realize just how different things are, but they are.

Read on for a detailed explanation.

vSphere 5 - APD gets a new friend… PDL.

In this webcast, I talked about “All Paths Down” or APD – an important storage state for the vmkernel – where all the paths to a known device are down, and it’s unknown whether it’s transient or permanent.  The topic of APD behavior has been a sensitive one since the early vSphere 4 days (where some APD bugs, long since fixed, caused still-remembered pain)

Two fascinating (at least to me) things with vSphere were:

1. There was no inherent “timeout” for guest (and even vmkernel) IO when a device enters APD (BTW – this is still true even with vSphere 5.   This is easy to test.  Yank a device (like I did here) and watch what happens.
2. There was no easy, proper way to remove a device.   Heck, unmounting a filesystem wasn’t easy :-)

In vSphere 5, the engineering team introduced a new device state called Persistent Device Loss (PDL).

PDL means that ESX host can see the array target (implying that connectivity is OK), but the array is saying “hey, I don’t have that device”.  This is done via SCSI sense codes: e.g. the target returning 5/25h/00h (ILLEGAL REQUEST; LUN NOT SUPPORTED) or 4/3Eh/01h (HARDWARE ERROR; LUN FAILURE).    It’s important to note that if for whatever reasons the device isn’t responding (but those sense codes are not indicated) – the vSphere host will go down the APD code path – so think of APD as something general, and PDL being something specific.

But – once it’s a device is in PDL, the removable is not expected to reappear.

PDL can be planned, or unplanned.   The main thing that people should now know is that device removal is safe and simple (which is a very popular thread on an oldie-but-goodie post I did here).

Step 1: Unmount the filesystem – like in the screenshot below.

Step 2: Remove (detach) the device from the host.

Simple and easy.   Gotta love the new vSphere 5!