By Andrew Gregson, Novosco Creative Technology Director

Cloud Computing has long been a buzz word in the IT industry. Everyone is jumping on the cloud trend, but what does it really mean for businesses? What options are available today and what are the customer benefits of adopting a cloud IT infrastructure?

It is not surprising that companies find the cloud computing model confusing or fuzzy. Among the jargon however lies a fundamental change in the way IT operates. It’s about looking at ongoing IT costs per user and having a trusted ‘cloud provider’ to worry which technologies/hardware to host your infrastructure on. With cloud providers hosting the infrastructure, companies simply pay a fee per user/per month, with no capital expenditure (CAPEX) to spend. Only when businesses (large & small) start to actively embrace this model, will they realise both the immediate and future benefits of cloud computing.

Novosco’s definition of cloud computing…

Cloud computing provides computing resources on demand and leaves the worry of IT hardware/infrastructure to cloud providers.  Instead of companies buying traditional hardware, they simply avail of a hosted hardware/software platform and rent ‘IT as a service’; taking the form of hosted servers, hosted software applications and hosted online backup.

FIND OUT MORE
To receive the full PDF copy of the article please complete the form below:

Novosco CloudStream Net makes affordable Videoconferencing a reality.  All customers need is:

1) Any PC & webcam – One per site.  (Apple iMac is a popular choice as the camera resides in the screen.)   
2) To use free software or web plugins such as  Skype, ichat, google talk
3) Novosco CloudStream Net – Cloud Network Service (charged at a monthly rate)

HOW?

CloudStream Net is a cost-effective network service that among other benefits increases broadband speed and upload/download speeds.  This allows phenomenal improvements in VoIP and video conferencing quality, but without huge costs.  Without the frustrations of poor video quality, companies can audio and visually communicate as well as quickly share documents and computer-displayed information.   With improved broadband speed, even if miles from the local exchange, communicating with remote offices through videoconferencing is now a refreshing reality with CloudStream Net. With a reliable, fast line using CloudStream Net, customers can get the most out of tools such iMacs and ichat/Skype.           

For more information:

Eddie O’Rourke, Novosco Sales Director, Ireland

Microsoft have also released a corresponding “out-of-band” (i.e., not contained in the monthly batch of updates) update in the shape of KB958644. The update is available from Microsoft Update.

Novosco are actively encouraging all of our customers to deploy the update as soon as possible (on all Windows hosts – clients and servers). You can do so by visiting the Microsoft Update website or by deploying with Windows Server Update Services or some other 3rd party deployment tool.

But why all the fuss? Well, this particular vulnerability is wormable – meaning that potentially (more on “potentially” later) the vulnerability can be exploited by a worm, i.e., self-replicating malicious code that seeks out vulnerable hosts and infects them from your laptop while you’re writing your blog post…

Talking about worms in this way takes me back to those bygone halcyon days when Windows anti-virus was “optional”, host based firewalls were unheard of and the only reason to use a firewall in the enterprise was to take advantage of its NAT capabilities and not fork out for expensive publicly routable IP addresses for your network. It was also the time before we had all deployed WSUS or some other automatic update solution. Right?

Wrong! Even though we now have written policies defining that laptops must have host-based firewalls and AV, and we have fancy UTM devices at the network perimeter, all too often we still have the problem that updates are being ignored. Consider this situation: a user goes home with their company laptop (which hasn’t been updated in the last 8 months) and browses the web for a while from their home internet connection. Because Internet Explorer hasn’t been patched they get burned by some exploit which drops a Trojan containing code which in turn exploits the MS08-067 vulnerability. The user didn’t really do anything wrong, wasn’t an local administrator and knows nothing of the infection. Next day they plug their laptop into the corporate network and while they’re at the coffee machine ten minutes later they see the IT admins running past on their way to the server room as the “whole network’s down!!!!”.

Update mangement would have saved that company on two counts – the first by patching the user’s laptop. If it wasn’t vulnerable the malicious code wouldn’t have got onto it in the first place. The second; even if the laptop hadn’t been patched (say the user was off work for a while and got infected anyway) the servers would have been patched and wouldn’t have been vulnerable so no downtime would have occurred.

That example’s a bit simplified, certainly a layered security solution of best practices, AV and UTM would have helped. But I think it serves to get the message across – the fuss surrounding this update is symptomatic of a bigger problem.

Now I put “potentially” in bold above for a reason – there is no worm exploiting this vulnerability (that we know of, yet). Right now, there is however a recognisable trojan which is being used in targeted attacks. And, there’s publicly available exploit code in the wild which means you can bet that VXers are beavering away trying to develop a suitable worm. So you have a choice – patch now or don’t. You can choose not to and give me the old excuses about the risks of deploying patches (breaking applications etc) but that’s why Microsoft genuinely recommend that you test their updates with your applications and if you’re really that worried you should seriously think about a test environment, but if (maybe when) the worm hits and you get burned I’ll try not to say “I told you so”.

Remember folks – “Proactive patching is better than reactive repair”.

Stratus is currently a hardware based solution and Marathon’s is software, running on Windows Server 2003. Both of these companies have enjoyed a certain level of exclusivity but that of course will not last. I have very little info on where Stratus is going other than it can run ESX on its FT kit. Marathon have embraced the Xen hypervisor and have jumped in bed with Citrix, helping Citrix initially provide a host based XenServer HA solution (on a per VM basis!), along with their on HA solution for XenServer adding component level HA. And eventually in Q1 2009, their XenServer based FT solution will be released.

What this means, is that we will still have a choice about which hypervisor to use across all availability levels: Marathon on XenServer and VMware.  This is good!

After reading a blog post from Marathon about VMware FT and some retort from a VMware supporter, I thought I’d throw in my 2p, as there appeared to be some problems with these arguments.

Firstly, the comparison is Marathon’s existing FT product that only runs on Windows against VMware’s that only runs on VMware’s hypervisor. This is a pointless comparison as they dont compare like for like and  VMware’s product has not been released and wont be until some time in 2009. It would be a much fairer comparison to pitch Marathon’s new XenServer based FT against VMware’s FT…when they both arrive.

Secondly, Marathon argued against the requirement for shared storage with the VMware FT solution and the VMware guy stated that where you’d want to use FT you’ll likely have a SAN in place anyway. I have a slight issue with this. Quite often, FT solutions are used for critical production lines, health systems and emergency services. These systems may not run anywhere near a SAN, nor require one. It would be a considerable expense to require a SAN just for a 2 node FT solution. Also consider the site that has two data centres connected via fiber. We have Marathon FT systems running like this, which would allow for the likes of a site failure. This kind of setup requires that the writes are done to each system and that shared storage just doesn’t work in all cases.

Judging by the review of the FT session at VMworld by Scott Lowe, VMware may change their minds about the need for shared storage for FT. I hope so.  I think it’s great that VMware is getting into this game.  We have a lot of VMware sites that would be reluctant to add another virtualisation platform into the mix at this time. Being the pioneers and market leaders of server virtualisation gives them a big advantage. It widens their scope and will certainly provide decent competition for Citrix and Marathon. But, Marathon have been in the FT game for a long time too and know the problems and limitations that can be encountered in FT land. I wouldn’t underestimate them either.

This release brings an end to months of Beta and RC testing on an exciting new feature set, and we’re looking forward to providing our customers with even more innovative implementations than we have with previous releases.

I won’t repeat the feature list here (you can check the comprehensive announcement linked above) however you may want to read the post on Virtualization.info for a decent summary.

This is great news for customers who have been holding back on running applications such as Microsoft Exchange on VMware due to support concerns. Those “not officially supported” barriers, that we’ve heard here in Ireland time and time again, have now been removed.  Now we just have to figure out the licensing.

An application using the SSE4.1 feature (or is aware of this feature) when VMotioned to a non-SSE4.1 host would likely blue screen trying to make use of this feature on the older host.

People then recalled the CPU mask feature in VMware – we’ll just mask it out they thought. Unfortunately VMware declared this was an unsupported mask with KB1993 and KB1991.

Note that for production environments, VMware neither supports nor recommends modifying VMotion masks for SSE3, SSE3, or SSE4.1 because of the risk of failure of the application or guest operating system after migration.

The reason soon became clear:

• SSE features can be used by user-level code (applications).
• Mask does not work for user-level code (i.e. applications).
• In user-level code, CPUID is executed directly on hardware and is not intercepted by VMware.
• Thus, VM cannot reliably hide SSE from an application

The best that customers could do was buy compatible hardware, and keep themselves right with vendor compatibility charts such as these ones from Dell and HP.

ESX 3.5 U2 brought a new feature: Enhanced VMotion Compatibility (EVC for short) which I’ll explain…

New CPUs are coming out with a facility to ‘turn off’ (mask) features that would make them VMotion incompatible with other hosts running older (compatible) CPUs.

For Intel this is called Flex Migration. It is clear that for processors that are in different families but support Flex Migration will negotiate the common feature set amongst the CPUs.

Where it is not absolutely clear, is where you have an existing cluster and you want to add in hosts with the new Flex Migration facility. You should be able to do this if you satisfy the following requirements (paste from Basic Administration Guide):

All hosts in the cluster must either have hardware live migration support(Intel FlexMigration or AMD‐V Extended Migration) or have the CPU whose baseline feature set you intend to enable for the cluster. For specific host processors supported, see Table 15‐1.

Table 15-1. Processors Supported in EVC Clusters

Vendor	Baseline Processor	Processors Supported
Intel	Intel Core 2 (Merom)	Intel Core 2 (Merom) 45nm Core 2 (Penryn)
AMD	AMD Second Generation Opteron (Rev‐E/F)	AMD Second Generation Opteron (Rev‐E/F) AMD Third Generation Opteron (Barcelona)

It is therefore advised that customers buying new tin, if they cannot acquire a processor that is exactly the same or in the same family – purchase a Flex Migration enabled CPU.

It should also be clear that only masks the features on the processors, it does not turn them off. Programs which are written to guidelines will behave, those which are coded badly will see these features regardless – and more importantly will encounter issues if VMotioned to a host that used that feature. Pasted from VMware:

EVC utilizes hardware support to modify the semantics of the CPUID instruction only. It does not disable the feature itself. For example, if an attempt to disable SSE4.1 is made by applying the appropriate masks to a CPU that has these features, this feature bit indicates SSE4.1 is not available to the guest or the application, but the feature and the SSE4.1 instructions themselves (such as PTESE and PMULLD) are still available for use. This implies applications that do not use the CPUID instruction to determine the list of supported features, but use try‐catch undefined instructions (#UD) instead, can still detect the existence of this feature.

Therefore, for EVC to be useful, application developers must adhere to recommended guidelines on feature detection. CPU vendors recommend that software programmers query CPUID prior to using special instructions and features available on their CPUs. If this guideline is followed by programmers, EVC is a reliable mechanism for live migration of x86 virtual machines across varied hardware. Thus, you can use EVC to enable an entire cluster to use the same set of basic features, allowing migration with VMotion across any two nodes in the cluster. VirtualCenter can also set up new hardware add‐ons to the cluster and apply these masks.

Intel provide a comparison tool to check beforehand if a CPU possesses Flex Migration capability.

Further Information on this subject can be located in the VMware VMotion Guide and the ESX 3.5U2 Basic Admin Guide Page 238 Onwards.

This is interesting for a couple of reasons: It will increase the size of servers being purchased – a 4U powerhouse can do much more than a blade, in terms of capacity.  So what becomes the expensive part, the license or the rackspace? The other reason, is that it puts it on a par with Microsoft Windows and Hyper-V, since the pricing model is the same.  I’m sure VMware will have an answer to this, otherwise the competition might start to get some traction.  Either way, competition like this is always good for the customer and will only ensure that virtualisation get’s further entrenched into IT infrastructures and datacentres that bit quicker.  And when the pricing differences become negligible, it will be all down to capabilities, that’s when we’ll really start to see some innovation…hopefully!

The vendor story

Microsoft – “We have a complete end to end management solution for all your assets both physical and virtual. Why invest in a point solution such as VMware when we can provide all of the important features at a fraction of the cost ? Our hypervisor is more efficient and smaller,  is architecturally superior and has the features that most customers need. The hypervisor is a commodity and the important elements in a virtualisation solution are really the management toolset.”

Citrix – “We have the most cost effective hypervisor on the market offering all of the really relevant advanced features that are missing from Microsoft, but provided by VMware, for an expensive premium.  Our technology set provides an integrated solution around virtualising, not just servers, but desktops and applications too. Our core product has strong pedigree in supporting non MS O/S and our partnership with MS guarantees the best all round fit no matter what server O/S you wish to virtualise.”

VMware – “We own this space, with a ten year track record and the most advanced product set that is available on the market today. Our hypervisor is the most cost effective because advanced features such as: VMotion, DRS, Host mgt and memory over-commit, provide a consolidation ratio which our competitors can only dream about. In fact, some of them haven’t shipped a product yet. We manage your complete virtual infrastructure from a single interface without the complexity of multiple consoles and technologies. Our reliability is legendary and our track record in solid dependable code release is enviable across the industry.”

Who has the answers?

• So as a customer what do you do?
• Who do you believe?
• Which vendor has the answers for your environment or your unique set of circumstances?

<Shameless Plug>
Of course, all of the vendors have valid points and they are all in a way correct. It really is a minefield trying to figure out the right infrastructure technology to use and manage your environment. What you need is a trusted advisor, an organisation with a unique field of vision across all the main infrastructure technology vendors who stands independently and can offer you the right advise based on your requirements without prejudice.

Often, the correct solution does not sit with a single vendor.  If I look at some of our recent projects, there is a common thread based on best fit, not vendor fit. We recently commenced a project to virtualise the server infrastructure of a local building society with branches throughout the country. The customer had diverse requirements in terms of desktop management, application deployment and a desire to improve their disaster recovery capability and at the same time reduce server footprint. In the end we deployed Citrix XenApp, Microsoft System Centre Ops Mgr, Softgrid and VMware ESX based on these requirements.
</Shameless Plug>

Make sure you choose wisely

Make sure when looking for a technology partner they have  a broad view of virtualisation and a track record in multi-vendor deployment. Rarely, if ever, does one size fit all.