Archives for June 2009

Joining a Mac to a Windows Active Directory

June 30, 2009 by Josh Townsend 1 Comment

We picked up a few new 17″ MacBook Pro’s at work. We’re a Microsoft shop, so Mac’s aren’t part of the basic knowledge for our IT staff, myself included. I don’t want to be the Windows guy who says “I don’t do Macs” – part of being a technologist is serving the user base where they are at with the technologies they require to do their job (but please, included me in determining your requirements and technological solutions – a Mac might be really cool, but might not fit with the organizations needs or your IT group’s ability to support your solution). Really, that’s what Web 2.0 is all about – compatible, interchangeable tools that offer customized functionality for the users’ abilities and needs. Come to think of it, that’s what VMware is all about too – the right resources in the right place at the right time, independent of underlying hardware, application/OS agnostic, able to rise above local shortcomings by pushing to the cloud….

To be fair, I was issued a Mac at a previous company, but didn’t care much for it as the programs I had to run for my job were Windows based. I ran VMware Fusion, but it could only take me so far – funny things start to happen when you are in a VM, RDC’ing to a client server, opening the VI client and console’ing to a VM. Shortcut keys behave strangely, and one can only create so many alternate key mappings before going insane. It wasn’t the right tool for me and my job, but Macs do serve some purposes very well – graphic design and iPhone app development in my current case.

I didn’t have a requirement to do much customization the new Mac’s, but they did have to allow users to authenticate to the current Microsoft Windows Active Directory Domain. I hit a few snags as I went through the process, including making domain users local administrators and allowing domain users to log in to the Mac while off-line. Here is what I came up with for a final process in my environment – adjust according to your needs:

1.) Configure OS X to talk to the Active Directory

Using Spotlight (LeftCommand+Space), open the ‘Directory Utility’
Switch to the Services tab
Tick the box next to Active Directory plug-in (Note: You may have to click the lock icon to make configuration changes).
Highlight the Active Directory plug-in and click the Configure icon (pencil icon).
Enter an Active Directory Domain, using the FQDN (example: mydomain.local)
Enter a Computer ID. This ID will be used to create a computer object in the AD.
Expand Advanced Options:
- On the User Experience Tab:
  - Check the box for ‘Create mobile account at login’.
  - Uncheck the box for ‘Require confirmation before creating a mobile account’.
  - Choose the ‘Use UNC path from Active Directory to derive network home location’ if your AD is set to map a user’s home location to a UNC and/or DFS path; if not, you may want to uncheck this option.
- On the Administrative tab:
  - Check the box for ‘Allow Administration By:” and then Add the Active Directory ‘domain admins’ and ‘enterprise admins’ group
  - Check the box for ‘Allow Authentication from any domain in the forest’ if appropriate for your environment
Click the Bind button and enter credentials for an account with permissions to join the domain on the Active Directory domain you are joining. Note: The computer account may appear in the default AD ‘Computers’ container even if the redircmp utility was used on the domain to change the default Organizational Unit (OU) of new computers joining the domain.
Click OK.
Verify that the Active Directory Domain that you configured correctly appears with a green dot on the ‘Directory Servers’ tab of the Directory Utility.
Close the Directory Utility.

2.) Configure basic login options

Open the Accounts tool from Apple | System Preferences | Accounts
Click Login Options (Note: you may have to click the lock icon to allow changes to be made).
Configure the Login Options settings as follows:
- Automatic Login: Disabled
- Display login windows as: Name and Password
- Check the box for Allow network users to login to this computer.
  - Click the Options button and configure all network users (i.e. – all Domain users) or only select users to have login permissions.
- Configure other options as desired.
Log out of the local Admin account

3.) Log in using a domain user account (with permissions to login to the server (see above) while connected to the network) using the AD user.name and password

The first login may take several minutes to complete as a local account is being created.
Open the Accounts tool from Apple | System Preferences | Accounts
Highlight the logged-in user’s account.
- Check the box for ‘Allow user to administer this computer’ as appropriate
- Verify that the ‘Settings’ button for Mobile Account is grayed out – this means that an offline account has been created for the user.

4.) Test the config by removing network connectivity (disable AirPort and/or pull the network cable) and log in as the user you just configured.

5.) Buy VMware Fusion so you can run Windows on your Mac when all the stuff you were used to just ain’t there anymore 😀

VMware Fusion Updated to 2.0.5

June 29, 2009 by Josh Townsend 3 Comments

While setting up a new 17″ MacBook Pro today I found that an update to VMware Fusion has been released. The update, version 2.0.5, has a release date of June 23. According to the release notes, the update includes:

Support for Mac OS X Server guest operating systems on Macs with Intel Xeon 5500 and 3500 Series processors (based on Nehalem micro-architecture)
Provides experimental support for Mac OS X 10.6 Snow Leopard Server as a guest operating system (32-bit only)
Provides experimental support for Mac OS X 10.6 Snow Leopard as a host operating system (32-bit only)
Supports Ubuntu 9.04 as a guest operating system, including features such as VMware Tools pre-built modules and Easy Install
Reduces CPU usage when a virtual machine is idle under VMware Fusion
Contains fixes for more than 80 bugs

Download a trial version or update your purchased copy here: https://vmware.com/download/fusion/.

VMworld Content Catalog Released

June 29, 2009 by Josh Townsend Leave a Comment

The VMworld 2009 Content Catalog was released on Friday night according to a post on the VMworld.com blog. I have only started to browse the many breakout sessions, instructor-led labs, self-paced labs, and panel sessions that are currently planned for VMworld 2009. A quick glance shows a wide variety of content for all technical levels across many tracks, including Business Continuity and Disaster Recovery, Desktop Virtualization, Enterprise Applications, Technology and Architecture, Virtualization 101 and Virtualization Management. It also appears that the catalog includes a nice mix of VI3 and vSphere content, as well as expanded desktop virtualization information.

Be sure to browse the catalog now so you are ready for session registration later in July. From past experience, knowing what session and labs you want to attend before registration, and then jumping right into registration once it is available, is the best way to ensure you get a slot in the hottest sessions.

VMworld Here I Come

June 26, 2009 by Josh Townsend 1 Comment

Today is the last day for VMworld early-bird registration, and I got in just under the wire. Here’s to hoping that VMworld 2009 is as informative, fun and valuable as last years. I remember sitting in Vegas last year as the first of the big financial institutions began to fall. It will be interesting to see how the current economic condition impacts attendance, vendor quality, tee-shirt availability, and the VMworld party. Here’s to fun, free beer, and virtualization!

I’m also hoping that my wife will be able to join me and ‘geek out’ (her term) this year. If so, I’ll have to get her connected with the unofficial VMworld 2009 Spouse Activities!

IBM DS3300 iSCSI Write Performance Solved

June 16, 2009 by Josh Townsend 67 Comments

I have been pulling my hair out with a small VI3 implementation running against an IBM DS3300 iSCSI array. Performance, for lack of a better term, sucked. Granted, the DS3300 is not an enterprise level workhorse of a storage system, but it fit the budget. Read performance was decent from the array, but write performance was terrible, maxing out at 10Mpbs throughput and insanely high latencies on long writes when the system was under load. This led to some long P2V operations, poor guest performance, and some questions from the project sponsors on why I couldn’t make the environment sing.

The system was configured with a single controller with dual GigE NIC’s. The controller had 512MB of battery backed cache (there is also a 1GB cache upgrade option available). I wrote off some of the poor performance to a single controller with a less-than-optimal amount of cache; blamed the SAS controller to SATA disk command translation overhead; cringed at the 6 disk RAID5 configuration; and engaged in some self doubting. I convinced the powers that be that we were IO constrained and got some funds to fill out the 3U chassis to a full 12 SATA disks, and reconfigured the array as a RAID10. Performance gains were almost unnoticeable with these changes. In addition, I did some basic troubleshooting of the network environment, verifying multiple paths to the storage, setting Flow Control on the switches to receive only, and double-checked my iSCSI initiator settings. Note: The DS3300 is only supported with the ESX software initiator. I found documentation on the DS3300 to be lacking, but did discover that the Dell MD3000i is based on the same LSI Engenio array. Some Googling on the Dell solution led to to the ‘SMcli’ command line interface for both arrays. The commands are slighly different for the Dell and IBM. The links to the IBM CLI documentation were broken, so I had to do a bit of trial and error to get the commands right. I used the Dell documentation as a starting point. (Rant: Seriously, IBM? Can you make your documentation any harder to get through – is it a Redbook, is it an Engineering Whitepaper, is it a support document, is it a case study – and why can I only find these with complex Google searches, not on your own product pages, and why can’t you name for documents intelligently, not with some random string of characters).

Update: The IBM System Storage DS3000, DS4000, and DS5000Command Line Interface and Script Commands Programming Guide is here: IBM System Storage DS3000, DS4000, and DS5000Command Line Interface and Script Commands Programming Guide – DS3k4k5kCLIreference, SMCLI

Moving on… I received an automated alert from the DS3300 about an incomplete battery learn cycle. Using the IBM Storage Manager GUI I generated a Storage Subsystem Profile’ from the Support tab to check the battery status. In the profile I discovered that while write cache was enabled, it had a status of “Enabled (Suspended)”. Ah ha! Now I’ve got some decent Google material that led me to this: https://communities.vmware.com/thread/195838. Hot damn I love the VMware Community Forums!

It turns out that in a single-controller configuration the setting for cache mirroring remains enabled by default. Because there is no 2nd controller to mirror to, the array suspends write caching. This is probably a safety thing – loss of high availability on the controllers puts data in cache at risk should the only controller fail. I weighed my options and decided that the poor performance I was experiencing beat HA concerns, so I enabled write cache on the array using this command:

c:program filesibm_ds4000client>smcli -n <ARRAYNAME> -c “set allLogicalDrives mirrorEnabled=false;”

And then followed with this for good measure:

c:program filesibm_ds4000client>smcli -n <ARRAYNAME> -p <arraypassword> -c “set allLogicalDrives writeCacheEnabled=true;”

The results were immediately noticeable:

The screen shot is from Veeam Monitor Free Edition, taken during 4 concurrent V2V operations from Hyper-V to VMware. With the write cache fully functional, disk usage peaked at 54MBps, latency dropped to about 6ms, and my blood pressure dropped a few notches.

While poking around the CLI I also found that you can dump performance stats from the array (performance is otherwise hard to find on the thing) using this command:

C:Program FilesIBM_DS4000client>smcli -n <ARRAYNAME> -c “set session performanceMonitorInterval=5 performanceMonitorIterations=120;save storageSubsystem performanceStats file=”c:ds3300perfstats.csv“;”

This will give you a 10 minute record of performance from the array which you can analyze using Excel. The Dell Enterprise Center TechCenter Wiki has a great write-up on how to efficiently analyze the data from this command here: https://www.delltechcenter.com/page/MD3000i+Performance+Monitoring, complete with a YouTube video that walks you through the process:

I am beginning to think that the DS3300 (and MD3000i) may actually be a viable starter solution for SMB’s starting out on a virtualization project. But I would recommend the cache upgrade, 2nd controller, SAS disks instead of SATA to eliminate the SAS-to-SATA translation overhead and more faster disks instead of fewer slower disks so you can drive throughput and IOPS to a higher level.

Have any of you deployed the DS3300 or MD3000i (or the generic LSI solution)? Do you have any performance tuning tips for these arrays? If so, share in the comments!