360is Builds VDI for InnovateUK

UK Satellite and GIS Imagery

The UK Satellite Applications Catapult (The Catapult) was established to promote growth in commercial applications of satellite technology. Its mission is to accelerate the take-up of emerging technologies by businesses and in so doing, drive UK economic growth. The Catapult offers expertise and facilities that will bring strategic benefit to the community of industrial companies working in the sector.  

How did the project come about? 
Making facilities and information assets easily available to potential users of their services is part of the Catapult's mission. Satellite analysts routinely work with heavyweight applications like ESRI ArcGIS, GE Smallworld, and Raytheon VIIRS. The Catapult wanted to see how such applications performed on a modern, fluid, Virtual Desktop Infrastructure (VDI). 360is was challenged to build a system capable of multi-user, multi-screen VDI for satellite applications using thin clients while providing a dedicated workstation-like experience.

What did 360is do?
After interviewing end users, 360is built a VDI system using Citrix XenDesktop, XenServer, and NVIDIA GPU hardware and a suitable WYSE thin client. This combination of technologies allowed for maximum flexibility.

• Physical GPUs may be partitioned into virtual GPUs Virtual Desktops are booted on demand.
• Users are allocated VDI's with different vCPU/vGPU capabilities depending on a profile.
• The platform may be optimised for user density or performance.
• Server GPUs work with client GPUs to enable a high-quality end user experience.
• Network bandwidth is minimised using caching and compression.

As this was a proof of concept demonstration, 360is chose components and settings for maximum stability. End users can quickly form a negative opinion if a new technology is not completely reliable and this system was to be used for live demonstration.

How successful was the platform in meeting the project goals?
Multi-screen multi-user GPU VDI was delivered. 0.5Mb/s to 1.0Mb/s of network bandwidth was required per client while running in excess of 60fps. Up-to 64 concurrent GPU-powered VDI's could be provided by the system, this could be increased to 128 with different choices of hardware. The thin client CPU (capable of driving up-to 6 monitors) proved to be the limiting factor. High-density, GPU VDI is now within the reach of most organisations. Specialist scientific applications no-longer need to be excluded from the virtual desktop projects.

About 360is
360is builds multi-user, multi-monitor, high-resolution and GPU-enabled Virtual Desktop Infrastructure for Scientific Technical and Creative Industry organisations. Our engineers can address all aspects of the project from storage, to networking, to hypervisor configuration and application performance tuning. If you would like to talk to one of our engineers about deploying scientific and GPU applications to demanding users, get in touch via our contact page, Email, or message us on twitter.

If you want to know more about the UK's Satellite Applications Catapult and the great work they are doing to help grow the £7B annual turnover of the UK space sector, take a few minutes to find out more:

XenServer Creedence Alpha 3, Disk I/O testing (part 2)

We did some more testing of XenServer Creedence Alpha (XSCA3) disk performance, and plotted large streaming reads for a variety of record sizes against both a physical and Brand-X Hypervisor.

Recap:

• System is an AMD6176SE, 2 CPU, 192GB RAM 
• Local storage, 3x 10Krpm SATA, LSI 9261-8i, RAID0, thick provisioned 
• No special settings, tuning, or configuration 
• Testing is with dd and iozone, with and without Direct I/O (dd iflag=direct, iozone -I)
• CentOS 6 2 vCPU, 2GB vRAM (updated 3-07-2014) VM and physical 
• The system was idle 

Physical achieves ~600MB/s transfer speed. 
Brand-X achieves a similar figure.
XSCA3 achieves less than 50% of that, unless Direct I/O is used.
Neither physical nor Brand-X are significantly affected by use (or not) of Direct I/O.

Results for physical without Direct I/O are excluded as with 192GB RAM and only 8GB of test data, transfer rates are in the 2500-1700 MB/s range due to the abundance of RAM for cache. We took no steps to limit the physical CentOS to 2 cores either.
  
We know the disappointing XenServer performance is only for asynchronous (not Direct I/O) disk access, and that the system behaves as expected when running physical or Brand-X hypervisor. The mystery deepens!

XenServer Creedence Alpha 2, Disk Performance

360is gets paid to make information technology go faster.

Sometimes its hardware which doesn't hit the stated performance, or software which cant fully utilise the capability of modern hardware. Sometimes it's a lifetime extension for an old platform, squeezing in another 18 months growth before a replacement arrives. If we are really lucky we get to re-design an entire end-to-end process and make it more efficient. More layers and more abstraction means more scope for performance problems, so virtualisation has been a rich seam for us. With Citrix release of XenServer Creedence Alpha 2 (XSCA2) should we be worried? Is it time to throw in the towel on IT performance-tuning and setup that high-end bicycle-shop-come-espresso-bar we've always talked about?

We've been following XenServer performance from the start, and have a tome of magic spells to instrument and improve network, storage, and CPU performance. Without resorting to black-magic we were interested in seeing how XSCA2 performed straight out of the box.

Firstly let me say that all we have time for here is the most superficial of testing. Large sequential reads and writes are the 0-60 time of the storage world. That is to say, while they have some value, unless your use-case is an out-and-out drag race this test probably isn't a good approximation of the kind of performance you will see in your applications. Single VM large sequential read/writes are even more of a corner-case. If you only had a single VM to run you should probably run physical, just a suggestion...

Secondly, XSCA2 is alpha, and so it is slightly unfair subjecting it to a performance benchmark.

Finally, we used the equipment we had spare in the lab at the time. The storage back-end is puny. We had a handful of 10Krpm spindles and SSDs laying about. Out in the real world, 360is regularly deliver 1.5GB/sec to 2GB/sec of storage bandwidth (at high IOPS) to Hypervisors and physicals of one kind or another either over local or network storage.


The Goal
We were interested to see how XSCA2 performed against XenServer 6.2, against physical, and against "Brand-X" Hypervisor, all of which were "out of the box".

The Test
The test couldn't have been simpler. For a 2 vCPU VM, for each of 9 record sizes (64KB-16MB), we write (or read) 8GB of data and measure the performance in MB/sec for each record size. Why 2 vCPUs? Adding more doesn't change the results. Why 8GB? We can be sure 8GB blows through any caching that may be happening on disks, RAID controller, VM, or Hypervisor. Even at a 16MB record size, 8GB takes a lot of writes. For the physical test case we force direct IO to get around the fact that the physical system has much more RAM than 8GB. We use the same guest Operating System, installed in the same way for each of the VM tests. Everything is thick provisioned. This isn't a test of how fast each configuration can be made to go, it is a test of how fast each actually goes, straight out of the box on the lab system that was available at the time.

Tuning
None. No changes to the default install of XenServer, Brand-X Hypervisor, the CentOS VM or physical instance, with the exception of taking XSCA2 out of debug mode. No CPU pinning, no IO scheduler changes, no disk/virtual disk alignment, no IRQ balancing, no interrupt coalescing, no filesystem tweaking, no queue size alteration, no waving of dead chickens or reciting of incantations.

Results  
Enough talk, on with the results:

8GB Streaming Write At A Variety Of Record Sizes

8GB Streaming Read At A Variety Of Record Sizes

On this system, for this test, XSCA2 is an improvement over XS61-SP1, but is still significantly behind the physical, and more disappointingly behind the other well known brand of Hypervisor. Besides the obvious, there are a few points from the chart which warrant further investigation for starters:

• High jitter in all XS results.
• Odd dip at the 512KB record size test on both XSCA2 and "Brand-X" hypervisor.
• Slow start to the physical test at 64KB record size.

  The tests shown here were on a RAID0 of 3x 10Krpm spindles (maximum sustained transfer rate ~200MB/s each). Conducting the same test on a RAID0 of SSDs made little difference to the XenServer results, adding 20MB/s to the average write result and 40MB/s to the average read value.

Conclusions

1. We aren't out of the performance tuning business just yet it seems!
2. There is a significant difference in performance between the physical and "Brand-X" and XenServer.
3. Read performance is particularly disappointing for XenServer in this test.

"It is easier to repair a bucket with a big hole, than an inner tube with a slow puncture." - Ancient 360is Engineer's Proverb.

For this system, for this test, the hole in the bucket is large, with a bit of further investigation it shouldn't be too hard to find. XenServer Dom0 (which strictly speaking we don't care about) comfortably achieves ~600MB/sec in read performance tested using "dd" with direct IO (no cache effect), so we know the problem is with the guest disk virtualisation IO path. First port of call will be instrumenting CPU consumption in the guest and Dom0, paying particular attention to XSCA2 susceptibility to numa-effects on the CPUs. We love a mystery. The game is afoot!


Further Information

Test VM Spec.
CentOS6 x86_64 Linux, default install from distribution, updated with "yum update" 3-07-2014, with the following additional packages: wget, openssh-clients, iozone (3.424-2 x86_64). 2 vCPUs, 1GB RAM, 20GB virtual hard disk.

Test Hardware Spec.
AMD 6176 CPUs (x2), 192GB 1066MHz RAM, LSI 9260-4i RAID, 3x WD1000DHTZ, 2x SSDSC2BW12.

Test Hardware OS.
CentOS6 x86_64 (same as VMs).

Brand-X Hypervisor.
Latest version, chose the PV SCSI device.

Benchmark.
We used the continuous benchmarking feature of VMCo Virtual Estate Manager (VEM). VEM's benchmarking alerts administrators to performance regressions in your XenServer or VMware estate, whether they be caused by bugs, patches, hardware problems, subtle interactions between network elements or administrator misconfiguration. VEM's continuous benchmarking shows you where the performance regression is, when it started, and it's impact is.

 

Why VMware (still) Wont Convince The Cloud Providers

We don’t normally comment on commentary at the 360is blog. Most of our postings are more substantial, whitepapers, guides, seminars, or software we’ve produced or packaged. However there is a good posting (Cloud Hosting & Service Provider Forum) by Richard Talaber (ex-CTO’s office at VMware) on LinkedIn and thought I’d reflect on it here.

For those of you who aren’t on LinkedIn, or don’t want to join the group in question, Richard was responding to Beth Pariseau’s article at TechTarget on VMware’s recent abolition of the vRAM tax.

Richard makes the case that VMware is probably not going to be the right virtualisation stack for a commodity “$75” per-month per-VM hosting/cloud service, vRAM tax or not. He also believes that VMware still makes sense for the smaller market for high-value fully-managed VM hosting, with load balancing, monitoring, fault tolerance, and high performance throughput bells and whistles.

Mostly I agree with Richard, he makes sensible arguments supported by good assumptions but in-spite of this I still see more than a few problems for VMware in the short and medium term. Let me explain...

All service providers, including Cloud & Hosting providers, need to own their own infrastructure if they are to have a sustainable business. Whether it be a fibre optic network (in the case of a carriers) or their provisioning, monitoring, and management stack in the case of Cloud providers. Unless a service provider owns his own infrastructure, he cannot exercise full control over his costs. Cost control is vital in a service provider business, as profits depends upon volume, and any tax on profits is unwelcome, especially one that grows in-line with that volume.

Hardware must be paid for (hopefully using inexpensive long-term debt secured against assets you also own), but if there is even a chance of finding a cheap or inexpensive hypervisor-and-management-stack then Cloud providers have to take it. This is why you see so many of them with Xen, XenServer or KVM. This is why the list of users of OpenStack reads like a who’s who of Telecoms and Hosting. For those that argue I'm not considering TCO, think about this. I've hired good technical guys, pay them well, they work hard for me, I'm supposed to be a player in Cloud. If my guys can’t engineer something solid, maintainable, and cost effective then what am I doing in this business? These guys and the platform they build from KVM, Xen, or whatever, are my long-term competitive advantage. At least until I'm big enough to be building my own data centers from scratch.

If I'm a Cloud provider and my maintenance renewal (or any other per-unit-customer cost) jumps even 1%, its a big deal, I've got a bazillion systems after all.

For parts of the infrastructure that can’t be wholly owned, or cannot be had for free (with effort from my hardworking DevOps guys), the Cloud provider's only weapon is over-subscription. Pay for the product then figure out how to dilute that cost by maximising over-subscription, balance providing a great service with running the hypervisor and server hot. It is a very difficult balance. This is one of the reasons the vRAM tax was so wildly unpopular with Cloud providers, it took away one of their profit levers, or at the very least shortened it.

Hosting/Cloud providers are currently at a very immature stage in life, they are talking about RAM, and IOPS, and vCPUs or is it CPUs or is it Cores or Threads? What do any of those things mean? What about transfer rates, or latency, what kind of cores? What is a thread? These things don't mean much to business people so good luck trying to explain them. When business sees 3 prices for what they perceive as essentially the same service, they are going to go for the cheapest and find out later if it was appropriate. By Richard’s own admission, 80% of workloads are relatively modest in demands. VMware will not manage to get across an argument based upon performance; a performance lead of the size VMware achieves (or even aspires to achieve) is not a sustainable advantage for the Cloud provider market. 

Richard's last sentence is key: "Perhaps VMware should consider a public cloud price that is significantly less expensive than a private cloud price.". Logical. If the public cloud VMware price were somehow so small as to barely matter, then service providers would not spend time fiddling around with the competition or knocking up free alternative platforms....but how to segment the product? I think it is too late now, there are alternatives in-use, there are engineers out there with experience of building these infrastructures for service providers, and even if you can't afford to buy such people you can probably rent them. Talk to us.

• Better performance is not a sustainable advantage for VMware.
• A richer feature set probably isn’t either.
• Cloud providers dislike anything that handicaps their ability to over-subscribe.
• Cost that grows in-line with customer volume is a no-no, unless it is absolutely impossible to avoid.

VMware could make their product more appealing to commodity Cloud providers, but in order to do so they’ll have to start thinking more like them. Or talk to someone who does. 360is has helped companies like CheckPoint, HP, and Microsoft understand the Cloud service provider market. You know where to find us.

April Seminar, Virtualisation In High-Tech Environments

101 Cambridge Science Park, Milton Rd

We are holding a free, invitation only seminar on the 23rd April 2012 for high-tech or research and development centric organisations in the Cambridge area.

Aimed at technical and business users with an interest in virtualisation, this is not a vendor-centric product briefing, but a sharing of real customer experiences in two demanding application areas and a detailed look at a world class software research and development facility. There will also be an opportunity to network with fellow members of the Cambridge technology cluster over lunch.

360is are hosting the event at Citrix’s R&D centre on the Cambridge Science Park. Two local case studies will feature, each from a different high-tech business that has adopted desktop or server virtualisation to increase productivity for specialist office workers, scientists, or engineers. If you are charged with supporting demanding, sophisticated users in the Cambridge area then this seminar will be of interest to you.

Contact the organiser for an invite if you would like to attend.

When: Monday April 23^rd 09:30 until 12:30

Where: Citrix Systems Inc, Building 101, Cambridge Science Park, Milton Road, Cambridge, CB4 0FY

Organiser: rob.gilson@360is.com

Summary Agenda:

09:30 Registration and Coffee

09:50 Start

10:00 Mark Heath VP of Products, Citrix XenServer

Detailed look at the engineering facilities and resources behind the Citrix R&D organisation

10:30 Case Study 1

Shortening the testing and development cycle for an large international software company

11:00 Break

11:15 Case Study 2

Virtual Desktop Infrastructure (VDI) for demanding, scientific, and engineering users

11:45 Closing remarks and prize draw

12:00 Buffet lunch and open networking 

About 360is

360is have over 10 years’ experience in providing consultancy and professional services in the application of  technology to business problems and challenges. Our staff have worked in and around Cambridge since the early 90s, solving problems for numerous Software, Life Sciences,  Electronics and R&D driven companies.

360is End Of Year Message, 2011

2011 was another year of growth for 360is and for many of those with whom we work. Our base of Financial Services clients has seen a rebound since the darker days of 2009, and we have continued to expand into Scientific and Research Intensive sectors with several new projects and clients in Cambridge. As a result of this, we were pleased to welcome another Cambridge-based senior consultant to the practice. We continued to execute Virtualisation, Security, and Performance-related engagements for our clients, and maintained our focus on short term, (less than 3 month) fixed-price, projects, with a vendor-independent, client focused approach.

Inside 360is in 2011

• Security work consisted mainly of Security Assessments, Penetration Tests, and Post Incident work, but grew to include Application Security Assessments, with significant new clients in the online gaming sector. We have also seen an increase in Distributed Denial Of Service (DDoS) mitigation projects. More companies with an online business model established themselves as brands, and therefore attracted the attention of extortionists, activists, and attention-seekers.

• Virtualisation made-up almost 50% of projects, however the emphasis shifted from 1st-time production roll-out to 2nd or 3rd stage "3-5 years on" projects. We recently doubled the density of an already-virtualised estate of 500+ VMs as part of a hardware refresh cycle. Service Provider Virtual Desktop Infrastructure (VDI) projects also grew in 2011. 360is worked in partnership with client's Architecture and DevOps staff to deliver industry-leading high-density, high-margin, VDI to tens of thousands of users.

• Performance-related projects were driven by a combination of CAPEX freezes and business growth, and were concentrated around storage systems. Due to continued difficult economic conditions in the UK, and recent shortages in hard drives, we expect this trend to continue into Q1/Q2 2012. In the last 18 months, data volumes have increased dramatically in Media (HD and 3D), Geo Sciences (ultra-wideband sensors), and Life Science (faster, cheaper, sequencing). These trends drive up data volumes and the demand for performance, as the bottlenecks move downstream.

360is Outlook For 2012

The outlook for 360is in 2012 is good.  Industry trends favour our long experience, technical capability, and vendor-neutral approach to problem solving. 

• There will be fewer new infrastructure projects in 2012 (semiconductor sales were essentially flat in 2011). Supply chain disruption caused by floods in Thailand will provide even greater incentives to extend the life of existing platforms through careful optimisation and tuning. Although hard drive prices are stabilising, availability remains poor unless you take spindles as part of a large purchase from a major vendor. 360is can help you grow in spite of these difficulties, engage us to execute the following projects:
• Storage Consolidation/Re-Tasking
• Storage Performance Tuning
• Storage Tiering

• Rising energy costs and the practicalities of power distribution will continue to constrain some projects and have a significant impact on hosting and colocation costs. A recent study by 360is revealed that those renewing 3-year contracts for data-centre space typically saw a 40%-50% increase in annual charges, with colocation customers under pressure to migrate to higher-margin higher-price fully managed hosting contracts. If you have already virtualised some years ago 360is consultants can help you find an encore, we can further streamline your operations, deliver greater VM densities and lower OPEX costs through the use of new methods and technologies.
• High Density, Low Power Virtualisation Appliances
• Data Centre selection and evaluation
• Cloud or hosting provider selection and evaluation

• Recent wide-scale civil unrest across UK cities brought Disaster Recovery and Contingency Planning into focus in 2011. Further disturbances are set to occur as a variety of protest and pressure groups plan disruptions in 2012. Whether it be city-wide riots or attacks against individual organisations, it is now more important than ever to make sure you have a solid, rehearsed, Disaster Recovery or Business Continuity plan. 360is consultants have executed many of successful projects in the areas of DR/BC.
• Secure hosting/colocation outside London
• In-house Disaster Recovery Infrastructure
• Replication and High Availability or Fault Tolerant Systems
• Denial Of Service Mitigation

If your team is challenged to deliver any of these projects, 360is can help you do so, on time and on budget, in a way that is tailored to your organisation's individual circumstances. We look forward to working with you in 2012.

Welcome To 2011, Year Of The Rabbit

This year our normal New Year message to clients and partners comes exactly one month late. Another way to look at it (with the Chinese New Year starting February 3rd) is that we are bang on time.

一个好年头 (Another Good Year)

2010 was another year of growth for 360is with more clients in new sectors and a formalised datacenter performance practice. We deepened our profile in Private Equity with more virtualization projects (VMware and XenServer), and in mainstream Investment Banking with more VDI (VMware View and XenDesktop) assignments. Our Security practice continued with steady growth, and included new business from UK-based online gaming and "dotcom" sectors. 360is now counts among it's clients several of the UK's fastest growing and "best to work for" companies. While the UK Economy may have disappointed in December (particularly retail), through 2010 we saw our Financial Services, Mining/Metals, and Hi-tech Manufacturing clients rebound.

年更强 (Stronger In 2011)

The outlook for Q1 2011 is better than many thought. For the services sector at least, it looks like the December 2010 disappointment really was snow related, or was everyone at home with flu? This year promises more investment activity, increasing demand for raw materials (China again), and growing orders for our UK Hi-tech manufacturers.

We expect the trends of 2009-2010 to continue for 360is:

• Increasing average project size
• Steady rate of new client acquisition
• Increasing number of projects per client
• Steady geographical focus on UK, South East
• Increasing client diversity beyond historic finance/telecoms base
• Steady ratio of bookings to billings to backlog, no credit risk
• Conservative recruitment strategy focused on "talent" not "resource"

科技是一个礼物 (The Gift Of Technology)

What technological gifts did 2010 bring our clients, and how can we best use them to increase their prosperity in 2011?

Multi-Core Systems

Multi-core systems have been around since at least 2005. One fact of which you may not be aware is that x86-64 CPU manufacturers have long since given up on making CPU cores go faster. Faster cores require more exotic materials, more expensive cooling apparatus, more complex micro-architectures with only marginal performance gains, and present all sorts of problems with manufacturing yield. That last point frightens shareholders to death. Instead, today, Intel and AMD devote most of their efforts to making more cores per square millimeter of silicon. More cores means more processing capability. Problem solved, right? Not really.

While increasing the numbers of cores (made possible as transistors get smaller) does increase theoretical performance, in practice this must be balanced with the right amount of memory bandwidth and core-to-core interconnect design. Even then, our problems have only just begun. The fact is most software does not take great advantage of multiple cores, more serious still is the fact that most programmers lack parallel programming skills. Finally, there are many classes of computational problem which are serial in nature, and are never going to gain much from running on a multi-core CPU.

Wont Microsoft/Oracle/IBM/VMware sort all this out for me? Not really.

While technologies like virtualization (whole-system or zone-based) allow you to run many workloads on a single CPU (keeping many cores occupied at once) they do nothing to speed up the execution of any one task or thread of activity. In order to speed up your IT from the end-user's perspective you may have to resort to more carefully considered system performance tuning, and that may require a deeper understanding of systems hardware and application software than your staff posses. The really big gains in performance can't be had by simply adding a product here and a patch there.

360is consultants have extensive experience in squeezing the maximum performance out of an infrastructure. Using a toolkit of repeatable intellectual property we are often able to increase performance even for serial, single threaded processing through our formal methods approach. Find out more about our performance practice.

Non x86-64 Servers And Other Novel Hardware

If like most of our clients, you are in the UK, then IBM Power CPUs calculate your insurance premiums, Oracle SPARC processors compute your taxes, and Intel Itaniums keeps your commuter train running on time (mostly). If you are out of work, then it's an IBM z10 CPU that you have to thank for paying your benefits. While Intel or AMD x86-64 systems dominate in the front office, the back office is more mixed, and with good reason. No, these particular systems do not run Windows, or Linux.

This year x86-64 front-office systems will be joined by new servers based upon ARM, Loonsong, Atom, and SPARC-T3 CPUs. So the next time you visit your hosted/colocated systems in a shared datacenter, keep an eye out for them. If you want to know how these systems might provide a competitive advantage to your business, get in touch. 360is has a record of working with novel hardware platforms that increase the profitability of our clients.

The Inevitable Spread Of Productivity Services

Technology vendor's continue to channel hundreds of millions of pounds a year from their marketing budgets into rebranding products and services "for the cloud". At 360is we call this "cloudwashing", it's much like the "greenwashing" that the same vendors underwent a few years ago. However, through the fog of cloudwashing there is value and real adoption happening in the world of cloud services. At 360is we are users of cloud-based productivity tools like Evernote, Dropbox, ManyEyes, and Google Chrome (as a tool to access other Google services). These productivity services offer an inbuilt ability to work anywhere, on any device, over any network. Whether or not they conform to your security policy, your users will soon be using services like these. If they make life easier then they will spread in the same way that instant messaging spread a decade ago.

360is can help you select and standardise upon productivity tools and provide secure remote access to your confidential information.  

VDI - Virtual Desktops - Desktop As A Service

Virtual Desktop deployments continue to grow in number as both large and small clients display increasing acceptance of this method of desktop delivery to end users. The primary drivers for VDI deployment remain:

- Avoidance of desktop hardware refresh 

- Ease of migration to Windows 7 from XP

- Stronger Disaster Recovery/Business Continuity

- Ability to manage/maintain more desktops with fewer/static IT staff

360is have executed a number of virtual desktop projects using all the major vendor products for large and small organisations in the public and private sector, using a variety of endpoints including thin clients, tablets, and mobile devices. Find out how.

If you would like to discuss any of what you have read about with one of our consultants then we would be happy to meet with you at your offices or at our London or Wokingham sites. Simply get in touch.

All that remains is for us to say is Happy New Year and finally"gung hay fat choy"(*)
(*)"may you become prosperous"

Citrix XenServer Certified at EAL2 Common Criteria

Back in April we discussed XenServer's recent submission to the Common Criteria (CC) scheme. Based upon previous evaluations, we predicted a 6-month end-to-end process. True to form the guys at SiVenture have delivered on time.

As is common with other virtualization technologies that have been through the CC process, the investigation work centered around separation of virtual machines, their memory, virtual disks, and execution on the CPU(s). The method of secure administration was also investigated.

This is good news particularly for those UK Government buyers who need a CC approved virtualization platform that will help to reduce OPEX through lower power consumption and CAPEX though XenServer's lower license cost.

There is going to be a lot more white space on this chart in 2011-2012 than there was in 2007-2008 when it was compiled, so a lower-cost method of virtualization will be a welcome addition to the procurement department's product list.

Citrix XenServer & VMware ESX Common Criteria Certification

As some of you already know, Citrix have sponsored XenServer, XenDesktop, XenApp, and Netscaler into the Common Criteria program for Information Technology Security Evaluation (CC). We have had several questions about the announcement and what it means for both VMware and XenServer in particular. Since 1 or 2 of us at 360is were there way-back when Common Criteria & ITSEC first started seeing mainstream IT products submitted for evaluation, we thought we would take this chance to answer some of your questions in this posting.

What is Common Criteria (CC)?
CC is an attempt to reduce duplication of effort of the IT security evaluation functions of several governments (6 in all). CC is an international standard that describes how product vendors may make claims about their security software or hardware, and have independent laboratories investigate these claims and certify the product has been designed and built in a way that meets the vendors claims and can be relied upon to function as described.

What is EAL?
Within CC, products are examined to an Evaluation Assurance Level (EAL). EALs are numbered currently from 1 to 7, with 7 being the most detailed, most stringent level of scrutiny that a product is put under. VMware ESX and ESXi 3.5 were certified to EAL4+ in February 2010. Citrix have submitted their products for the EAL2 process this month.

So An EAL4 Product Is More Secure Than An EAL2 Product?
No. This is probably the most common misconception about CC. A higher EAL number means only that the product passed a deeper level of scrutiny of the vendor's claims. For example, I might have a simple weak encryption application that passes EAL7, because it was found to meet my claims without fault, and its design and execution was found to be exemplary even when "put under the microscope" of EAL7. A much stronger encryption application, that would protect my data better using a strong algorithm, might only be submitted for EAL2, because I want to get some kind of basic certification quickly so I can sell to my government customers. There are also a number of misconceptions around how vendor claims are tested. In our experience, code review is only done at EAL 6 or 7 for example.

What Claims Might A Vendor Make?
The scheme allows for vendors to tailor their claims based upon their product and the way it is to be used. This means that a Firewall is not subject to the same investigation as an Email system or a Desktop OS. A vendor with a Firewall might claim that in order to administer the device you must pass 2-factor authentication, and can only do so over a strongly encrypted connection, and that there are no other possible way of gaining admin access. Such a claim would be investigated to the required depth as part of the CC certification. Another example of a popular claim might be "the admins can't automatically read everyones Email". CC tests these claims are true to a certain depth. Documentation is a vital part of passing an evaluation.

Does It Matter What Version Gets Certified?
Yes. It matters very much. Just because version 1 of a product received certification, it doesn't mean that v2 or even v1.0.1 is certified. The product must be resubmitted into the evaluation process for it to be re-assessed. This is because CC evaluates vendors claims for a given version and even a given configuration of the product. It is normal for a product to be obsolete by the time it passes certification. You could argue this is made worse by the pace of change in commercial software, with many companies pushed to make 1 major release per year and 2 functionality patches, alongside the 4 critical security related hotfixes, all of which take a product outside its certified condition.

How Long Does It Take?
For product of similar size/complexity, the higher the level of assurance the longer the evaluation takes. Expect to see an XenServer (we presume v5.0 or v5.5) certified within the next 6 months. A CC certification can be an expensive business, in our experience of the process (mainly CheckPoint-FW1 and Harris CyberGuard) the cost is £200K-£400K.

Who Cares If A Product Is Certified?
Mostly it is government buyers or those who have to work closely with government agencies, exchanging information with them, or connecting directly to them. Often such customers are restricted to choosing products from the catalogue of evaluated solutions. However, depending on the sensitivity of the information being handled by the IT, an EAL certified may not even be required.

Where Can I Find Out More?
As ever, Wikipedia is a good start.
Check the Portal for certified products.
Or talk to us.

Updated 14-09-2010: XenServer has now been granted it's certification.

Performance Expert Services

Over the last 12 months we have seen a sharp increase in clients targeting poor performance of systems and applications, particularly around storage, virtualization, and wide area networking. As a result of which we have formalised our professional services for performance investigation, reporting, and remediation. We call this our Performance Expert Service.

We provide fixed-fee projects where our consultants work either independently of your vendors, or with their assistance, to get the performance you need from mission critical systems. When more performance cannot be liberated from existing assets, we are able to provide a quantified case for additional investment, couched in business terms.

While everyone strives for more performance, it is only since the credit crunch and economic slowdown in the UK that there has been a significant increase in these projects for 360is. We put this down to factors impacting IT departments like reduced staffing, frozen budgets, and lack of visibility into the future. Not since the great Y2K spending freeze has there been such a focus on making do with what you have and ensuring it runs efficiently. Bad news for product vendors, but not necessarily bad for end users. Many found the Y2K hiatus in new IT deployments to be no bad thing, some even said IT had never worked so well.

Benefits

• Get next years hardware performance now. (useful if your capex budget has been frozen)
  
• Free up staff from nursing overloaded systems. (good if your team has recently shrunk)
  
• Reduce license costs through higher utilization of fewer systems. (interesting if you just got your support renewal quotes)
  

Our consultants are there for when performance problems defeat your IT team’s efforts, and are beyond the scope of vendor patches and support contracts. Contact us to find out how we can solve your performance problems.

Web Conference, Virtualization Hardware

We are holding a 15 minute webinar on choosing dedicated virtualization hardware. Some of you will have already received the invite directing you to register.

Click on the date below to register for a place and receive the calendar appointment and PDF agenda via Email. Nearer the date and time you will also receive a brief Email reminder.

Save the date: 10am, Friday 19th March 2010, to be held online.

Agenda

"How Virtualization Demands Are Changing Hardware Choices, The Emergence Of A Virtualization Appliance"

Registered attendees will receive further information on the event and a full agenda. A recording of the material will be available for a period after the initial broadcast.

Updated 19-03-10 10am

A recording of the webinar (40MB) is now available. If you cannot read PowerPoint (.pps) files then please contact us for an alternative format.

360is Represented at Microsoft Virtualization Round-table

360is were delighted to be able to take part in this months virtualization round-table, held at Incisive Media's central London offices. We spoke alongside representatives from Microsoft and Computerlinks. The panel debated the mainstream adoption of virtualization occurring now the software is mostly free, virtual desktop infrastructure, and the skills gap that exists in many IT/MIS departments around this new wave of software and hardware infrastructure.

The panel concluded that virtualization and the abstraction of "nuts and bolts" was already fundamentally changing the nature of conversations between Vendors, VARs, and clients, and would likely change hiring practices as companies sought business technologists over traditional IT skills.

The full text of the article is available online.
A copy of the print magazine is available on our site.

Autumn Virtualization Seminar, London & Cambridge (NOW FULL)

We are holding an invitation-only seminar on mission critical & production systems virtualization in November. Some of you will have already received the invite directing you to register.

Choose the date/location below to book your place and receive the calendar appointment and PDF agenda via Email.

19th November: Royal Mint, Royal Mint Court, London, EC3N 4HJ.
26th November: Trinity Centre, Milton Rd Cambridge, CB4 0FN.

Registered attendees will receive further information on the event and a full agenda.

Agenda
09:30 Arrival & Tea/Coffee

10:00 Welcome & Introductions - 360is Ltd

10:05 Running Citrix Virtualized In Production - Citrix Systems Inc

• Netscaler VPX, XenDesktop, XenApp.
  
• Best practice advice for reliable virtualization of Citrix software.
  
• Citrix end-to-end virtualization strategy for agile infrastructure.

11:00 Break

11:10 Virtualization Hardware - The Virtual Machine Company Ltd

• How customer requirements shaped virtualization hardware.
  
• How to achieve ultimate VM density and lowest TCO.
  
• A post-server approach to virtualization.

11:40 Case Study, “Virtualising A Billion Dollar Database” - 360is Ltd

• Maximising VM density without compromising performance & availability
  
• The virtualization experience, one year on.

12:00 Finish and Q&A.

12:15 Tour (Royal Mint only) followed by light lunch.

Cancellations & Additional Invitations
Places are limited, if you are subsequently unable to attend then please let us know so that we can move someone else up from the waiting list. If you did not get an invite and would like to attend, or wish to recommend a colleague, please contact rob.gilson@360is.com.

---

Update 16-11-09: The seminar is now full and there is a waiting list for those unable to get in this time around. Please notify Rob Gilson (above) if you have registered but are now unable to attend.

---

Update 20-11-09: Thanks to all who attended the Seminar. For those who were unable to make it, or who want copies of the presentations, please see the following links:

• 360is Intro & VMCO Hardware (7MB), Rob Gilson - 360is
  
• Citrix Update (11MB), Damian Saunders - Citrix Inc
  
• Virtualizaing Difficult Workloads (2MB), 360is
  
• VMCO Case Study (6MB), 360is
  

360is Awarded Platinum Partner Status by The Virtual Machine Company

360is are delighted to be the first UK reseller awarded Platinum status in recognition of their achievements as the partner with the highest unit shipments in 1H 2009.

360is continue to see strong growth in the hardware virtual appliance market, fueled by tightening operating expenditure, increased hosting/colo costs, and growing adoption of virtualization in business critical infrastructure. Since their launch in early 2008, Virtual Machine Company appliances have provided superior VMs-per-watt and VMs-per-square-foot to enterprises, hosting providers, and compute-intensive industries, when compared to general purpose x86 servers.

In a recent press release, Steve Barnett, Virtual Machine's Managing Director said "The 360is team consistently over-deliver, their mixture of expertise, execution and customer service means we're proud to have them as a platinum partner".

About The Virtual Machine Company
The Virtual Machine Company manufacture the worlds most powerful & energy efficient virtualization appliances, offering the densest VM ratios of any comparable platform. Led by Steve Barnett, the former Managing Director of Check Point Software Technologies. Their appliances are designed from the ground up to provide ultimate performance and return on investment in a virtualized environment, and each is backed up by enterprise quality support and services. Each device benefits from performance monitoring, capacity management & planning tools that ensure the optimum configuration of your virtual estate, and access to free In-Cloud services that take estate management to a new level.

Winner of June TomTom Give Away

Back in June we gave away a new TomTom GO 530 SatNav system. We can now announce the lucky winner as Ms K.Pavitt, who registered an opportunity with us for a virtualization project beginning in August. Congratulations!

360is wins Virtual Desktop Infrastructure Contract at Wren Academy

Wren Academy is a new 1000-place secondary school in the London Borough of Barnet. The Academy, specialising in Design and the Built Environment, offers state-of-the-art ICT facilities. Over £1 million will be spent on hardware and infrastructure supporting the aspiration that every student will have plentiful access to Information Technology.

360is is rolling out a complete campus-wide VDI solution for students and staff. The Citrix XenDesktop solution is based upon a mixture of thin and thick clients, and virtualized server-side. 360is drew upon prior experience of implementing complex VDI projects in the public and private sector to win the contract.

Virtual Iron Scrapped!

The acquisition of Virtual Iron was announced by Oracle on the 13th May this year. Oracle already had its own OracleVM product and can now add Sun's xVM software to the pot. Both of those products are (like Virtual Iron) based on open source Xen.

While this consolidation is good for customers in the long term, providing 3 strong competitors to the incumbent VMware, in the short term it was hard to see Oracle maintaining so many similar components to their stack. Sure enough something had to give and last week Oracle wrote to partners confirming that there would be no new sales of Virtual Iron, and that its features would eventually be subsumed into OracleVM. Virtual Iron customers should update themselves on the situation here.

Although we have already been contacted by an unhappy Virtual Iron customer looking to mitigate the risks in operating a platform whose development has been ceased, at least Oracle made their decision to melt-down Virtual Iron quickly, limiting any uncertainty.

If you are a Virtual Iron customer, and need to migrate to a supported, Xen-based platform with a future. We can make the transition as painless as possible. Given that most Virtual Iron customers have tight cost constraints, we are currently recommending Citrix XenServer as a replacement. There is even a completely free version that offers enterprise features like live migration, shared storage integration, and OS templates.

During this difficult period, we offer a free consultation with one of our engineers, to scope the size and shape of any possible migration from Virtual Iron to XenServer, or to consider other options. Simply get in touch.

TomTom GO 530 To Give Away

If you register your Virtualization or Security Service, support or training requirement with us before the end of June 2009, and attend a meeting with one of our consultants, you will be entered into a prize draw for a TomTom GO 530 Sat Nav system.

To register your project and to arrange a meeting, email your contact details and an outline of your requirement to Rob Gilson. Details of the lucky winner of the TomTom will be announced on our site on the 30th of June.

Citrix XenServer Case Studies

Over the last 3 years, our consultants have delivered about 50 virtualization projects for clients as far away as India. We have worked with all the major hardware and software vendors to solve real business problems. A few of these experiences were captured as case studies and can now be made available to you.

What makes these documents a little more interesting than an average case study is that they have been written up-to a year after completion of the project, and include an update on how the new infrastructure is performing, and how accurately the technology delivered on promises. First out of the trap are several Citrix XenServer success stories, watch out for VMware and Hyper-V later.

Multimedia Distribution & Switching, virtualizing difficult workloads.
Financial Data Warehouse, how to virtualize a billion dollar database.
Multilingual Call Center, navigating the vendor jungle.

Can you see your current situation reflected in these stories?
Are the benefits gained by these clients interesting to you?
Have you thought about the ways we can help you this year?

XenServer Administration Poster

Since XenServer was made freely available for download a few weeks ago, there has been a surge in companies new to virtualization, taking their first steps into this area. As you would expect, this has resulted in lots of questions on the user forum and calls to our help desk.

360is have produced a XenServer administrators poster, in A4 format, for both new and experienced admins to download for free. Do let us know what you think, and make any suggestions for improvement via the normal channels.

UPDATE: 28-04-09
The response has been overwhelming, with more than eight hundred downloads. For those of you that asked for more glitz, and as part of 360is "printer toner industry stimulus package", please check out the new "midnight edition".