VMworld Europe: An Opportunity Missed

He was at VMworld all week (alas, budget considerations kept yours truly firmly glued to his desk in Westminster, MD -- which, by all accounts, is nearly as scenic as Cannes), and filed multiple reports, followed by a wrapup. To summarize his summary, he says that, basically, VMworld Europe was a gigantic missed opportunity for VMware. He wrote:

"The explicit message of this first European edition of VMworld has been: VMware sponsors are worth much more than VMware itself."

If I can paraphrase what I think his meaning is, Perilli's saying that VMware touted its partners a great deal more than itself, which he (and I) consider to be a big strategic blunder.

Perilli goes on:

"Despite the unique opportunity to talk to so many European companies for the first time, VMware co-founders Diane Greene and Mendel Rosenblum didn't dedicate much space to the company vision.

The two preferred to give a more than remarkable part of their time to some prestigious partners (IBM, HP, Dell and Fujitsu Siemens) which didn't add any value to the discussion.

Customers and prospects looking for guidance from two of the brightest minds of the last decade, found themselves looking at a sort of prime time showcase for OEMs.

An unacceptable debut considering the incredible amount of topics that VMware executives could cover on stage."

I watched the Webcast of CEO Diane Greene's keynote speech, and was similarly underwhelmed. Greene mostly spoke in generalizations, and talked about how virtualization, and specifically VMware, is changing the datacenter. All true, no doubt; but I found the "Vision Thing" sorely lacking in her presentation, as well as a substantive discussion of what were a slew of important new product releases. How could they give such short shrift to VMsafe and the new automation products? If I were an attendee, I'd be more interested in the cool new stuff VMware was releasing than watching a parade of OEM vendors touting their servers.

(A related note: It was awesome to see sister publication Redmond magazine mentioned by name during Greene's keynote! Look for it at about the 25-minute mark of the "Day 1 Webcast", where Greene talks about ESX Server's reliability).

VMware faces a major challenge from Microsoft, which pushed Hyper-V and virtualization relentlessly at its product launch last week. That indicates to me that Redmond is training the big guns in VMware's direction, and will spare no expense to climb that mountain. VMware needs to respond to this challenge immediately, and had a chance to play up its expanding product line. While there was certainly some of that, it felt very, very light, and inconsequential.

Perilli says one other thing that intrigued me: his canvassing of a number of attendees found a general impression that many of the courses were too basic in the information they presented. If you were there and went to some of those classes, I'd love to hear from you, to see if you agree with him, and what you'd like to see done differently.

Posted by Keith Ward on 03/03/2008 at 12:48 PM1 comments

VMsafe Moves Security to Center Stage

VMware describes its functionality well on a product page: "VMsafe enables third-party security products to gain the same visibility as the hypervisor into the operation of a virtual machine to identify and eliminate malware, such as viruses, trojans and key-loggers." This, of course, is a very, very good thing.

A strong list of security companies and other vendors have already signed up for the program, including Shavlik, Kaspersky, IBM, Catbird, McAfee, F5, Symantec and more. They'll quickly integrate VMsafe in their products, giving virtualization admins a lot more peace of mind. VMware itself has promised to bake VMsafe into future versions of VMware Infrastructure.

This Network World story on VMsafe brings up a good point about malware vs. security software in a virtualized environment:

"Previously, security software really had no advantage over malware that's infiltrated a virtualized server, says Parag Patel, vice president of alliances at VMware. The visibility into the hypervisor afforded by the VMsafe APIs gives security software a higher degree of privilege than malware."

Initially, VMware has said VMsafe will work with ESX Server, its flagship hypervisor. I haven't been able to determine if it will work with ESX 3i, the embedded hypervisor going out with certain servers from IBM, Dell, HP, Fujistu and others, as announced last week. I've got a query into VMware now; I'll update this when I get a response.

This vendor partnering should mean quick adoption of VMsafe; it's also a subtle reminder that virtualization isn't a bulletproof technology. Certainly, there are a number of inherent security benefits of virtualization: for instance, keeping applications in a bubble, through application virtualization, means any viruses in the programs won't spread from server to server; it also keeps them from interfering with each other and causing system instability. In addition, using a Web browser in a VM means security from Internet malware. There are many more, too.

But virtualization also introduces new issues. With the ease of creating and updating new servers comes the danger that a virus that slips in through a patch, for example, will infect 5,000 virtual servers, instead of just 200 physical servers. It's also my anecdotal experience that admins don't spend much time on virtualization security. Having these third-party products include VMsafe means that shops which use them -- which is most, since almost every datacenter has a third-party security product or suite -- will now get a version of that product that includes VM security (at least those that use VMware.)

This is a very positive, very needed step by VMware. As of yet, no dates have been released as to when VMsafe will be available. We'll be doing our part in the fight for better virtualization security, too, including lots of security coverage in the upcoming magazine and here on the Website.

Posted by Keith Ward on 03/03/2008 at 12:48 PM0 comments

Microsoft Pushes Virtualization

That's great news for those of us in the virtualization industry.

Although I wasn't at the overhyped event in Los Angeles, a number of 1105 Media editors were there. Becky Nagel, who wrote the story for our Websites, says that virtualization was a key topic throughout the presentation. And the fabulous Mike Domingo wrote a guest blog referencing a slide that Ballmer put up, talking about the top new features of each product. The No. 1 feature for Windows 2008? Hyper-V, Microsoft's new, bare-metal hypervisor, a beta version of which will be included in the server.

In a way, it's analogous to what VMware recently did when it announced deals to embed a lightweight version of ESX Server into OEM hardware from Dell, IBM, HP and Fujistu-Siemens. VMware is making deals with hardware vendors, of course, and Microsoft is incorporating this into the base OS; the key in both instances, however, is slipping the product in by bundling with another, already established product that's widely used in the industry.

The idea is that when you fire up your HP DL580 server, you have a built-in on-ramp to virtualization via ESX 3i. Same thing with Windows 2008; instead of downloading eval versions of ESX Server, Virtuozzo, XenServer, Virtual Iron or whatever, then configuring the software and trying it out, Microsoft undoubtedly hopes the little admin voice in your head says "Hey, I can just fire this puppy up, since it comes with my brand-spanking-new OS; no muss, no fuss. Let's try it out first, then we'll look at the other options if this free hypervisor doesn't do what we want." Tempting, no?

Becky's story quotes Ballmer on Microsoft's high-level virtualization strategy:

""Today we launch our virtualization strategy in earnest," he said. "We want to democratize virtualization," making it easy, efficient, interoperable and cheap enough to run on as many servers as a company desires, he said."

Ballmer said something else that struck me. Back to Becky's story:

""The thing that is quite unique about our approach to virtualization is that we take virtualization as just a piece of overall management," he continued. "You don't manage [virtualization], you manage a datacenter." "

VMware's management app, VirtualCenter, is for managing virtual machines [VMs]; currently, it doesn't allow management of physical machines. Of course, those OEM vendors mentioned before all have sophisticated management capabilities, so managing both virtual and physical environments isn't a nightmare. Still, there is something to be said for managing both from a single console. Microsoft will have that with its System Center Virtual Machine Manager; I wonder how long it will be before VMware comes out with a similar announcement.

In all, it's good to see Microsoft putting so much emphasis on virtualization in Windows 2008. It shows Redmond's commitment to the technology, and that there's no going back to the way things were.

Posted by Keith Ward on 02/28/2008 at 12:48 PM1 comments

Hyper-V: Life in the Slow Lane

Apparently, loading an OS into a Hyper-V-created virtual machine (VM) is like trying to get around the Washington D.C. beltway at 7:30 a.m. on a rainy Monday morning -- bring a book to read, because you aren't going anywhere fast. The problem, Armstrong relates, is that the emulated devices loaded with the OS were optimized to work with Microsoft Virtual Server, but due to Hyper-V's different architecture, that optimization has been removed. (Emulated devices are things like network adapters and mice that the host OS virtualizes. Emulation adds a lot of processor overhead, reducing performance.)

Microsoft decided not to re-optimize these emulated devices because it's moved to a new model with Hyper-V, that of synthetic devices. Synthetic devices are virtualization-tuned and work much faster than their emulated brethren. Synthetic devices, however, are installed after the OS is up and running; so during the installation process, non-optimized emulated devices are being used instead of the speedy synthetics.

Once loaded, the VMs work fine, and are faster than similar VMs in Virtual Server, according to Armstrong; it's just that putting them in place is laborious.

Armstrong says that this issue isn't likely to change for the first version of Hyper-V, so you're stuck with it for awhile.

Is this a big deal? It's hard to know initially. But one poster who responded to Armstrong's blog says it will: identified as "Xepol", the poster wrote, "Slow as molasses OS installs are a definite barrier to adoption. Might want to seriously consider that before calling any decission "final"."

What say you? Have you experienced this problem? If so, I'd love to hear from you.

Posted by Keith Ward on 02/27/2008 at 12:48 PM6 comments

Heroes Happen Where?

Yawn.

The issue, of course, is that VS 2008 was released last year; SQL 2008 won't be released until the summer or later; leaving Windows 2008 as the sole product actually being launched today. Does that thrill your toes?

Microsoft, of course, will try and trumpet this day as the pinnacle of civilization; that's what they do. The reality is somewhat less impressive, however: One product out the door.

And there was great rejoicing all across the land.

This isn't to minimize the importance of Windows 2008, which, by all accounts, is a very strong offering right out of the gate -- and something needed after five years of waiting since the last major server OS from Redmond. But Microsoft, with typical blow-hard-iness, started building anticipation a long time ago for what it originally termed a "Global Launch Wave" of epic proportions. When it started looking more and more like these releases weren't going to be synched the way Microsoft hoped, the company changed slogans to "Heroes Happen Here," which, for my money, is about as meaningful as if they'd changed the slogan to "Red Tricycle Bulldozers".

Major, major yawn. Microsoft, stop letting your marketing department run the company. In situations like this, it just makes you look dumb.

Posted by Keith Ward on 02/27/2008 at 12:48 PM6 comments

Hyper-V Explained

This morning, I found a great resource for definitions about Microsoft's new hypervisor, Hyper-V (for my money, still the coolest name for a Microsoft product ever. They didn't drab it down when they announced the final name of the product. I mean, isn't Longhorn 100,000 times cooler than "Windows Server 2008"? I usually love Microsoft's code names and hate their formal names; not in this case. First, it was "Viridian", which is cool. Then it was "Windows Server Virtualization", which has that hideous stench of Microsoft marketing hanging all over it; so naturally, I assumed this would be the final name. Then came "Hyper-V." Yes! It's bad (in a good way)! OK, detour over, back to the main highway.)

Ben Armstrong, who blogs as the "Virtual PC Guy" over at Microsoft, is a virtualization product manager. He's just published a terrific list of definitions for Hyper-V. He explains everything very clearly, and doesn't assume any knowledge on the reader's part. If you've ever wanted to know how emulated devices differ from simulated devices in the Hyper-Verse (and haven't we all?), he'll explain.

It's already on my list of foundational resources. Consider adding it to yours.

Posted by Keith Ward on 02/26/2008 at 12:48 PM2 comments

Very Un-Guest-Like Behavior

As of Monday morning, a fix hadn't been posted on VMware's Website. The only solution at the moment is to turn off shared folders, which is the source of the problem. That, of course, seriously reduces the functionality of the affected products. Not good news for VMware.

The flaw is analagous to an old friend staying in your home. The friend, unknown to you, has developed a drug habit over the years. One day when you're off at work, he steals your silver and your new MacBook Air and pawns them to feed his need for speed.

In this case, a program running in a guest can take control of the host machine and muck around good, including creating and modifying executables. In other words, you'd be completely hosed.

The affected versions of programs, according to VMware:

Windows hosted versions of

• VMware Workstation 6.0.2 and earlier
• VMware Workstation 5.5.4 and earlier
• VMware Player 2.0.2 and earlier
• VMware Player 1.0.4 and earlier
• VMware ACE 2.0.2 and earlier
• VMware ACE 1.0.2 and earlier

VMware Fusion is unaffected -- it's only the Windows products. Also note that VMware Server and ESX Server aren't vulnerable.

Shared folders in general is a good idea. Very often there's a need to share files between the guest and its host. For instance, I use Fusion on my MacBook Pro. There are often times when I need to transfer data to and from Office files on my respective OSes -- Office for Mac on the host (OS X), and the version of Office that resides in my Fusion-housed guest, Windows XP. Ideally, the only files that can be read and written to are the ones in the shared folders. The flaw, however, allows the malware in the guest OS to infiltrate the entire file system of the host. And that's a bad thing, as you've probably guessed.

VMware states that the shared folders feature is disabled by default in those programs. That's good (and a security attitude that would have saved Microsoft, for instance, tons of grief if it had instituted from the beginning). But it's hard to imagine anyone working in a VM for more than an hour without needing to enable shared folders, so my guess is that shared folders is "on" in most environments.

Here's VMware's instructions on how to disable shared folders:

To disable shared folders in the Global settings:

1. From the VMware product's menu, choose Edit > Preferences.

2. In the Workspace tab, under Virtual Machines, deselect the checkbox for Enable all shared folders by default.

To disable shared folders for the individual virtual machine settings:

1. From the VMware product's menu, choose VM > Settings.

2. In the Options tab, select Shared Folders and Disable.

Do not mess around with this vulnerability. If you're an admin with Workstation, Player or ACE in your environment, make this Job No. 1 today.

Posted by Keith Ward on 02/25/2008 at 12:48 PM0 comments

Novell Buys PlateSpin

PlateSpin adds to Novell's portfolio of virtualization management offerings, the space within virtualization that Novell appears to want to make its bones. PlateSpin is most famous for two products: PowerRecon and PowerConvert. PowerRecon is an analysis and capacity planning tool that examines an IT environment, helping determine the best way to integrate virtualization; for instance, which servers are the best candidates, according to capacity and power, for server consolidation.

PowerConvert is a workload optimization tool. It's often thought of as a P2V app; in other words, it virtualizes the properties of a physical server, including the operating system, data and applications, and enables it to be moved to another physical server. PowerConvert, however, goes beyond that basic description, allowing not only P2V, but conversion in any direction: virtual-to-virtual, physical-to-physical, and virtual-to-physical.

PlateSpin's latest offering is Forge, a hardware-based disaster recovery appliance. It can handle up to 25 VMs or physical workloads, and provides near-instantaneous recovery in the event of an outage.

Novell already has a management platform. It uses the Xen open source hypervisor, and runs SUSE Linux Enterprise Server on top of that. Its management application is ZENworks Virtual Machine Management, which does at least some of what PowerRecon does; for the most part, however, PlateSpin's products will add a lot more functionality to the very basic abilities of ZENworks. It also propels Novell into the disaster recovery space with Forge, and adds, from what I've been able to glean, Novell's first hardware offering.

From where I sit (hour after hour after...), this looks like a great acquisition for Novell. The former blood enemy of Redmond (and I still chuckle when I see NetWare listed as an actual product on Novell's site) has smoked the peace pipe with Microsoft, which has helped Novell enormously since its entry into the virtualization space; now it's picked up a valuable player which will dramatically extend its reach in the virtualization management and DR niches.

For PlateSpin, an innovative company that realized the potential in the virtualization market before many other companies, it's hitched its wagon to another up-and-comer in this virtual world. If it can be left alone enough by the suits to continue to be fresh and agile, while leveraging the new cash infusion, it could be a happy marriage indeed.

Posted by Keith Ward on 02/25/2008 at 12:48 PM4 comments

Xen and the Art of Demystification

Well, after much research and many interviews, I believe I have a handle on Xen, and will try to clear up some of the misinformation out there.

First, Xen is an open source hypervisor. It's maintained by the Xen Project, which houses the source code and remains the home of the Xen community. It was originally developed by the company XenSource, before XenSource was bought by Citrix last year for $500 million. What that means is that XenSource, as a product, no longer exists; the Citrix version is now called XenServer.

Xen is still going strong, though; in fact, it's healthier than ever, given the cash infusion from Citrix after the acquisition.

Simon Crosby, former CTO of XenSource and now CTO of the Virtualization and Management Division at Citrix, emphasized to me that Citrix absolutely does not interfere with the Xen project. "It's very important that there is a church-state separation there," he says. Xen is "still community-driven ... and guided by an advisory board." (As an aside, Crosby is one of the founding fathers of the new virtualization industry. His blog is an absolute must-read for anyone who wants to know what's really going on in this space.)

Being open source, Xen can be used by anybody, or any company, that wants it, as long as they abide by the GNU General Public License (GPL2). And, in fact, many virtualization vendors are using Xen. They include Citrix (of course), Virtual Iron, Sun, Red Hat, Novell and others. They differ from companies that have built a closed, proprietary hypervisor like VMware, Parallels and Microsoft (more on Redmond in a moment).

Xen is a trademarked name and can only be used if a company follows certain rules on how Xen is incorporated into their products. Basically, according to Crosby, "The interface between a guest and the hypervisor is really what defines that whether [a hypervisor] is or isn't Xen. If a product derives from the Xen codebase and is compatible in key interfaces, it can be described" as a Xen hypervisor. How vendors the use the Xen hypervisor differ is in what they build on top of Xen; for instance, what type of migration technology a company uses to move virtual machines from one physical server to another.

Another common misconception surrounding Xen is that Microsoft's new hypervisor, Hyper-V, is based on Xen technology. This is simply false. Xen and Hyper-V were "built totally separately," says Mike Neil, Microsoft's general manager for virtualization. "There's no common lineage in technology."

Crosby affirms Neil's statement. "Hyper-V is entirely Microsoft-created codebase ... there is absolutely no Xen in Hyper-V."

The confusion about Hyper-V's roots may arise from their similar architectures. Notes Neil, "From an architectural standpoint, we and Xen have taken the same tack of building a very thin hypervisor, and then moving functionality into partitions -- into the virtual machines."

Again, Crosby and Neil are in agreement. "Hyper-V shares core architectural principals" with Xen, he says. "But their implementation is entirely different. They [have] different APIs; their functions and protocols are different. But architecturally they are very similar."

Citrix and Microsoft have also taken great pains to make sure their hypervisors get along. For instance, any VM created in Xen can run in a Hyper-V environment, and vice-versa. The long, productive relationship between the two software giants has transferred very nicely to their virtualization efforts. VMware, by contrast, is currently much more closed; it's a great irony that both Citrix and Microsoft, which have both taken many hits over the years for making proprietary software, have become much more open in the area of virtualization.

I hope this makes sense, and that you get some use out of it. It's complicated, but I would strongly recommend you research each of the different types of hypervisors to see the benefits and drawbacks of each before deciding on a solution. And your solution may involve using more than one type of hypervisor.

Posted by Keith Ward on 02/22/2008 at 12:48 PM2 comments

Risky Business: Migrating VMs Between Intel, AMD Procs

Virtualization allows this because it separates software from the underlying hardware, making it independent. But, like a college student that wants freedom yet still wants mom to wash the clothes which have been piling up in his dorm room for a month, it may not be completely indepenent. Mike DiPetrillo, a prominent blogger at VMware, stated recently that migrating a VM from an Intel-based server to an AMD-based one could cause big trouble.

Because of differing instruction sets between the chips, migrating between the two is a bad idea, DiPetrillo says, because

"Your app and your OS will crash. This can happen with VMotion and Microsoft Quick Migration. Actually anyone that does live migration will get impacted by this. There are several "user mode" instructions like this that we can't mask out at the virtualization layer."

Ben Armstrong, a program manager on the core virtualization team at Microsoft, essentially confirmed the problem on his blog, the "Virtual PC Guy's Weblog." Writes Armstrong:

"The root problem of moving a virtual machine with active processor state between physical computers with different processor capabilities is a real problem that all virtual machine migration solutions need to handle in one way or another."

Armstrong goes on to note that the same problem exists for server clusters.

"When you then try to perform a planned fail-over of a virtual machine it will be placed in saved state on the source physical computer, but when we try to restore it on the target physical computer we will detect that the processor is not compatible and will fail the request. The virtual machine can then be safely restored on a compatible system."

There is a somewhat kludgy workaround for Virtual Server that involves scripting, and changing a config file for Hyper-V.

If you're an admin with virtualization responsibilities, this is important information to know. Plan your hardware purchases accordingly; and, as always, plan your virtualization infrastructure before you start spinning out VMs here, there and everywhere.

Posted by Keith Ward on 02/19/2008 at 12:48 PM6 comments

Poll: Virtualization Gaining Steam

The poll, released yesterday, shows that 35 percent of companies are currently using virtualization, while another 9 percent are planning on implementing it in 2008, and another 18 are "seriously evaluating" virtualization. The survey studied attitudes about Windows Server 2008, which includes Microsoft's first hypervisor, Hyper-V, as a major component.

One interesting side note in the findings is that the stats for virtualization mirror almost exactly the percentage of companies (63 percent) that say they'll be upgrading to Windows Server 2008, expected to be available in the next two weeks. The margin of error in the report is plus or minus 3.5 percent.

In addition, 35 percent of respondents listed "future virtualization capabilities of Windows Server 2008" as a benefit. I assume that means they're looking forward to the final version of Hyper-V, expected to be available 180 days after Windows 2008 ships.

David Cottingham, director of product and partner management at CDW, said in a press release announcing the poll results that interest in virtualization is mounting. "This is consistent with the increasing interest CDW sees from customers in our offerings of server virtualization solutions ...There are a variety of options available, of course, and while built-in virtualization will not be in the initial Windows Server 2008 Release-to-Manufacture version when it launches on February 27, Microsoft is tapping into this market interest with their plan to integrate virtualization features into the server operating system later this year."

Cottingham is a little off in his remarks. Hyper-V will be shipping with Windows 2008; it will only be a beta product. But it's been pretty quiet on the complaints front so far for Hyper-V, which indicates that it's working pretty well. This is all subject to change, naturally, as more users get hold of it and start testing, but Microsoft has to feel pretty good so far about Hyper-V's stability.

The survey results, I'd say, are positive for the virtualization industry. I'm a little surprised to read that 38 percent of respondents have "no plans to implement" virtualization. One has to think that those numbers reflect mostly ignorance; it's hard to imagine having even a basic knowledge of virtualization and not wanting to take advantage of what it can offer. Hopefully this Website, along with our new magazine and other Internet resources like blogs, can move that figure downward by this time next year.

Posted by Keith Ward on 02/19/2008 at 12:48 PM2 comments

Hardy Boys/Nancy Drew: Man, I'm Old

Well, somehow we acquired (don't know whether my wife bought them somewhere, or they were a gift) a DVD set of all of them, and we've been watching some with our kids. Wow, what a shock -- they are horrible! It's amazing what your young mind will accept, that your much-older mind sees as complete, utter drivel.

The dialogue is laughable, and the plots inane to the nth degree. It looks like each episode cost about a buck to produce. In one two-parter, set in some Dracula's castle-like place, there's a scene where a bat gets into a room. Frank (the immortal Parker Stevenson) picks up a lamp and throws it at the bat. This is hilarious on several levels: first, this incredibly fake-looking bat is like four feet long, and keeps itself aloft by flapping its wings about once every five seconds. Second, who would try to take out a bat by throwing a huge, ugly, late-70s lamp at it? I was literally screaming with laughter, at what was supposed to be a highly tense moment.

That kind of stuff happens all the time in those episodes. The acting is, to put it kindly, amateurish. The Dracula episode featured another 70s icon - Paul Williams. Remember him? What flashbacks his hair and oversize aviator glasses brought back. Classic stuff. And he's only one; I recognized just about everyone from those episodes, as they all appeared in all the 70s shows. It's like there was one huge acting troupe for the networks, and they just shuffled them from show to show.

Actually, I enjoy watching the episodes. They are unintentionally hysterical. If you lived through that era you owe it to yourself to get an episode or two and relive your youth. It's sorta like watching Scooby Doo; with the benefit of age and experience, you watch them now with your kids and say "Hey, every plot is exactly the same!" At the time though, you thought Fred, Velma and Daphne were the most brilliant detectives this side of Sherlock Holmes -- or at least Frank and Joe.

And before you write in, saying "Why is this dork writing about this junk on a computer site?", see my disclaimer.

Posted by Keith Ward on 02/15/2008 at 12:48 PM8 comments