So, I’ve had an issue creating VMFS partitions from the GUI on the ESX 3.02 servers that I have built.   Given that I didn’t have it create partitions at installation because I wanted a bigger block size (its an 800GB local disk, so I want one VM to be able to use at least a majority of it, and the default 1MB block size means a .vmdk file is limited to 256GB, too small) so I elected  to wait until after the ESX installation. Doing this greeted me with a great “There was an unexpected error updating the partition table.”  Great, thanks for that descriptive error. So, to the command line we go:

fdisk -l (check what the last partition is)

fdisk /dev/sda

n (new)

default (start block)

default (end block)

t (partition type)

10 (partition 10, just created)

fb (vmfs type)

w (write config)

reboot (Reboot the host before you format the newly created local partition)

vmkfstools -C vmfs3 /vmfs/devices/disks/vmhba0:0:0:10

Go to VI Client, Refresh storage view and rename the newly created volume

W

You can align the VMFS volume as follows, before you do step 9:

X

b

1

128 (disk alignment, check your SAN manual for the correct value, 128 is correct in most cases…)

Now I need to figure out how to set blocksize while running that command and I will be set.

#vmkfstools –C vmfs3 –b 2M vmhba1:0:0:2

Found it.

–Nat

I’ve learned to trust the cold clone version of converter as my defacto conversion tool as you can be sure that it is going to do the job right the first time and not hit issues based on file system depth, etc.

The big question is where is this functionality with the newest version? Hardware support in the bootpe disc (especially network drivers!) is a big deal with newer hardware coming out. Let’s get it together VMware and release a new version. My cold clone CD appears to have last been updated in May 2009 – lame!

–Nat

Continuing the quest to install ESX 3.02, it came about that we need to enable some password security.  There is a couple things to do here, the first being to run the command “esxcfg-auth” – this command will bring up the list of commands available which include setting how long the password is valid, how often the password can be changed and when the warning will appear that the password for a given account is going to expire.

The meat of the password security is setting the password complexity rules setup.  I found that using the –usepamqc=values worked well.  Here is the verbose language:

-KjB
–usepamqc
Enables the use of the pam_passwdqc PAM module for password com-
plexity checking. It can be configured by passing a 6 value tuple
as the value. The tuple is formed from the following information:
– minimum length of a single character class password
– minimum length of a password that has characters from 2
character classes
– minimum number of words in a passphrase
– minimum length of a password that has characters from 3
character classes
– minimum length of a password that has characters from 4
character classes
This does not fully expose the abilities of this powerful PAM
module. See the pam_passwdqc man page for more information on how
to use this PAM module to enforce password rules on the user’s
password.
If you pass a value of -1 for any of the six tuple values,
that is understood as disable this option. An example of a tuple
is “8 -1 -1 -1 8 4”.

That worked well (with some different values of course.)  The last number, not described above is the number of times a character can appear in the password.  In this case, that would mean any single character could appear four times.

To add the a nifty warning message when a user logs on, simply create a file titled “motd” in /etc and add your message.  Easy!

–Nat

Dailytech Virtualization Article

Seriously?  A dark side to virtualization?  If virtualization technology is phased in by someone that has a clue this cannot be an issue.  Take something like Exchange 2007 – will the performance be worse virtualized?  Yep.  But what kind of horsepower do you really need for 100?  Or 1,000?  A modern server on the VMware HCL that is configured reasonably should be able to take 30 to 40 servers, which means that many SMB’s could get away with a two node cluster.

Virutalization allows for enormous flexibility.  Even if you run the most basic version of VMware ESX, you’ll get fully encapsulated virtual servers that you can back up cheaply with a product like vRanger from Vizioncore for complete, bare metal backups.  You could run two or three servers per host and see incredible DR and utilization benefits very cheaply.

If the issue for SMB’s is that they are going to be dumb and deploy a technology in a way that dreadfully increases risk that’s a not a technology problem.  That’s a stupid person problem.

It really sounds like the analyst wanted to say something to stir it up.  Congrats, man, but you just sound ignorant.

–Nat

I’ve gotten really spoiled recently (say, for the last two years) on setting NTP on ESX servers.  I found a nifty script that would take an answer file, do all the necessary firewall and startup tweaking and that was that.

Unfortunately, it only worked if I used a certain version of winscp and my Dell 620.  For whatever reason, any other combination broke the script (confirmed by other admins here).   Well, the 620 died a couple months ago, just after my cube migration.   I didn’t bother fixing the script because recent (as in published in 2008 or newer) versions of ESX added NTP configuration to the GUI and that has worked fine.

Now, I am installing 3.02 again and NTP configuration looks like this:

(1) update /etc/ntp.conf

restrict 127.0.0.1

restrict default kod nomodify notrap

server xxxx

driftfile /var/lib/ntp/drift

(2) update /etc/ntp/step-tickers

xxxx

(3) update /etc/hosts (if using hostname)

(4) using putty or similar to goto the console, login as root and run the following command. This opens the appropriate ports and enables the NTP daemon to talk with the external server.

root@esxhost# esxcfg-firewall –enableService ntpClient

(5) Restart the NTP service.

root@esxhost# service ntpd restart

(7) Now you can set the local hardware clock to the NTP synchronized local system time. Run:

root@esxhost# hwclock –systohc

Sheesh.   Props to the VMware Forums for coughing up that bit of goodness.

–Nat

Something to watch out for as older versions of ESX drop off the support list – 3.02 Update 1 is the oldest version of ESX you can install on the latest version of the Dell 2950.  Even the 2950 is likely to go away soon, so be prepared to step up to at least 3.5 if you want hardware support in the near future.

Another awesome preparation note is that in order to install a version of ESX previous to 3.5 on a server that has a SATA CD-ROM (most do these days) you’ll want an external USB CD-ROM drive handy…  and make sure to enable the USB mass storage device driver when it complains about not having any install media.