kool blog

o ESX/ESXi uses at least 50MB of system memory for the VMkernel. This is not configurable. It depends on the number and type of PCI devices. An ESXi host uses additional system memory for management agents. o The service console typically uses 272MB. o Memory activity is 220 702 monitored to estimate the working set sizes for a default period of 60 seconds. o ESX/ESXi charges more for idle memory than for memory that is in use. This is done to help prevent virtual machines from hoarding idle memory. o Hosts can reclaim memory from virtual machines using: o Memory balloon driver (vmmemctl) - collaborates with the server to reclaim pages that are considered least valuable by the guest operating system. Closely matches the behavior of a native system under similar memory constraints. Causes the guest to use its own native memory management algorithms. You must configure the guest operating system with sufficient swap space. o Swap Files - hosts use swapping to forcibly reclaim memory from a virtual machine when the vmmemctl driver is not available or is not responsive. You must reserve swap space for any unreserved virtual machine memory (the difference between the reservation and the configured memory size) on per-virtual machine swap files. o If you are overcommitting memory, to support the intra-guest swapping induced by ballooning, ensure that your guest operating systems also have sufficient swap space. This guest-level swap space must be greater than or equal to the difference between the virtual machine’s configured memory size and its Reservation. o Many workloads present opportunities for sharing memory across virtual machines. o To determine the effectiveness of memory sharing use resxtop or esxtop to observe the actual savings. The PSHARE field of the interactive mode in the Memory page. o You measure guest physical memory using the Memory Granted metric (for a virtual machine) or Memory Shared (for an ESX/ESXi host). To measure machine memory, however, use Memory Consumed (for a virtual machine) or Memory Shared Common (for an ESX/ESXi host). o The VMkernel maps guest physical memory to machine memory. o Multiple regions of guest physical memory might be mapped to the same region of machine memory (in the case of memory sharing) or specific regions of guest physical memory might not be mapped to machine memory (when the VMkernel swaps out or balloons guest physical memory) o Resource Pool Hierarchy can have Parents, Children, and Siblings. o Resource Pool Admission Control - Before you power on a virtual machine or create a resource pool, check the CPU Unreserved and Memory Unreserved fields in the resource pool’s Resource Allocation tab to determine whether sufficient resources are available. o A group power on will 9L0-403 power on multiple virtual machines at the same time. o VMotion does not support raw disks or migration of applications clustered using Microsoft Cluster Service (MSCS). o Other VMware products or features, such as VMware vApp and VMware Fault Tolerance, might override the automation levels of virtual machines in a DRS cluster. o An affinity rule specifies that two or more virtual machines be placed on the same host. An anti-affinity DRS rule is limited to two virtual machines, o If two rules conflict, the older one will take precedence, and the newer rule is disabled. o Disabled rules are ignored. DRS gives higher precedence to preventing violations of anti-affinity rules than violations of affinity rules. o When a host machine is placed in standby mode, it is powered off. o Hosts are placed in standby mode by the VMware DPM feature o A cluster becomes overcommitted (yellow) when the cluster does not have the capacity to support all resources reserved by the child resource pools. Typically this happens when cluster capacity is suddenly reduced. o A cluster enabled for DRS becomes invalid (red) when the tree is no longer internally consistent, that is, resource constraints are not observed. o VMware DPM can use one of three power management protocols o IPMI - Intelligent Platform Management Interface o iLO - Hewlett-Packard Integrated Lights-Out o WOL - Wake-On-LAN o If a host supports multiple protocols, they are used in the following order: IPMI, iLO, WOL. o The VMotion NIC on each host must support WOL to use that protocol. o The DRS threshold and the VMware DPM threshold are essentially independent. You can differentiate the aggressiveness of the migration and host-power-state recommendations. o Verify that DPM is functioning properly by viewing each host’s Last Time Exited Standby information. o The most serious potential error you face when using VMware DPM is the failure of a host to exit standby mode when its capacity is needed by the DRS cluster. Use the preconfigured Exit Standby Error alarm for this error. o DRS Recommendations have 5 levels (1-5). Priority 1, the highest, indicates a mandatory move because of a host entering maintenance or standby mode or DRS rule violations. Other priority ratings denote how much the recommendation would improve the cluster’s performance; o Prior to ESX/ESXi 4.0, recommendations received a star rating (1 to 5 stars) instead of a priority level. o Non-Uniform Memory Access (NUMA) systems are advanced server platforms with more than one system bus. o Some virtual machines are not managed by the ESX/ESXi NUMA scheduler: if you manually set the processor affinity for a virtual machine, or virtual machines that 9L0-510 have more virtual processors than the number of physical processor cores available on a single hardware node. o When a virtual machine is powered on, ESX/ESXi assigns it a home node. This is initially assigned to home nodes in a round robin fashion.

o Perform a rescan each time you make one of the following changes: o Create new LUNs on a SAN. o Change the path masking on a host. o Reconnect a cable. o Make a 220 701 change to a host in a cluster. o Change CHAP settings or add new discovery addresses. o If you notice unsatisfactory performance for your software iSCSI LUNs, you can change their maximum queue depth by using the vicfgmodule command. o The iscsi_max_lun_queue parameter is used to set the maximum outstanding commands, or queue depth, for each LUN accessed through the software iSCSI adapter. The default is 32, and the valid range is 1 to 255. o Setting the queue depth higher than the default can decrease the total number of LUNs supported. Appendix A - iSCSI SAN Configuration Checklist o Set the following Advanced Settings for the ESX/ESXi host: o Set Disk.UseLunReset to 1 o Set Disk.UseDeviceReset to 0 Appendix B - VMware vSphere Command-Line Interface o The resxtop command provides a detailed look at ESX/ESXi resource use in real time. o The vicfg-iscsi command allows you to configure software or hardware iSCSI on ESX/ESXi hosts, set up CHAP parameters, and set up iSCSI networking. o Use the vicfg-mpath command to view information about storage devices, paths, and multipathing plugins. o Use the esxcli corestorage claimrule command to manage claim rules. Claim rules determine which multipathing module should claim paths to a particular device and manage the device. o The vmkping command allows you to verify the VMkernel networking configuration. Appendix C - Managing Storage Paths and Multipathing Plugins (Same as Appendix B in the Fibre Channel SAN Configuration Guide) Resource Management Guide o The need for resource management arises from the over-commitment of resources. o Resources include CPU, memory, power, storage, and network resources. o The guide focuses primarily on CPU and memory. Power resource consumption can also be reduced with the Distributed Power Management (DPM) feature. o ESX/ESXi manages network bandwidth and disk resources on a per-host basis, using network traffic shaping and a proportional share mechanism, respectively. o Shares specify the relative priority or importance of a virtual machine (or resource pool). o Shares are typically specified as High, Normal, or Low and these values specify share values with a 4:2:1 ratio. (or can set Custom value) o A reservation 220 702 specifies the guaranteed minimum allocation for a virtual machine. o The reservation is expressed in concrete units (megahertz or megabytes). o Reservation defaults to 0. o Limit specifies an upper bound for CPU or memory resources that can be allocated to a virtual machine. It never gets more than this. o A limit is expressed in concrete units (megahertz or megabytes). o CPU and memory limit default is unlimited. o Using limits can be beneficial if you want to manage user expectations, but might waste idle resources. o Expandable Reservation defines whether reservations are considered during admission control. o Overhead Reservation is the amount of the “Reserved Capacity” field that is being reserved for virtualization overhead. o Worst Case Allocation is the amount of (CPU or memory) resource that is allocated to the virtual machine based on user-configured resource allocation policies (for example, reservation, shares and limit), and with the assumption that all virtual machines in the cluster consume their full amount of allocated resources. o Admission Control - If enough unreserved CPU and memory are available, or if there is no reservation, the virtual machine is powered on. Otherwise, an Insufficient Resources warning appears. o ESX/ESXi cannot enable hyperthreading on a system with more than 32 physical cores, because ESX/ESXi has a logical limit of 64 CPUs. o Hyperthreaded Core Sharing Modes: o Any - can freely share cores with other virtual CPUs. o None - each virtual CPU should always get a whole core to itself, with the other logical CPU on that core being placed into the halted state. o Internal - cannot share cores with vCPUs from other virtual machines. Can share cores with the other virtual CPUs from the same virtual machine. Only for SMP virtual machines. o For the best performance, when you use manual affinity settings, include at least one additional physical CPU in the affinity setting to allow at least one of the virtual 220 701 machine's threads to be scheduled at the same time as its virtual CPUs. o Dynamic Voltage and Frequency Scaling (DVFS) - You can configure your hosts to dynamically switch CPU frequencies based on workload demands.

o On ESXi, it is not possible to rescan a single storage adapter. o You can modify the Disk.MaxLUN parameter to improve LUN discovery speed. o You cannot discover LUNs with a LUN ID number that is greater than 255. o You can disable the default sparse LUN support to decrease the time ESX/ESXi needs to scan for LUNs. o The sparse LUN 640 802 Dumps support enables the VMkernel to perform uninterrupted LUN scanning when a storage system presents LUNs with nonsequential LUN numbering. o NPIV enables a single FC HBA port to register several unique WWNs with the fabric, each of which can be assigned to an individual virtual machine. o The virtual machine’s configuration file (.vmx) is updated to include a WWN pair (consisting of a World Wide Port Name and a World Wide Node Name). o If NPIV is enabled, four WWN pairs (WWPN & WWNN) are specified for each virtual machine at creation time. All physical paths must be zoned to the virtual machine. o NPIV can only be used for virtual machines with RDM disks. Physical HBAs, must have access to all LUNs that are to be accessed by virtual machines running on that host. o By default, the host performs a periodic path evaluation every 5 minutes causing any unclaimed paths to be claimed by the appropriate MPP. o Make sure read/write caching is enabled. o Dynamic load balancing is not currently supported with ESX/ESXi. o Path thrashing only occurs on active-passive arrays Appendix A – Multipathing Checklist Appendix B – Managing Storage Paths and Multipathing Plugins o Claim rules indicate which multipathing plugin, the NMP (Native MP) or any third-party MPP, manages a given physical path. o List claim rules esxcli corestorage claimrule list o To list all multipathing modules: vicfg-mpath --server --list-plugins o List all VMware SATPs: esxcli nmp satp list o List all storage devices: esxcli nmp device list iSCSI SAN Configuration Guide o There is no mention of requiring a Service Console connection for iSCSI anymore. o Virtual SCSI controllers - BusLogic Parallel, LSI Logic Parallel, LSI Logic SAS, and VMware Paravirtual. o iSCSI Name identifies a particular iSCSI element. The iSCSI name can use either IQN or EUI format. o IQN (iSCSI qualified name) - 640-802 can be up to 255 characters long and has the following format: iqn.yyyy-mm.naming-authority:unique_name o EUI (extended unique identifier) - takes the form eui.<16 hex digits> o iSCSI aliases - not unique, and are intended to be just a friendly name to associate with the node. o You must enable your software iSCSI initiator so that ESX can use it to access iSCSI storage. o Dynamic Discovery - Also known as Send Targets discovery responds by supplying a list of available targets to the initiator. The names and IP addresses of these targets appear on the Static Discovery tab. If you remove a static target added by dynamic discovery, the target might be returned to the list the next time a rescan happens, the HBA is reset, or the host is rebooted. o Static Discovery - The initiator does not have to perform any discovery. o Dynamic discovery obtains a list of accessible targets from the iSCSI storage system, while static discovery can only try to access one particular target by target name. o You cannot change the IP address, DNS name, or port number of an existing Send Targets server. To make changes, delete the existing server and add a new one. o To protect the integrity of iSCSI headers and data, the iSCSI protocol defines error correction methods known as header digests and data digests. Both parameters are disabled by default, but you can enable them. o Check the end-to-end, noncryptographic data integrity beyond the integrity checks that other networking layers provide. o Enabling header and data digests does require additional processing for both the initiator and the target. Intel Nehalem processors offload the iSCSI digest calculations. o Use the esxcli command to connect the VMkernel ports to the software iSCSI initiator. o Jumbo Frames up to 9kB (9000 Bytes) are supported. o You cannot change the IP address, DNS name, iSCSI target name, or port number of an existing target. To make changes, remove the existing target and add a new one. o iSCSI requires that all devices on the network implement Challenge Handshake Authentication Protocol (CHAP), which verifies the legitimacy of initiators that access targets on the network. (EDIT - I don’t think its “required”) o ESX/ESXi supports one-way CHAP for both hardware and software iSCSI, and mutual CHAP for software iSCSI only. o For software iSCSI only, you can set one-way CHAP and mutual CHAP for each initiator or at the target level. o Hardware iSCSI supports CHAP only at the initiator level. o For software iSCSI, the 640 802 braindumps CHAP name should not exceed 511 and the CHAP secret 255 alphanumeric characters. o For hardware iSCSI, the CHAP name should not exceed 255 and the CHAP secret 100 alphanumeric characters. o Boot from a SAN - ensure that the LUN is presented to the ESX system as LUN 0. The host can also boot from LUN 255.

Appendix A – ESX Technical Support Commands Command Purpose esxcfg-advcfg advanced options esxcfg-auth Configures authentication esxcfg-boot vcp 4 bootstrap settings esxcfg-dumppart Configures a diagnostic partition esxcfg-firewall service console firewall ports esxcfg-info Information about the state of the service console, VMkernel, various subsystems in the virtual network, and storage resource hardware. esxcfg-init Internal initialization routines. Used for the bootstrap process you should not use it under any circumstances. esxcfg-module Sets driver parameters and modifies which drivers are loaded during startup. esxcfg-mpath multipath settings for your Fibre Channel or iSCSI disks. esxcfg-nas Manages NFS mounts esxcfg-nics physical network adapters esxcfg-resgrp resource group settings esxcfg-route default VMkernel gateway route esxcfg-swiscsi software iSCSI software adapter. esxcfg-upgrade Upgrades from ESX Server 2.x to ESX. esxcfg- scsidevs Prints a map of VMkernel storage devices to service console devices. esxcfg-vmknic VMkernel TCP/IP settings for VMotion, NAS, and iSCSI. esxcfg-vswif service console network settings. esxcfg-vswitch virtual machine network settings. Appendix B – Linux Commands Used with ESX Appendix C – Using vmkfstools o vmkfstools utility is used to create and manipulate virtual disks, file systems, logical volumes, and physical storage devices. Fibre Channel SAN Configuration Guide o Zones define which HBAs can connect to which SPs. o Zoning is similar to LUN masking, which is commonly used for permission management. Usually, LUN masking is performed at the SP or server level. o WWPN (World Wide vmware vcp 4 Port Name) is a globally unique identifier for a port. o Port ID (or port address) enables routing. FC switches assign the port ID when the device logs in to the fabric. o When N-Port ID Virtualization (NPIV) is used, a single FC HBA port (N-port) can register with the fabric by using several WWPNs. o active-active - access to the LUNs simultaneously through all the storage ports that are available, without significant performance degradation. o active-passive - one port is actively providing access to a given LUN. The other ports act as backup o Disk shares are relevant only within a given ESX/ESXi host. o Virtual machine I/O might be delayed for up to sixty seconds while path failover takes place. I/O delays might be longer on active-passive arrays. o On virtual machines running Microsoft Windows, increase the value of the SCSI TimeoutValue parameter to 60. o Only one VMFS volume per LUN. o Unless you are using diskless servers, do not set up the diagnostic partition on a SAN LUN. o ESX/ESXi does not support FC connected tape devices. o You cannot use virtual machine logical-volume manager software to mirror virtual disks. Dynamic disks on a Microsoft Windows virtual machine are an exception, but require special configuration. o You should not mix FC HBAs from different vendors in a single server. o Use a dedicated SCSI adapter for any tape drives that you are connecting to an ESX/ESXi system. o You should not use boot from SAN in the following situations: o If you are using Microsoft Cluster Service. o If I/O contention might occur between the service console and VMkernel. o Proper LUN masking is critical in boot from SAN mode. o Runtime Name - the name of the first path to the device. Created by the host. Is not a reliable identifier for the device, and is not persistent. o vmhba#:C#:T#:L#, where: o vmhba# is the 640 802 name of the storage adapter o C# is the storage channel number. o T# is the target number. o L# is the LUN number o If a target has only one LUN, the LUN number is always zero (0).

o Set up a separate VLAN or virtual switch for vMotion and network attached storage. o The iSCSI initiator relies on being able to get MAC address changes from certain types of storage. If you are using ESX iSCSI and have iSCSI storage, set the MAC vcp-410 Address Changes option to Accept. o A legitimate need for more than one adapter to have the same MAC address, is if you are using Microsoft Network Load Balancing in unicast mode. When NLB is used in the standard multicast mode, adapters do not share MAC addresses. o ESX uses the Pluggable Authentication Modules (PAM) structure for authentication. The PAM configuration in /etc/pam.d/vmware-authd, ESX uses /etc/passwd authentication, but you can configure ESX to use another distributed authentication mechanism. o CIM transactions also use ticket-based authentication in connecting with the vmware-hostd process. o Management functions with username/password > vmware-hostd > Service Console o VM console with ticket > vmkauthd > vm in VMkernel o vicfg commands do not perform an access check. o The vpxuser is used for vCenter Server permissions. o The root user and vpxuser permissions are the only users not assigned the No Access role by default. o ESX supports SSL v3 and TLS v1. o All network traffic is encrypted as long as: o Did not change the Web proxy service to allow unencrypted traffic for the port. o Service console firewall is configured for medium or high security. o The default location for your certificate is /etc/vmware/ssl/ on the ESX host. The certificate consists of two files: the certificate itself (rui.crt) and the private-key file (rui.key). o The ESX host generates certificates the first time the system is started. o Each time you restart the vmware-hostd process, the mgmt-vmware script searches for existing certificate files (rui.crt and rui.key). If it cannot find them, it generates new certificate files. o SSL timeout settings are set in /etc/vmware/hostd/config.xml. o Do not set up certificates using passphrases. o For certificates in a location other than the default location, set the location in /etc/vmware/hostd/proxy.xml. o If you are performing activities that require root privileges, log in to the service console as a recognized user and acquire root privileges through the sudo command, which provides enhanced security compared to the su command. o The service console firewall is configured to block all incoming and outgoing traffic, except for ports 22, 123, 427, 443, 902, 5989, 5988, pings (ICMP) and communication with DHCP and DNS (UDP only) clients. o Medium security - All incoming traffic is blocked, except on the default ports and any ports you specifically open. Outgoing traffic is not blocked. o Low security - There are no vmware vcp 410 blocks on either incoming or outgoing traffic. This setting is equivalent to removing the firewall. o Password aging restrictions are enabled for user logins by default. o Maximum days - By default, passwords are set to never expire. o Minimum days - The default is 0, meaning that the users can change their passwords any time. o Warning time - The default is seven days. o To change this for hosts use esxcfg-auth. Change for users use the command chage. o By default, ESX uses the pam_cracklib.so plug-in. There is no restrictions on the root password, but the defaults for non-root users is: o minimum password length is nine o password length algorithm allows shorter passwords if the user enters a mix of character classes. M – CC = E where the Character Classes are upper, lower, digits and other. o retries is set to three o The pam_passwdqc.so provides a greater number of options for fine-tuning password strength and performs password strength tests for all users, including the root user. o setuid allows an application to temporarily change the permissions of the user running the application. o setgid changes the permissions of the group running the application. o Default setuid applications: crontab, pam_timestamp_check, passwd, ping, pwdb_chkpwd, ssh-keysign, su, sudo, unix_chkpwd, vmkload_app, vmware-authd, vmware-vmx. Default setgid Applications: wall, lockfile. o Virtual Machine Recommendations: o Install Antivirus Software o Disable Copy and Paste Operations Between the Guest Operating System and Remote Console o Removing Unnecessary Hardware Devices o Limiting Guest Operating System Writes to Host Memory o Configuring Logging Levels for the Guest Operating System o Host profiles eliminates per-host, configuration and maintain configuration consistency and correctness across the datacenter. o Only supported for vmware vcp 4 VMware vSphere 4.0 hosts. o Host Profiles are only available when the appropriate licensing is in place. o You can export a profile to a file that is in the VMware profile format (.vpf).

o Key contents of the metadata in the mapping file include the location of the mapped device (name resolution), the locking state of the mapped device, permissions, and so on. o You cannot perform vMotion or Storage vMotion between datastores when NPIV is enabled. o VMware protects Passed VCP410 the service console with a firewall. It also mitigates risks using other methods: o Only services essential to managing its functions. o By default, installed with a high-security setting. All outbound ports are closed. o By default, all ports not specifically required for management access to the service console are closed. o By default, weak ciphers are disabled and all communications from clients are secured by SSL. Default certificates created on ESX use SHA-1 with RSA encryption as the signature algorithm. o The Tomcat Web service, has been modified to run only those functions required. o VMware monitors all security alerts (for the RHEL5 distribution and 3rd party software). o Insecure services such as FTP and Telnet are not installed. o The number of applications that use a setuid or setgid flag is minimized. o ESX can automate whether services start based on the status of firewall ports, but this only applies to service settings configured through the vSphere Client or applications created with the vSphere Web services SDK. Doesn’t apply to changes made with the esxcfg-firewall utility or configuration files in /etc/init.d/. Port Purpose Interface Traffic type 22 SSH Server Service Console Incoming TCP 80 HTTP access and WS-Management Service Console Incoming TCP 123 NTP Client Service Console Outgoing UDP 427 The CIM client SLPv2 to find CIM servers. Service Console Incoming and outgoing UDP 443 HTTPS access - vmware-hostd vCenter Server access to ESX hosts Client access to vCenter Server and ESX hosts WS-Management Client access to vSphere Update Manager Converter access to vCenter Server Web Access to vCenter Server and ESX hosts Service Console Incoming TCP 902 Host access to Passed VCP 4 other hosts for migration and provisioning Authentication traffic for ESX (xinetd/vmware-authd) Client access to virtual machine consoles (UDP) Status update (heartbeat) connection from ESX to vCenter Server Service Console Incoming TCP, outgoing UDP 903 Remote console traffic from VI client & Web Access (xinetd/vmware-authd-mks) Service Console Incoming TCP 2049 Transactions from NFS storage devices VMkernel Incoming and outgoing TCP 2050-2250 Between ESX hosts for HA and EMC Autostart Manager Service Console Outgoing TCP, incoming and outgoing UDP 3260 Transactions to iSCSI storage devices VMkernel & Service Console Outgoing UDP 5900-5964 RFB protocol, which is used by management tools such as VNC Service Console Incoming and outgoing TCP 5989 CIM XML transactions over HTTPS Service Console Incoming and outgoing TCP 8000 VMotion requests VMkernel Incoming and outgoing TCP 8042-8045 Between ESX hosts for HA and EMC Autostart Manager Service Console Outgoing TCP, incoming and outgoing UDP 8100, 8200 Between ESX hosts for Fault Tolerance Service Console Outgoing TCP, incoming and outgoing UDP PLUS installed vcp 410 management agents and supported services such as NFS. o Create a separate VLAN for communication with the service console. o Configure network access for connections with the service console through a single virtual switch and one or more uplink ports

o You cannot use IDE/ATA drives to store virtual machines. o Use local SATA storage, internal and external, in unshared mode only. o Some SAS storage systems can offer shared access o You can have VCP-410 questions up to 256 VMFS datastores per system, with a minimum volume size of 1.2GB. o Grow the existing datastore extent if the storage device where your datastore resides has free space. You can grow the extent up to 2 TB. o You can connect up to 32 hosts to a single VMFS volume. (EDIT: Maximums document says 64) o Perform a rescan each time you: o Create new LUNs on a SAN. o Change the path masking on a host. o Reconnect a cable. o Make a change to a host in a cluster. o Do not rescan when a path is unavailable. o To rescan adapters on all hosts managed by vCenter by right-clicking a datacenter, cluster, or folder and selecting Rescan for Datastores. o ESX does not support the delegate user functionality that enables access to NFS volumes using non-root credentials o Disk format on a NAS device is dictated by the NFS server, typically a thin format that requires on-demand space allocation. o When your host accesses a virtual machine disk file on an NFS-based datastore, a .lck-XXX lock file is generated to prevent other hosts from accessing this file. o If the underlying NFS volume, is read-only, make sure that the volume is exported as a read-only share by the NFS server, or configure it as a read-only on the ESX host. o A diagnostic partition cannot be located on an iSCSI LUN accessed through a software iSCSI initiator. o You can query and scan the host’s diagnostic partition using the vicfg-dumppart -l command o You can group datastores into folders. o You can unmount: o NFS datastores o VMFS datastore copies mounted without resignaturing o You can have up to 32 extents. o You can grow an extent in an existing VMFS datastore. Only extents with free space immediately after them are expandable. o If a shared datastore has powered on virtual machines and becomes 100% full, you can increase the datastore's capacity only from the host, with which the powered on virtual machines are registered. o You can mount a VMFS datastore only if it does not collide with an already mounted VMFS datastore that has the same UUID (signature). o When resignaturing a VMFS copy, ESX assigns a new UUID and a new label to the copy, and mounts the copy as a datastore distinct from the original. o The default format VCP-410 dumps of the new label assigned to the datastore is snap--, where is an integer and is the label of the original datastore. o Datastore resignaturing is irreversible. o A spanned datastore can be resignatured only if all its extents are online. o Pluggable Storage Architecture (PSA) is an open modular framework that coordinates the simultaneous operation of multiple multipathing plugins (MPPs). The VMkernel multipathing plugin that ESX provides by default is the VMware Native Multipathing Plugin (NMP). Two types of NMP subplugins, Storage Array Type Plugins (SATPs), and Path Selection Plugins (PSPs). o The VMware NMP supports all storage arrays listed on the VMware storage HCL and provides a default path selection algorithm based on the array type. o ESX offers an SATP for every type of array that VMware supports. o By default, the VMware NMP supports the following PSPs: o Most Recently Used (MRU) o Fixed - with active-passive arrays that have a Fixed path policy, path thrashing might be a problem. o Round Robin (RR) - Uses a path selection algorithm that rotates through all available paths enabling load balancing across the paths. o Claim rules defined in the /etc/vmware/esx.conf file, the host determines which multipathing plugin (MPP) should claim the paths. o By default, the host performs a periodic path evaluation every 5 minutes. o Active multiple working paths currently used for transferring data are marked as Active (I/O). In ESX 3.5 or earlier, the term active means the only path that the host is using to issue I/O to a LUN. o Standby path is operational and can be used for I/O if active paths fail. o If you created a virtual disk in the thin format, you can later inflate it to its full size. o RDM offers several benefits. User-Friendly Persistent Names, Dynamic Name Resolution, Distributed File Locking, File Permissions, File System Operations, Snapshots, vMotion, SAN Management Agents and N-Port ID Virtualization(NPIV). o Certain limitations exist when you use RDMs: o Not available for Passed VCP-410 block devices or certain RAID devices. o Available with VMFS-2 and VMFS-3 volumes only. o No snapshots in physical compatibility mode. o No partition mapping. It requires a whole LUN.

o MAC Address Changes - the guest OS changes the MAC address of the adapter to anything other than what is in the .vmx o Forged Transmits - Outbound frames with a source MAC address that is different from the one set on the adapter are dropped. o Traffic shaping o Traffic shaping policy VCP-410 exam is defined by three characteristics: average bandwidth, peak bandwidth, and burst size. o ESX shapes outbound network traffic on vSwitches and both inbound and outbound traffic on a vNetwork Distributed Switch. o Peak bandwidth cannot be less than the specified average bandwidth. o NIC Teaming (Load balancing and failover) o Load Balancing 1. Route based on the originating port ID — Choose an uplink based on the virtual port where the traffic entered the virtual switch. 2. Route based on ip hash — Choose an uplink based on a hash of the source and destination IP addresses of each packet. 3. Route based on source MAC hash — Choose an uplink based on a hash of the source Ethernet. 4. Use explicit failover order — Always use the highest order uplink from the list of Active adapters which passes failover detection criteria. o IP-based teaming requires that the physical switch be configured with etherchannel. For all other options, etherchannel should be disabled. o Incoming traffic is controlled by the load balancing policy on the physical switch o Network failover detection o Link Status only o Beacon probing - Do not use beacon probing with IP-hash load balancing. o Notify Switches - a notification is sent out over the network to update the lookup tables on physical switches. In almost all cases, this process is desirable for the lowest latency of failover occurrences and migrations with VMotion. Do not use this option when the virtual machines using the port group are using Microsoft Network Load Balancing in unicast mode. o Failback - determines how a physical adapter is returned to active duty after recovering from a failure. If failback is set to Yes (default), the adapter is returned to active duty immediately upon recovery. o Failover Order 1. Active Uplinks 2. Standby Uplinks 3. Unused Uplinks o When using IP-hash load balancing, do not configure standby uplinks. o VLAN - The VLAN policy allows virtual networks to join physical VLANs - vNetwork Distributed Switch only (dvPorts). o Port blocking policies - VCP-410 exam questions vNetwork Distributed Switch only (dvPorts). o VMware uses the Organizationally Unique Identifier (OUI) 00:50:56 for manually generated addresses. You must set them in a virtual machine’s configuration file: ethernet.addressType="static" o Jumbo frames must be enabled at the host level using the command-line interface to configure the MTU size for each vSwitch. o TCP Segmentation Offload (TSO) is enabled on the VMkernel interface by default, but must be enabled at the virtual machine level. o To enable TSO at the virtual machine level, you must replace the existing vmxnet or flexible virtual network adapters with enhanced vmxnet virtual network adapters. This might result in a change in the MAC address of the virtual network adapter. o To check whether TSO is enabled on a particular VMkernel networking interface use the esxcfg-vmknic -l command. The list shows each TSO-enabled VMkernel interface with TSO MSS set to 65535. o If TSO is not enabled for a particular VMkernel interface, the only way to enable it is to delete the VMkernel interface and recreate the interface. o Jumbo frames up to 9kB (9000 bytes) are supported. o Use the vicfg-vswitch -m command to set the MTU size for the vSwitch. o Enabling jumbo frame support on a virtual machine requires an enhanced vmxnet adapter for that virtual machine. o NetQueue in ESX takes advantage of the capability of some network adapters to deliver network traffic to the system in multiple receive queues that can be processed separately. This allows processing to be scaled to multiple CPUs, improving receive-side networking performance. o NetQueue is enabled by default. o ESX supports a direct PCI device connection for virtual machines running on Intel Nehalem platforms. Each virtual machine can connect to up to 2 passthrough devices. o The following features are unavailable for virtual machines configured with VMDirectPath: o VMotion o Hot adding and removing of virtual devices o Suspend and resume o Record and replay o Fault tolerance o High availability o DRS (limited availability; VCP-410 study guide the virtual machine can be part of a cluster, but cannot migrate across hosts) o Software-initiated iSCSI is not available over 10GigE network adapters in ESX.

4. Assign each physical NIC to a port group and a vSwitch. 5. Use separate physical NICs to handle the different traffic streams, such as network packets generated by VMs, iSCSI protocols, VMotion tasks, and service console activities. 6. Ensure that the VCP-410 dumps physical NIC capacity is large enough to handle the network traffic on that vSwitch. If the capacity is not enough, consider using a high-bandwidth physical NIC (10Gbps) or moving some VMs to a vSwitch with a lighter load or to a new vSwitch. 7. If packets are being dropped at the vSwitch port, increase the virtual network driver ring buffers where applicable. 8. Verify that the reported speed and duplex settings for the physical NIC match the hardware expectations and that the hardware is configured to run at its maximum capability. For example, verify that NICs with 1Gbps are not reset to 100Mbps because they are connected to an older switch. 9. Verify that all NICs are running in full duplex mode. Hardware connectivity issues might result in a NIC resetting itself to a lower speed or half duplex mode. 10. Use vNICs that are TSO-capable, and verify that TSO-Jumbo Frames are enabled where possible. o Tasks represent system activities that do not complete immediately, such as migrating a VM. o If you are logged in to a vCenter Server system that is part of a Connected Group, a column in the task list displays the name of the vCenter Server system on which the task was performed. Appendix A – Defined privileges Appendix B – Installing the MS sysprep tools Appendix C – Performance metrics ESX Configuration Guide o A vNetwork Distributed Switch acts as a single vSwitch across all associated hosts on a datacenter. This allows virtual machines to maintain consistent network configuration as they migrate across multiple hosts. A dvPort is a port on a vNetwork Distributed Switch. o The VMkernel TCP/IP networking stack supports iSCSI, NFS, and VMotion. Virtual machines run their own systems’ TCP/IP stacks and connect to the VMkernel at the Ethernet level through virtual switches. o TCP Segmentation Offload (TSO), allows a TCP/IP stack to emit very large frames (up to 64KB) even though the maximum transmission unit (MTU) of the interface is smaller. The network adapter then separates the large frame into MTU-sized frames and prepends an adjusted copy of the initial TCP/IP headers. o The default number of logical ports for a vSwitch is 56. o Each uplink adapter associated with a vSwitch uses one port. o You can create a VCP-410 maximum of 127 vSwitches on a single host. (EDIT the current Maximums PDF says 248) o Maximum of 512 port groups on a single host. o For a port group to reach port groups located on other VLANs, the VLAN ID must be set to 4095. If you enter 4095, the port group can see traffic on any VLAN while leaving the VLAN tags intact. o VLAN ID is a number between 1 and 4094. o ESX supports only NFS version 3 over TCP/IP. o You can create a maximum of 16 service console ports in ESX. o CDP advertisements typically occur once a minute. o dvPort group properties include: o Port Binding - when ports are assigned to virtual machines connected to this dvPort group. o Static binding - to assign a port to a virtual machine when the virtual machine is connected to the dvPort group. o Dynamic binding - to assign a port to a virtual machine the first time the virtual machine powers on after it is connected to the dvPort group. o Ephemeral - for no port binding. o Whether to allow live port moving. o Config reset at disconnect to discard per-port configurations when a dvPort is disconnected from a virtual machine. o Binding on host allowed to specify that when vCenter Server is down, ESX can assign a dvPort to a virtual machine. o Port name format to provide a template for assigning names to the dvPorts in this group. o Private VLANs are used to solve VLAN ID limitations. o A private VLAN is identified by its primary VLAN ID. A primary VLAN ID can have multiple secondary VLAN IDs associated with it. Primary VLANs are Promiscuous, so that ports on a private VLAN can communicate with ports configured as the primary VLAN. Ports on a secondary VLAN can be either: o Isolated - communicating only with promiscuous ports o Community - communicating with both promiscuous ports and other ports on the same secondary VLAN. o Only one VMotion and IP storage port group for each ESX host. o You can enable or disable IPv6 support on the host. o The following networking policies can be applied: o Security o Promiscuous Mode - In VCP-410 braindump non-promiscuous mode, a guest adapter listens only to traffic forwarded to own MAC address. In promiscuous mode, it can listen to all the frames. By default, guest adapters are set to non-promiscuous mode.

o By default, statistics are stored in the vCenter Server database for one year. You can increase this to three years. o You cannot view datastore metrics in the advanced charts. They are only available in the overview charts. o CPU Performance Enhancement Advice 1. Verify that VMware Tools is installed on every VM on the host. 2. Compare the CPU VCP-410 exam questions usage value of a VM with the CPU usage of other VMs on the host or in the resource pool. The stacked bar chart on the host's Virtual Machine view shows the CPU usage for all VMs on the host. 3. Determine whether the high ready time for the VM resulted from its CPU usage time reaching the CPU limit setting. If so, increase the CPU limit on the VM. 4. Increase the CPU shares to give the VM more opportunities to run. The total ready time on the host might remain at the same level if the host system is constrained by CPU. If the host ready time doesn't decrease, set the CPU reservations for high-priority VMs to guarantee that they receive the required CPU cycles. 5. Increase the amount of memory allocated to the VM. This decreases disk and or network activity for applications that cache. This might lower disk I/O and reduce the need for the ESX/ESXi host to virtualize the hardware. Virtual machines with smaller resource allocations generally accumulate more CPU ready time. 6. Reduce the number of virtual CPUs on a VM to only the number required to execute the workload. For example, a single-threaded application on a four-way VM only benefits from a single vCPU. But the hypervisor's maintenance of the three idle vCPUs takes CPU cycles that could be used for other work. 7. If the host is not already in a DRS cluster, add it to one. If the host is in a DRS cluster, increase the number of hosts and migrate one or more VMs onto the new host. 8. Upgrade the physical CPUs or cores on the host if necessary. 9. Use the newest version of ESX/ESXi, and enable CPU-saving features such as TCP Segmentation Offload, large memory pages, and jumbo frames. o Memory Performance Enhancement Advice 1. Verify that VMware Tools is installed on each VM. The balloon driver is installed with VMware Tools and is critical to performance. 2. Verify that the balloon driver is enabled. The VMkernel regularly reclaims unused VM memory by ballooning and swapping. Generally, this does not impact VM performance. 3. Reduce the memory space on the VM, and correct the cache size if it is too large. This frees up memory for other VMs. 4. If the memory reservation of the VM is set to a value much higher than its active memory, decrease the reservation setting so that the VMkernel can reclaim the idle memory for other VMs on the host. 5. Migrate one or more VMs to a host in a DRS cluster. 6. Add physical memory to the host. o Disk I/O Performance Enhancement Advice 1. Increase the VM VCP-410 study guide memory. This should allow for more operating system caching, which can reduce I/O activity. Note that this may require you to also increase the host memory. Increasing memory might reduce the need to store data because databases can utilize system memory to cache data and avoid disk access. To verify that VMs have adequate memory, check swap statistics in the guest operating system. Increase the guest memory, but not to an extent that leads to excessive host memory swapping. Install VMware Tools so that memory ballooning can occur. 2. Defragment the file systems on all guests. 3. Disable antivirus on-demand scans on the VMDK and VMEM (backup of the VM’s paging file) files. 4. Use the vendor's array tools to determine the array performance statistics. When too many servers simultaneously access common elements on an array, the disks might have trouble keeping up. Consider array-side improvements to increase throughput. 5. Use Storage VMotion to migrate I/O-intensive VMs across multiple ESX/ESXi hosts. 6. Balance the disk load across all physical resources available. Spread heavily used storage across LUNs that are accessed by different adapters. Use separate queues for each adapter to improve disk efficiency. 7. Configure the HBAs and RAID controllers for optimal use. Verify that the queue depths and cache settings on the RAID controllers are adequate. If not, increase the number of outstanding disk requests for the VM by adjusting the Disk.SchedNumReqOutstanding parameter. For more information, see the Fibre Channel SAN Configuration Guide. 8. For resource-intensive VMs, separate the VM's physical disk drive from the drive with the system page file. This alleviates disk spindle contention during periods of high use. 9. On systems with sizable RAM, disable memory trimming by adding the line MemTrimRate=0 to the VM's .VMX file. 10. If the combined disk I/O is higher than a single HBA capacity, use multipathing or multiple links. 11. For ESXi hosts, create virtual disks as preallocated. When you create a virtual disk for a guest operating system, select Allocate all disk space now. The performance degradation associated with reassigning additional disk space does not occur, and the disk is less likely to become fragmented. 12. Use the most current ESX/ESXi host hardware. o Networking Performance Enhancement Advice 1. Verify that VMware Tools is installed on each VM. 2. If possible, use vmxnet3 NIC drivers, which are available with VMware Tools. They are optimized for high performance. 3. If VMs running on VCP-410 questions the same ESX/ESXi host communicate with each other, connect them to the same vSwitch to avoid the cost of transferring packets over the physical network.

o If you create or edit a role on a vCenter Server system that is part of a connected group in Linked Mode, the changes you make are propagated to all other vCenter Server systems in the group. Assignments of roles to specific users and objects are not shared across linked vCenter Server systems. o Permissions grant VCP-410 users the right to perform the activities specified by the role on the object to which the role is assigned o By default, all users who are members of the Windows Administrators group on the vCenter Server system have the same access rights as any user assigned to the Administrator role on all objects. o Propagation is set per permission, not universally applied. Permissions defined for a child object always override those propagated from parent objects. o You cannot set permissions directly on a vNetwork Distributed Switches. To set permissions for a vNetwork Distributed Switch and its associated dvPort Groups, set permissions on a parent object, such a folder or datacenter, and select the option to propagate these permissions to child objects. o If no permission is defined for the user on that object, the user is assigned the union of privileges assigned to the groups for that object. o If a permission is defined for the user on that object, the user's permission takes precedence over all group permissions o Reports are updated every 30 minutes. o Map views are updated every 30 minutes o Alarms are notifications that occur in response to selected events, conditions, and states that occur with objects in the inventory. o Alarms are composed of a trigger and an action. o Alarms have two types of triggers: condition/state triggers, and event triggers. o Condition or State Triggers Monitor the current condition or state of VMs, hosts, and datastores. o Event Triggers Monitors events that occur in response to operations occuring with any managed object in the inventory, the vCenter Server system, or the license server. o Condition and state triggers use one of the following operator sets to monitor an object: o Is equal to and Is not equal to o Is above and Is below o Event triggers use arguments, operators, and values to monitor operations that occur in the vServer System. o Alarm actions are operations that occur in response to triggered alarms. o The default VMware alarms do not have actions associated with them. You must manually associate actions with the default alarms. o You can disable an VCP-410 braindump alarm action from occurring without disabling the alarm itself. o You disable alarm actions for a selected inventory object. o When you disable the alarm actions for an object, they continue to occur on child objects. o When you disable alarm actions, all actions on all alarms for the object are disabled. You cannot disable a subset of alarm actions. o The SNMP agent included with vCenter Server can be used to send traps when alarms are triggered on a vCenter Server. o Alarm reporting can further restrict when a condition or state alarm trigger occurs by adding a tolerance range and a trigger frequency to the trigger configuration. o The tolerance range specifies a percentage above or below the configured threshold point, after which the alarm triggers or clears. o Condition threshold + Tolerance Range = Trigger alarm o The trigger frequency is the time period during which a triggered alarm action is not reported again. By default, the trigger frequency for the default VMware alarms is set to 5 minutes. o Statistical data consists of CPU, memory, disk, network, system, and VM operations metrics. o Collection intervals determine the time period during which statistics are aggregated and rolled up, and the length of time the statistics are archived in the vCenter database. By default, vCenter Server has four collection intervals: Day, Week, Month, and Year. o Real-time statistics are not stored in the database. They are stored in a flat file on ESX/ESXi hosts and in memory on the vCenter Server systems o Real-time statistics are collected directly on an ESX/ESXi host every 20 seconds (60 seconds for ESX Server 2.x hosts). o On ESX hosts, the statistics are kept for one hour, after which 180 data points (15 -20 second samples) will have been collected. o On ESXi hosts, the statistics are kept for 30 minutes, after which 90 data points will have been collected. o Collection Intervals: Collected frequency Retention 5 Minutes 1 Day 30 Minutes 1 Week 2 Hours 1 Month 1 Day 1 Year o You can change the frequency at which statistic queries occur, the length of time statistical data is stored in the vCenter Server database, and the amount of statistical data collected. o Not all attributes are VCP-410 exam configurable for each collection interval. o You can assign a collection level of 1- 4 to each collection interval, with level 4 having the largest number of counters. o By default, all collection intervals use collection level 1. o Generally, you need to use only collection levels 1 and 2 for performance monitoring and analysis.