Month: January 2018

I can’t stand having to remember fiddly steps for tasks I only do now and then. I want things to just work, without clicking around through a dozen screens. That’s why I like Rufus for making bootable USB drives.

Rufus is a free, lightweight Windows utility that turns a USB flash drive into a bootable installer or recovery drive from an ISO image in just a few clicks.

Download Rufus

Give it a shot and make that USB stick do something more useful than just store files.

Multi-NIC vMotion lets VMware vSphere use more than one network adapter for a single vMotion, so live migrations finish much faster. Here’s how to set it up in vSphere 5.x on a standard vSwitch using two VMkernel port groups with opposite failover order.

Create the First vMotion Port Group

1. Log in to the vSphere Client and select the host in the inventory panel.
2. Click the Configuration tab and select Networking.
3. Click Add Networking, choose VMkernel as the connection type, and click Next.
4. Add two or more NICs to a new or existing standard vSwitch. Note: all adapters must be on the same physical network; if they’re split across switches, those switches must be able to talk to each other.
5. Name the VMkernel port group (for example, vMotion-01) and assign a VLAN ID if needed.
6. Check Use this port group for vMotion and click Next.
7. Enter the IP address and subnet mask and click Next.
8. Open the vSwitch Properties, select vMotion-01, and click Edit.
9. On the NIC Teaming tab, under Failover Order, select Override switch failover order.
10. Set the first adapter (for example, vmnic1) as Active and move the second (for example, vmnic3) to Unused Adapters. Click OK.

Create the Second vMotion Port Group

1. In the vSwitch Properties, click Add to create a second VMkernel port group.
2. Name it (for example, vMotion-02) and assign a VLAN ID if needed. Note: both vMotion VMkernel interfaces must have IP addresses on the same subnet.
3. Check Use this port group for vMotion, click Next, enter the IP address and subnet mask, and click Next.
4. Edit vMotion-02, go to NIC Teaming, and select Override switch failover order.
5. Set the second adapter (vmnic3) as Active and move the first (vmnic1) to Unused Adapters.
6. Select each vMotion port group in turn and confirm their active and unused adapters are the reverse of each other.

Scaling to More NICs

I repeated these steps two more times because I had four NICs. Each one went to its own physical network card, which was also bound to the software iSCSI HBA. After the change, I migrated the same machines back out across both hosts using all the configured NICs.

After upgrading to vRanger Backup and Replication 7.0.0.37394, I ran into a confusing bug. We’d been running fine on 6.1.0.35402 until we lost a drive in the SAN and, with it, the database that held our backup logs. Since the logs were gone anyway, it seemed like the perfect time to upgrade. Then the new backups started failing.

The Error

Backup failed: Error: 2258 - FATAL cifs_cant_mkdir CIFS can't create the directory cifs:localhost;admin@backupdevice/public/backup/* (No such file or directory) [at cifs_mkdir:615]

The Cause: Capitalization in the Repository Path

When you create a new repository in vRanger, the path is case-sensitive, over both NFS and CIFS. \\backupdevice\dir\backupfolder is not the same as \\backupdevice\dir\BackupFolder. In my case the path should have been backupdevice/public/Backup, with a capital B.

What makes it maddening is that vRanger validates the wrong path as correct during setup. This happens on the vRanger Virtual Appliance (vRanger-VA).

The Fix

If you see error 2258 on a fresh install, check that the capitalization of your repository path exactly matches the share. Or avoid the problem entirely by using all lowercase folder names.

Car owners are sometimes told by a dealership service writer or mechanic that using an aftermarket replacement filter will “void the warranty,” and that only the original equipment (OE) brand can be used during the warranty period. That claim casts doubt on perfectly good replacement parts, and it simply isn’t true.

Ask for that statement in writing and you won’t get it. Still, the claim can make do-it-yourselfers uneasy about installing their own filters, so it’s worth setting the record straight.

What the Law Says

Under the Magnuson-Moss Warranty Act, 15 U.S.C. §§ 2301–2312 (1982), and general principles of the Federal Trade Commission Act, a manufacturer may not require you to use any particular brand of filter, or any other part, unless the manufacturer provides that item free of charge under the warranty.

What to Do If You’re Told Otherwise

If you’re told only the OE filter will keep your warranty valid, ask for the OE filter to be supplied free of charge. If you’re charged for it, the manufacturer is violating the Magnuson-Moss Warranty Act and other applicable law.

The Filter Manufacturers Council shares this information to combat the false claim that non-OE replacement filters void a warranty.

Enforcement

The Magnuson-Moss Warranty Act is a federal law that covers consumer products. The Federal Trade Commission enforces it, including through injunctions and orders for affirmative relief, and consumers can also bring their own lawsuits under the Act.

Giving a virtual machine more vCPUs doesn’t always make it faster. On a busy VMware ESX/ESXi host, extra vCPUs can actually slow a VM down because it has to wait for enough physical cores to be free at the same time. Here’s how to tell if that’s happening.

How to Check Co-Stop (%CSTP) in esxtop

1. Open a console on the ESX host or connect to it over SSH.
2. Type esxtop and press Enter.
3. On the CPU screen, check the %CSTP value for the VM. If it’s higher than 3.00, the vCPU count may be causing the performance problem. Try lowering the VM’s vCPU count by one.
4. In vCenter, you can also add Co-Stop to the real-time performance charts.

What %CSTP means: it’s the amount of time a multi-vCPU virtual machine spends waiting to be scheduled across multiple physical cores. The higher the value, the longer it waits and the worse it performs. Reducing vCPUs cuts that scheduling wait.

Rule of Thumb: Start with One vCPU

Start VMs with one processor and add more only when it’s truly needed. Case in point: a DBA asked for 8 vCPUs for an Oracle database. I gave them to him, but the database soon started grabbing resources on the whole host. Once I showed him his server was causing the problem, we rolled it back several processors, and the database ran much better.

I’ve done a lot of brake work on our cars lately, and I can’t believe it took me this long to figure this out: skip the metallic pads and go with ceramic.

Why Ceramic Brake Pads Win

• Less brake dust: your wheels stay much cleaner.
• Longer life: ceramic pads last a lot longer than metallic ones.

Replace Rotors Instead of Turning Them

Instead of having your rotors turned (resurfaced), just replace them every other time you change the pads. It doesn’t pay to turn them anymore.

It’s an Easy DIY Job

Changing pads and rotors only takes simple hand tools. The one “special” tool I needed was a large C-clamp to push the caliper piston back. Both sides took about 45 minutes, and I got a good look at the rest of the car while I was under there.

The quickest way to check whether a public website still accepts the insecure SSLv3 protocol is the free Qualys SSL Labs Server Test. Enter your hostname and it reports every protocol and cipher the server supports, including SSLv3, along with an overall grade.

Run the SSL Labs Server Test

If SSLv3 shows as enabled, disable it on the server. See my posts on disabling SSLv3 in Microsoft IIS and the SSL 3.0 information disclosure vulnerability.

I needed a PGP encryption process to transfer files securely. Here are the GPG command lines I use to encrypt and decrypt a file, which work with keys managed in Kleopatra (Gpg4win).

Prerequisite: Trust the Recipient’s Key

Sometimes GPG won’t encrypt to a key until you’ve marked it as trusted:

gpg --edit-key email@****.com
trust
5        (select 5 if you ultimately trust the key)
save

Encrypt a File

gpg -r (NameOfCert) -o (NewEncryptedFile.pgp) -e (FileToBeEncrypted.pdf)

Decrypt a File

gpg --batch --yes --passphrase (your passphrase) -o (UnencryptedOutput.xml) -d (EncryptedFileInput.pgp)
gpg: encrypted with 4096-bit RSA key, ID ********, created 2014-10-20
"Certificate Name, Description, Etc. <Email Address>"

The --batch --yes --passphrase options let you decrypt non-interactively, which is handy in scripts. Keep in mind that a passphrase on the command line can show up in shell history.

When I upgraded a file server from Windows Server 2008 R2 to Windows Server 2012, letting DFS Replication (DFSR) do the initial sync took far too long because it was pulling everything from a remote server. Pre-seeding the new server with Robocopy from a local copy ran at line speed and finished much faster.

The Robocopy Pre-Seed Command

robocopy.exe "\\sourceserver\d$" "d:" /b /e /copyall /r:6 /xd dfsrprivate /log:robo.log /tee /MT

• /b copies in backup mode, /e includes all subfolders, and /copyall keeps permissions, owners, and timestamps so DFSR sees matching files.
• /xd dfsrprivate skips the DFSR private folder.
• /MT runs a multi-threaded copy, and /log with /tee writes to a log and the console.

Verify File Hashes Before Adding the Server to DFS

Before you add a pre-seeded server to DFS, spot-check that files and folders are identical on both sides. Matching hashes mean DFSR only has to sync the deltas, which makes the cut-over between old and new servers much faster.

C:\Windows\system32>dfsrdiag filehash /filepath:\\onrfs01\d$\vacancy_monitoring
File Hash: DBCCC7FA-E523939F-835B14D5-31020191
Operation Succeeded

C:\Windows\system32>dfsrdiag filehash /filepath:\\onrfs02\d$\vacancy_monitoring
File Hash: DBCCC7FA-E523939F-835B14D5-31020191
Operation Succeeded

Bonus: Turn On Data Deduplication

Don’t forget Windows Server 2012’s Data Deduplication feature. Enabling it saved me 20 to 30 percent of disk space on my file servers.