Windows Server 8 beta

The public beta of Windows Server 8 is now available for download. Windows Server 8 contains significant enhancements to support virtualization and cloud computing. This article describes how sFlow standard monitoring can be installed and configured to manage the performance of large scale Windows Server 8 cloud deployments.

With sFlow monitoring, each server sends performance measurements to a central analysis application - in this example the sFlow analyzer has address 10.0.0.50 and each Windows 8 server will be configured to send sFlow to this address.

First download the hsflowd-win8-X.XX.X-x64.msi file from sflow.net. Double click on the file to launch the installer:

Click on the Next button.

Click the check box to accept the license and then click on the Next button.

Click the Next button to accept the default installation location.

Enter the IP address of the sFlow collector, a Counter polling interval and a Sampling rate.  In this case the sFlow collector has address 10.0.0.50. The default polling interval of 20 seconds and default sampling rate of 1 in 256 should be suitable for most installations, see Sampling rates for more information on choosing sampling and polling setting.

Click on the Next button to accept the settings.

Click on the Install button to start the installation. After a few moments you will be prompted to install the network monitoring driver, see Hyper-V extensible virtual switch.

Click to check the Always trust software from "InMon Corp." box and click on the Install button to install the driver. Once the installation is complete, you should see the following window.

Click on the Finish button to complete the installation.

There is one final step to configure monitoring of the virtual switch. On the Start screen, type hyper-v manager to launch the Hyper-V Manager application.

Click on the Virtual Switch Manager... in the Actions column on the right to launch the Virtual Switch Manager.

Expand each virtual switch, click on Extensions and enable the sFlow packet sampling filter (in this case for vSwitch1). At this point the sFlow software installation and configuration steps are complete and you should start seeing data in your sFlow analyzer.

Use the Registry Editor if you need to change the sFlow configuration settings: the IP address of the sFlow analyzer, the polling interval, or the packet sampling rate. On the Start screen, type regedit to launch the Registry Editor.

Double-click on a setting to edit its value. Once the settings have been changed, the sFlow agent needs to be restarted before the changes will take effect.

On the Start screen type services to run the Services manager.

Select the Host sFlow Agent service and click on the Restart link (or use the right button menu option).

The following charts use the free sFlowTrend tool to demonstrate some of the performance metrics reported from Windows Server 8. However, there are many other open source and commercial sFlow analysis applications, see sFlow Collectors.

The following chart shows the top network connections flowing through the virtual switch.

It is easy to see that the bulk of the traffic is associated with Windows file sharing. The chart provides a minute-by-minute view of network activity based on measurements made by the driver installed in the virtual switch.

The next chart shows the CPU utilization on the server.

The processor utilization is averaging at just under 15%, with a brief peak of 40%. Based on this chart, it looks like there is plenty of capacity to run additional virtual machines.

The final chart in this example shows disk activity for the server and each virtual machine.

The physical servers and the virtual machines are all shown, along with key disk performance and usage metrics. Again, the numbers suggest that additional virtual machines could be added without impacting performance - the disk is only 26% used, there are only 3 virtual machines deployed, and there is very little disk IO activity.

The sFlow standard is widely supported by switch vendors. Using sFlow to monitor the Windows Server 8 extensible virtual switch simplifies management by allowing a common set of tools to monitor physical and virtual network performance. Performance management is further simplified since sFlow also provides an efficient way of monitoring server and virtual machine statistics. Unifying network and system monitoring provides the integrated view of performance needed for the coordinated management that is essential in virtualized environments. In addition to monitoring data center resources, sFlow can also be used to monitor performance within public clouds (see Rackspace cloudservers and Amazon EC2), providing the integrated visibility needed to optimize workload placement and minimise operating costs in hybrid cloud environments.

For public or private cloud operators, support for sFlow in the Hyper-V extensible switch and the Open vSwitch embeds visibility in leading commercial hypervisors (Microsoft Hyper-V and Citrix XenServer), open source hypervisors (Xen Cloud Platform (XCP), Xen, KVM, Proxmox VE and VirtualBox) and cloud management systems (OpenStack, OpenQRM and OpenNebula), providing the scalable visibility needed for accounting and billing, operational control and cost management.

Microsoft Hyper-V

This week, InMon Corp. demonstrated sFlow monitoring in Microsoft Hyper-V during the Microsoft BUILD conference in Anaheim, California. InMon and Microsoft are working together to integrate sFlow support in Hyper-V 3.0, the hypervisor that will be included in the upcoming Windows Server 8 and Windows 8 releases.

The video above describes the integration of sFlow monitoring in Hyper-V.  The extensible virtual switch is a key component of the Hyper-V 3.0 release. The following diagram from the video shows how sFlow is implemented as virtual switch extension.

The sFlow extension is inserted into the packet forwarding path, randomly sampling packets that flow through the virtual switch. sFlow's packet sampling mechanism is extremely lightweight, delivering detailed visibility while ensuring minimal impact on forwarding performance. Sampled packets are sent to a userspace sFlow agent that exports the sampled packet headers along with physical and virtual NIC interface counters, server and virtual machine cpu, memory and I/O performance to an sFlow collector.

The photo above is of a live demonstration of the Hyper-V sFlow extension. The screen shows a real-time chart of network traffic flowing between virtual machines generated using the free sFlowTrend collector.

The sFlow standard is widely supported by switch vendors. Including sFlow monitoring in the Hyper-V virtual switch simplifies network management by allowing a common set of tools to monitor physical and virtual network performance. sFlow in Hyper-V further simplifies management by exporting server and virtual machine statistics. Unifying network and system monitoring provides the integrated view of performance needed for the coordinated management that is essential in virtualized environments. In addition to monitoring data center resources, sFlow can also be used to monitor performance within public clouds (see Rackspace cloudservers and Amazon EC2), providing the integrated visibility needed to optimize workload placement and minimise operating costs in hybrid cloud environments.

For public or private cloud operators, support for sFlow in the Hyper-V extensible switch and the Open vSwitch embeds visibility in leading commercial hypervisors (Microsoft Hyper-V and Citrix XenServer), open source hypervisors (Xen Cloud Platform (XCP), Xen, KVM, Proxmox VE and VirtualBox) and cloud management systems (OpenStack, OpenQRM and OpenNebula), providing the scalable visibility needed for accounting and billing, operational control and cost management.

Windows load average

The latest version of Host sFlow calculates and exports load average metrics from Windows® systems. Since load averages aren't natively supported by Windows, this article provides an overview of load measurement and describes how the Windows Host sFlow agent calculates load averages.

Why the picture of a grocery store checkout line? When choosing which checkout line to join in a grocery store, the length of each lines gives a pretty good indication of how long the wait is for the register. Similarly, with computer systems, the number of tasks waiting for the CPU is a useful measure of system load.

The Windows Task Manager is a familiar tool for monitoring the performance of Windows systems. The Performance tab shows current CPU utilization and a trend of utilization over time.

In this example, the CPU utilization has spiked to 100%, but it's hard to gauge whether the server is overloaded. Going back to the grocery store analogy, we can see that the cashier is busy serving a customer, but we don't know how long the line is.

The following chart, generated using sFlowTrend, displays load average data collected from a Host sFlow agent installed on a Windows server:

The chart shows a trend of 1 minute, 5 minute and 15 minute load averages. Each load average is a moving average of the number of threads waiting to be serviced. A load average of 1.0 on a single processor roughly corresponds to a CPU utilization of 100%. A load average of three, as in this case, indicates that there is more work than the single processor can handle. Upgrading to a server with more CPUs would reduce the load and increase the throughput. Using the grocery store analogy, if the manager sees that lines are building up, it is time to start opening up additional registers.

For additional information, the article, Understanding Linux CPU Load - when should you be worried?, provides a good introduction to load averages and provides useful rules of thumb for sizing servers based on load average.

The white papers, UNIX Load Average Part 1: How It Works and UNIX Load Average Part 2: Not Your Average Average, give a detailed description of load averages and how to calculate them. The key to calculating a load averages on Windows is the ability to monitor the depth of the processor queue. The Microsoft article, Observing Processor Queue Length, describes the Windows System\Processor Queue Length metric, the critical measurement that allows the Host sFlow agent to calculate load averages.

Load averages are an important part of the standard set of metrics that the sFlow standard defines for monitoring the performance of servers. A standard set of metrics simplifies management of multi-vendor, multi-OS environments, while the scalability of sFlow provides real-time, centralized visibility into all the servers in the data center, making it easy to rapidly identify performance problems.

Finally, server monitoring is only one component of the sFlow standard. sFlow measurements from network devices, servers and applications combine to deliver the integrated, end-to-end visibility into performance that is essential in converged, virtualized and cloud environments.

Installing Host sFlow on a Windows server

The Host sFlow agent supports Windows performance monitoring, providing a lightweight, scalable solution for monitoring large numbers of Windows servers.

The following steps demonstrate how to install and configure the Host sFlow agent on a Windows server, sending sFlow to an analyzer with IP address 10.0.0.50.

Note: If there are any firewalls between the Windows servers and the sFlow analyzer, you will need to ensure that packets to the sFlow analyzer (UDP port 6343) are permitted.

First go to the Host sFlow web site, http://host-sflow.sourceforge.net

Click on the DOWNLOAD NOW button.

If you are using a browser on the Windows server, you should automatically be offered the file hsflowd_windows_setup.msi, click on the Download Now! button to download this file.

Note: If the Windows install file isn't displayed, click on the View all files button and select the file from the list.

Click on the Run button to install the software on your current server. Otherwise, click Save to store the file and copy it to the target system.

Click on the Run button to confirm that you want to install the software.

Click the Next> button

Confirm the installation location and click the Next> button

Enter the IP address of your sFlow analyzer, in this case 10.0.0.50, then click the Next> button.

Click on the Next> button to confirm that you want to install the software.

The Host sFlow agent is now installed, click the Close button to finish.

For a complete sFlow monitoring solution you should also collect sFlow from the switches connecting the servers to the network (see Hybrid server monitoring). The sFlow standard is designed to seamlessly integrate monitoring of networks and servers (see sFlow Host Structures).

An sFlow analyzer is needed to receive the sFlow data and report on performance (see Choosing an sFlow analyzer). The free sFlowTrend analyzer is a great way to get started, see sFlowTrend adds server performance monitoring to see examples.