Thursday, February 7, 2019

scaling - Combining like programs on same server



I have several different applications I need to run to serve my website. To use the minimum amount of servers while still maintaining good performance, which of the following can I put on a single server?




mysql, nginx (2), memcached, sphinx search, Rails Cron jobs



I know that mysql needs a dedicated system to run, so does nginx for serving web pages. However, I have heard that memcached can be put on the web server it's self because it uses almost no cpu and ram only, where the web server uses mostly cpu.



If possible, I would really like to combine memcached, sphinx search and Rails cron jobs on one machine.



What do you think?


Answer



AFAIK, you've got decent guidelines. For a definitive answer, you need to do load-testing of your specific application environment under conditions that reflect the usage you expect to see in the real world. Maybe your application generates very little SQL load, so SQL doesn't need to be on its own box. That's not often the case, but it's not an iron-clad rule that SQL must be on its own server. It's definitely a best-practice, especially if you want to scale - I'm just using it as an example.



Wednesday, February 6, 2019

amazon web services - DNS issue - Windows Domain Controller 2016 - Unable to resolve public and private hosts

I have configured a Domain Controller on a Windows Server 2016 (in AWS). Before setting up the AD I can able to browse the internet. But after configured the AD I can't able to ping the computers which all are added to that domain(but if I use FQDN its working). Also, I can't able to access the internet. But whenever I tried to ping using IP address I can able to access them. Public websites also.




  • My windows domain name: sql.com

  • I tried to add the 8.8.8.8 in the forwarders - Able to access all the websites.


  • In Append this DNS suffix I added sql.com - Able to ping all the computers using their name.






  1. VPC range: 172.31.0.0/16

  2. In DC DNS IP in IPv4 properties: 127.0.0.1

  3. Domain name: sql.com

  4. Reverse lookup: created (PTR records are also there)


  5. In AWS my AD and other servers are in public subnet. Necessary ports are opened.






  1. Why I couldn't able to ping the servers using their names (before adding the Append DNS suffix).


  2. Why I couldn't able to access the internet (until I have added the 8.8.8.8 to the DNS forwarders.)


  3. If I removed the google DNS IP from the forwarders and removed Append DNS suffix, after reboot the Network shows Public Network instead of a domain network.





Can anyone help me to understand at least first 2 questions,But Im using Windows Server 2012 from past few years where I didn't face any issues like this.

domain name system - If DNS Failover is not recommended, what is?



As a followup question to his very popular question: Why is DNS failover not recommended?, I think it was agreed that DNS failover is not 100% reliable due to caching.



However the highest voted answer did not really discuss what is the better solution to achieve failover between two different data centers. The only solution presented was local load balancing (single data center).



So my question is quite simply what is the real solution to cross data center failover?


Answer



A whole data center would need to go down or be unreachable for this to apply. Your backup at another data center would then be reached by routing the IP addresses to the other data center. This would happen through the BGP route announcements from the primary data center no longer being provided. The secondary announcements from the secondary data center would then be used.




Smaller businesses are generally not large enough to justify the expense of portable IP address allocations and their own autonomous system number to announce BGP routes with. In this case a provider would multiple locations is the way to go.



You either have to be reached via your original IP addresses, or via a change of IP address done by DNS. Since DNS is not designed to do this in the ways needed by what "failover" means (users can be out of reach by at least as long as your TTL, or the TTL imposed by some caching servers), going to the backup site with the same IPs is the best solution.


storage - Better performance when HDD write cache is disabled? (HGST Ultrastar 7K6000 and Media Cache behavior)

Attention, please. Long read.
During initial performance tests of Hitachi Ultrastar 7K6000 drives that I'm planning to use in my Ceph setup I've noticed a strange thing: write performance is better when disk write cache is disabled.







I use fio:



fio --filename=/dev/sda --direct=1 --sync=1 --rw=randwrite --bs=4k --numjobs=1 --iodepth=1 --runtime=60 --time_based --group_reporting --name=4krandw


When write cache is disabled:




hdparm -W 0 /dev/sda 

4krandw: (groupid=0, jobs=1): err= 0: pid=6368: Thu Jun 22 07:36:44 2017
write: io=63548KB, bw=1059.9KB/s, iops=264, runt= 60003msec
clat (usec): min=473, max=101906, avg=3768.57, stdev=11923.0


When write cache is enabled:



hdparm -W 1 /dev/sda


4krandw: (groupid=0, jobs=1): err= 0: pid=6396: Thu Jun 22 07:39:14 2017
write: io=23264KB, bw=397005B/s, iops=96, runt= 60005msec
clat (msec): min=1, max=48, avg=10.30, stdev= 4.12


Relevant hardware details:




  • Server: Supermicro 5018D8-AR12L


  • Storage controller: LSI2116 IT mode (integrated SW solution) works without any caching or logical volume management

  • Disks: Hitachi Ultrastar 7K6000 4Tb (HUS726040ALE614)

  • OS: Ubuntu 16.04.2, kernel 4.4.0-81-generic





Unfortunately, I can not think of any reasonable explanation for this behaviour, quick summary:





  • Write cache disabled: 264 IOPS, 3.768ms commit latency (high std deviation, though)

  • Write cache enabled: 96 IOPS, 10.3ms commit latency





UPD: I have tested the disk with direct connection to a SATA port on the motherboard (separate SATA controller, not LSI2116) and nothing has changed, the same results. So, I presume, that's not a SW LSI2116 controller that cause strange results.

UPD2: Interestingly, performance gain for sequential operations when cache is disabled is lower, but stable. Here's an example:



fio --filename=/dev/sdl --direct=1 --sync=1 --rw=write --bs=16M --numjobs=1 --iodepth=1 --runtime=60 --time_based --group_reporting --name=16M-wr 




Write cache enabled:



16M-wr: (groupid=0, jobs=1): err= 0: pid=2309: Fri Jun 23 11:52:37 2017
write: io=9024.0MB, bw=153879KB/s, iops=9, runt= 60051msec
clat (msec): min=86, max=173, avg=105.37, stdev= 9.64


Write cache disabled:




16M-wr: (groupid=0, jobs=1): err= 0: pid=2275: Fri Jun 23 11:45:22 2017  
write: io=10864MB, bw=185159KB/s, iops=11, runt= 60082msec
clat (msec): min=80, max=132, avg=87.42, stdev= 6.84


And this becomes interesting because difference between results when cache enabled and disabled is exactly what HGST claims in their datasheet:
https://www.hgst.com/sites/default/files/resources/Ultrastar-7K6000-DS.pdf




•Compared to prior generation 7K4000
...
— Up to 3X faster random write performance using media cache technology
— 25% faster sequential read/write performance





It still does not explain why performance is better with write cache disabled, however, it indeed looks like when write cache is enabled, I get performance comparable to prev. generation 7K4000. Without write cache random write performance is 2.6x faster and sequential is 1.2X faster.



UPD3 hypotesis:
Newer Hitachi Ultrastar drives has a feature called Media Cache. It is an advanced non-volatile caching technique and here's how it works (as I understand it, of course):




  • First data is written into DRAM cache

  • Next, drive has many reserved areas on each platter physically located in areas providing the best speed. These areas are essentially Media Cache storage. So, these areas are used as non-volatile second stage cache. The data from DRAM buffer is accumulated and flushed with high queue depth into Media Cache. This allows to minimize head movements and provides additional reliability and speed gain.

  • And only after that data is written to the actual storage areas on the platter.




So, Media Cache is a two-stage writeback cache and I think that write operation is considered complete only after flush to the Media Cache is done.
Interesting technique, I must admit. My hypotesis is that when we disable write caching with hdparm -W0, only media cache is disabled.
Data is being cached only in DRAM and then directly flushed to the platters. Although, Media Cache for sure should provide great advantage, during synchronous writes we have to wait for writes to the Media Cache area. And when Media Cache is disabled write is considered complete after data is written into disk DRAM buffer. Much faster. On lower queue depths DRAM cache provides enough space to write without speed degradation, however, on larger queues, when MANY flushes to the platter has to happen constantly the situation is different. I have performed two tests with QD=256.



fio --filename=/dev/sda --direct=1 --sync=1 --rw=randwrite --bs=4k --numjobs=1 --iodepth=256 --runtime=180 --time_based --group_reporting --name=4krandwrite

hdparm -W0 /dev/sda (write cache disabled)
4krandwrite: (groupid=0, jobs=1): err= 0: pid=3176: Wed Jun 28 10:11:15 2017
write: io=62772KB, bw=357093B/s, iops=87, runt=180005msec
clat (msec): min=1, max=72, avg=11.46, stdev= 4.95


hdparm -W1 (write cache enabled)
4krandwrite: (groupid=0, jobs=1): err= 0: pid=3210: Wed Jun 28 10:14:37 2017
write: io=70016KB, bw=398304B/s, iops=97, runt=180004msec
clat (msec): min=1, max=52, avg=10.27, stdev= 3.99


So, we clearly see that enabling write cache gives 11.5% advantage in IOPS and commit latency. Looks like my hypotesis is correct and hdparm controls only Media Cache, but not DRAM buffer. And on higher queue depths MC really pays for itself



This is not the case for sequential operations, though.




fio --filename=/dev/sda --direct=1 --sync=1 --rw=write --bs=16M --numjobs=1 --iodepth=256 --runtime=180 --time_based --group_reporting --name=16Mseq

hdparm -W0 /dev/sda (write cache disabled)
16Mseq: (groupid=0, jobs=1): err= 0: pid=3018: Wed Jun 28 09:38:52 2017
write: io=32608MB, bw=185502KB/s, iops=11, runt=180001msec
clat (msec): min=75, max=144, avg=87.27, stdev= 6.58

hdparm -W1 /dev/sda (write cache enabled)
16Mseq: (groupid=0, jobs=1): err= 0: pid=2986: Wed Jun 28 09:34:00 2017

write: io=27312MB, bw=155308KB/s, iops=9, runt=180078msec
clat (msec): min=83, max=165, avg=104.44, stdev=10.72


So, I guess, Media Cache provides speed advantage on random write loads, for sequential writes it may be used mainly as additional reliability mechanism.







UPD4 (Looks like I've got an answer)
I have contacted HGST support and they have clarified that on 7K6000 media cache is active only when write cache (DRAM) is disabled. So, it looks like on low queue depths Media Cache is actually faster than DRAM cache. I guess, this is because Media Cache allows to write data sequentially into it's cache areas irrespectively of IO pattern. That greatly minimizes required HDD head movements and leads to better performance. I still would like to know more about Media Cache, so, I am not answering my own question yet. Instead, I've asked support for more technical info on Media Cache. Will update this question with more info if I get any.







I still will greatly appreciate any suggestions, comments or alternative explanations. Thanks in advance!

Tuesday, February 5, 2019

Set up server at home for running svn and Bugzilla



I'm a fairly experienced developer, but when it comes to servers and network related stuff, I'm pretty green.



We are developing a web site, and I would like to set up a server that can host my SubVersion repository, and also host Bugzilla for when we release a testversion on some users.



So what do i need to accomplish this? I have an old computer that can be used. Can I run this on any OS? It currently has Win 7 installed, but I was thinking about going for Ubuntu instead. Any reason to go for one or the other?



I guess I need a web server, and I guess Apache will do fine. Do I need something else to let my computer be available from all over the web, or is a web server and a standard internet connection all it takes?




A link some good online tutorials would be much appreciated. And then I mean for real dummies ;). I usually find pages that try to explain setting up servers going way over my head.


Answer



I'd go with some kind of Linux. You can run what you want on Windows but it is more complicated and less supported. These are open source projects and their native environment is typically Linux.



You'll either need a static IP address on your internet connection, or you'll need to use some kind of dynamic DNS service that allows you to change the DNS when your IP address changes.



Subversion in general






These will help setting up SVN & Apache so the source control can be accessed externally (not sure if you want that)




Monday, February 4, 2019

zfs - zpool import on a 50TB volume is taking forever: What is it doing?



We have a fiber channel san managed by two OpenSolaris 2009.06 NFS servers.




  • Server 1 is managing 3 small volumes (300GB 15K RPM drives). It's working like a charm.

  • Server 2 is managing 1 large volume of 32 drives (2TB 7200 RPM drives) RAID6. Total size is 50TB.

  • Both servers have Zpool version 14 and ZFS version 3.




The slow 50TB server was installed a few month ago and was working fine. Users filled-up 2TB. I did a small experiment (created 1000 filesystems and had 24 snapshots on each). Everything when well as far as creating, accessing the filesystems with snapshots, and NFS mounting a few of them.



When I tried destroying the 1000 filesystems, the first fs took several minutes and then failed reporting the fs was in use. I issued a system shutdown but took more than 10 minutes. I did not wait longer and shut the power off.



Now when booting, OpenSolaris hangs. The lights on the 32 drives are blinking rapidly. I left it for 24 hours - still blinking but no progress.



I booted into an system snapshot before the zpool was created and tryied importing the zpool.



pfexec zpool import bigdata



Same situation: LEDs blinking and the import hangs forever.



Dtracing the "zpool import" process shows only the ioctl system call:



dtrace -n syscall:::entry'/pid == 31337/{ @syscalls[probefunc] = count(); }'

ioctl 2499



Is there a way to fix this? Edit: Yes. Upgrading OpenSolaris to svn_134b did the trick:



pkg publisher # shows opensolaris.org
beadm create opensolaris-updated-on-2010-12-17
beadm mount opensolaris-updated-on-2010-12-17 /mnt
pkg -R /mnt image-update
beadm unmount opensolaris-updated-on-2010-12-17
beadm activate opensolaris-updated-on-2010-12-17
init 6



Now I have zfs version 3. Bigdata zpool stays at version 14. And it's back in production!



But what was it doing with the heavy I/O access for more then 24 hours (before the software upgraded)?


Answer



With ZFS you really want to let it manipulate the disks directly as it improves concurrency. The single 50TB disk you gave it is a choking point.



That DTrace script is only tracking syscalls. The real action happens inside the kernel and if you want to see what's consuming most of the CPU, use the 'hotkernel' script from the DTrace Toolkit.




When you import a pool, ZFS reads the config from the disk and validates it. After the pool is imported, it'll start mounting all those 1000s filesystems and snapshots that you created. This can take a while. If you had dedup enabled (which you don't since you were using snv_111), it'd take even more time since it has to load the dedup table (DDT).



Shutting down the system is never a good option, specially on OpenSolaris snv_111. You haven't posted your pool configuration (zpool status) but, if you have slog devices and they fail, you won't be able to import the pool (this has been addressed recently in Solaris 11 Express snv_151a).



My advice is that you export each of the 32 disks individually and create multiple raidz2 vdev's so you have more read/write heads. Do not create huge vdev's with >8 disks because performance will be abysmal.



If you cannot afford to have the system down for so long (most people don't), study ZFS snapshots carefully and how to replicate them to a remote server with zfs send/receive. That will allow you to quickly bring a failover server up.


linux - Using Cloud Servers and Firewall

I would like to ask if the configuration of "firewall rules eg. only allowing port 80.. when configuring a server instance on cloud services such as google cloud and amazon aws is securely equivalent to hardware firewall implementations."




Are there settings or configuration on the "cloud instance firewall" cannot be achieved as compared to the hardware firewall?



Could someone help me clear this doubt that I can't be sure of? Thanks.

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...