DEPLOYING AND MANAGING MICROSOFT APPLICATIONS IN EMC HYBRID CLOUD WITH VMWARE

Transcription

1 DEPLOYING AND MANAGING MICROSOFT APPLICATIONS IN EMC HYBRID CLOUD WITH VMWARE Based on the EMC Hybrid Cloud with VMware Foundation Infrastructure Solution 2.5 EMC Solutions Abstract This describes how to use EMC Hybrid Cloud with VMware Foundation Infrastructure Solution 2.5 to provision and manage new and existing Microsoft Exchange, Microsoft SQL Server, and Microsoft SharePoint applications for onpremises or hosted cloud services. September 2014

2 Copyright 2014 EMC Corporation. All rights reserved. Published in the USA. Published September 2014 EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. The information in this publication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. EMC 2, EMC, and the EMC logo are registered trademarks or trademarks of EMC Corporation in the United States and other countries. All other trademarks used herein are the property of their respective owners. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. Part Number H

3 Contents Contents Chapter 1 Executive Summary 11 Document purpose Audience Solution purpose Business challenge Technology solution Key components Software components Terminology Chapter 2 Hybrid Cloud Overview 21 Overview Solution architecture Self-service and automation Multitenancy and secure separation Workload-optimized storage Security and compliance VMware NSX for vsphere Monitoring and service assurance Chapter 3 Provisioning Microsoft Applications 29 Overview VMware vcloud Application Director Marketplace Cloud providers Deployment environments Application owners and business groups Logical templates vcloud Application Director Services Application blueprints Publishing application blueprints Service Catalog Services Actions Entitlements

4 Contents Approval Policies Storage tiering Provisioning Microsoft Active Directory Services Provisioning Microsoft Exchange Exchange Server application blueprints Additional services Publishing a stand-alone Exchange Server Requesting Exchange Server from vcac catalog Validating an Exchange Server deployment Provisioning Microsoft SQL Server Anti-affinity rules for SQL Server virtual machines SQL Server application blueprints Additional services Requesting a SQL Server Approving a request Validating a SQL Server deployment Provisioning Microsoft SharePoint Provisioning SharePoint Provisioning SharePoint Chapter 4 High Availability for Microsoft Applications on EMC Hybrid Cloud67 Overview High availability Microsoft Exchange DAG vsphere HA with Exchange DAGs vsphere DRS with Exchange DAG Anti-Affinity rules for Exchange virtual machines Provisioning an Exchange DAG Microsoft SQL Server with AAG Provisioning SQL Server 2012 AAG Application Director Blueprint for SQL Server AAG Verifying SQL Server 2012 AAG deployment Microsoft SharePoint availability Chapter 5 Monitoring Microsoft Applications 79 Overview VMware vcenter Hyperic Supported versions vcenter Hyperic Agent Auto-Discovery

5 Contents VMware vcenter Operations Manager VC OPS integration with Hyperic Monitoring Microsoft Exchange Exchange 2013 Metrics Microsoft Exchange dashboards Monitoring Microsoft SQL Server SQL Server Metrics SQL Server dashboards Monitoring Microsoft SharePoint SharePoint server metrics SharePoint dashboards Chapter 6 Elasticity for Microsoft Applications 95 Overview Threshold Alerts Notification Elasticity for Microsoft Exchange Elasticity for Microsoft SQL Server Elasticity for Microsoft SharePoint SharePoint SharePoint Chapter 7 Conclusion 111 Summary Findings Chapter 8 Reference Documentation 113 EMC documentation VMware documentation Microsoft documentation

6 Contents Figures Figure 1. EMC Hybrid Cloud components Figure 2. EMC Hybrid Cloud features and functionality Figure 3. Solution reference architecture Figure 4. Self-service provisioning through the vcac portal Figure 5. Sample Microsoft application dashboard Figure 6. Workflow for publishing a vcloud Application Director blueprint Figure 7. Importing application blueprints from the Marketplace Figure 8. Sample of Marketplace import options Figure 9. Adding a cloud provider and vcac blueprints Figure 10. vcac Blueprints and Logical Templates are added to a cloud provider Figure 11. Setting build information for a vcac cloud blueprint Figure 12. Adding a service created on vcloud Application Director Figure 13. Creating an application blueprint Figure 14. Dragging and dropping GUI in vcloud Application Manager Figure 15. Publishing application blueprints to vcac Figure 16. Using the overridable option for an application parameter Figure 17. Reviewing and publishing the application blueprint to vcac catalog Figure 18. Viewing application blueprints added to vcac Catalog Items Figure 19. Viewing the vcac Service Catalog Figure 20. Viewing the vcac Service Catalog for SQL Server Figure 21. Viewing vcac Services Figure 22. Viewing vcac Catalog Items Figure 23. Viewing vcac Actions Figure 24. Viewing vcac Entitlements Figure 25. Approving or rejecting a request Figure 26. Selecting a storage tier Figure 27. Selecting a storage tier for SQL Server in vcac Figure 28. Provisioning Microsoft Active Directory from vcac Figure 29. Properties and actions for Exchange 2013 (stand-alone) blueprint Figure 30. Selecting a stand-alone Exchange server blueprint Figure 31. Editing a stand-alone Exchange application blueprint properties Figure 32. Editing options for a stand-alone Exchange blueprint Figure 33. Viewing vcac Service Catalog items for Exchange Figure 34. Viewing vcac application parameters for Exchange Server Figure 35. Confirming a successful Exchange Server deployment Figure 36. Viewing a provisioned application for Exchange Server

7 Figure 37. Figure 38. Contents Exchange admin center: newly deployed Exchange Server verification Viewing properties and actions for a SQL Server application blueprint deployment Figure 39. Viewing vcac Service Catalog for SQL Server Figure 40. Viewing vcac application properties for SQL Server Figure 41. Viewing Pending Approval of vcac requests for SQL Server Figure 42. Confirming a successful SQL Server deployment Figure 43. Viewing a provisioned application Figure 44. Example of a completed SQL Server deployment Figure 45. Application Director SharePoint blueprints available for deployment Figure 46. vcloud Application Director services for SharePoint deployments Figure 47. vcloud Application Director application blueprint for SharePoint Figure 48. SharePoint service types, templates, and services for the vcac blueprint Figure 49. Application Director service properties for a SharePoint blueprint Table 3. SharePoint blueprint property values Figure 50. Viewing SharePoint service catalog selections in the vcac Figure 51. Adding information for a SharePoint deployment request Figure 52. Changing service options for a SharePoint deployment Figure 53. Viewing deployed SharePoint virtual machine in vcac Figure 54. SharePoint farm deployment information Figure 55. Selecting a SharePoint template Figure 56. Deploying a SharePoint 2013 blueprint in Application Director Figure 57. Viewing vcac Catalog items for SharePoint Figure 58. Viewing a successful SharePoint 2013 deployment Figure 59. Configuring a new SharePoint farm for HR Figure 60. Anti-Affinity DRS rule for Exchange DAG servers Figure 61. Selecting an Exchange server blueprint from available Applications Figure 62. Viewing the application blueprint for an Exchange 2013 DAG Figure 63. Submitting a blueprint for deployment Figure 64. Selecting and deploying the Exchange DAG template in the vcac catalog Figure 65. Viewing the SQL Server AAG catalog items in vcac Figure 66. Viewing the AAG application blueprint Figure 67. Viewing the AAG application blueprint description Figure 68. Viewing AAG service dependencies Figure 69. Reviewing task execution workflow for AAG Figure 70. Viewing the deployed Availability Replicas in SQL Server Figure 71. SharePoint virtual machine protection by vsphere HA

8 Contents Figure 72. vcenter Hyperic Plugin Manager Figure 73. Adding the Hyperic Service on vcloud Application Director Figure 74. Auto-Discovery window on vcenter Hyperic Figure 75. vc Ops custom UI Figure 76. Installing and configuring the Hyperic Management Pack Figure 77. Confirming the Management Pack for Hyperic is listed Figure 78. Managing Adapter Instance Figure 79. Adding and setting up the Hyperic Adapter Instance Figure 80. Sample metrics in Hyperic Figure 81. Sample Exchange attribute package Figure 82. Exchange dashboard Figure 83. Managing attribute packages Figure 84. Viewing SQL Server Resource Details Figure 85. Customizing a SQL Server dashboard Figure 86. SQL Server customized dashboard sample Figure 87. Managing attribute packages for SharePoint Figure 88. Viewing SharePoint Resource Details Figure 89. Creating a custom SharePoint dashboard Figure 90. SharePoint customized dashboard sample Figure 91. Alerts Overview Figure 92. Configuring an alert Figure 93. Blueprint for Exchange 2013 DAG expansion Figure 94. Configuration properties for Exchange 2013 DAG expansion blueprint Figure 95. vcac Exchange DAG expansion request information and description Figure 96. vcac Exchange DAG expansion properties Figure 97. Deployment configuration properties for Exchange DAG expansion Figure 98. SQL Server alert Figure 99. Editing CPU resources for SQL Server Figure 100. CPU usage for SharePoint WFE in vc Ops Figure 101. SharePoint application blueprint Figure 102. SharePoint Application blueprint properties and actions Figure 103. SharePoint 2010 WFE selection from the vcac catalog Figure 104. SharePoint 2010 request information Figure 105. SharePoint 2010 request properties Figure 106. Provisioned SharePoint 2010 virtual machines in vcac Figure 107. SharePoint 2010 Farm information Figure 108. Options for virtual machines in vcac

9 Contents Figure 109. Destroying virtual machine confirmation options in vcac Figure 110. SharePoint 2013 WFE selection from the vcac catalog Figure 111. SharePoint 2013 request information and properties Figure 112. SharePoint 2013 Farm information

10 Contents Tables Table 1. Solution software requirements Table 2. Terminology Table 3. Exchange 2013 (stand-alone) blueprint property values Table 4. SQL Server blueprint property values Table 5. Exchange DAG blueprint property values Table 6. Exchange DAG expansion blueprint property values

11 Chapter 1: Executive Summary Chapter 1 Executive Summary This chapter presents the following topics: Document purpose Audience Solution purpose Business challenge Technology solution Software components Terminology

12 Chapter 1: Executive Summary Document purpose This describes how to deploy and manage Microsoft applications, such as Microsoft Exchange, Microsoft SQL Server, and Microsoft SharePoint within EMC Hybrid Cloud built with VMware vcloud Suite. This guide supplements the EMC Hybrid Cloud Solutions with VMware Foundation Infrastructure 2.5, which describes the foundation hybrid cloud solution in more detail. This guide introduces the main features and functionality of the solution, the solution architecture and key components, the validated hardware and software environment, and demonstrates the use cases enabled by this solution. Audience Solution purpose This guide is intended for EMC customers and qualified EMC partners. The guide assumes that users who intend to deploy this solution have the necessary training and background to install and configure an end-user computing solution based on EMC Hybrid Cloud with VMware, Microsoft Exchange, SQL Server, SharePoint, and the associated infrastructure. Users should also be familiar with the infrastructure and database security policies of the customer installation. This guide provides external references where applicable. EMC recommends that users implementing this solution are familiar with these documents. For details, refer to Reference Documentation. This solution enables EMC customers to build an enterprise-class, scalable, multitenant cloud that enables: Complete management of the infrastructure service lifecycle On-demand access to and control of network bandwidth, servers, storage, and security Provisioning, monitoring, and management of the infrastructure services by the line-of-business end user, without IT administrator involvement Provisioning of application blueprints with associated infrastructure resources by line-of-business application owners without IT administrator involvement Maximization of asset utilization This solution provides a reference architecture that integrates all the key components and functionality of a hybrid cloud. 12

13 Chapter 1: Executive Summary Business challenge Technology solution Business applications are becoming more integrated into a consolidated compute, network, and storage environment. Every organization is trying to: Lower operational costs Increase revenue Reduce risk While many organizations have successfully introduced virtualization as a core technology within their data center, the benefits of virtualization have largely been restricted to the IT infrastructure owners. End users and business units within customer organizations have not experienced the benefits of virtualization, such as increased agility, mobility, and control. Transforming the traditional IT model to a cloud-operating model involves overcoming the challenges of legacy infrastructure and processes, such as: Inefficiency and inflexibility Slow, reactive responses to customer requests Inadequate visibility into the cost of the requested infrastructure Limited choice of availability and protection services The difficulty in overcoming these challenges has given rise to public cloud providers who have built technology and business models specifically catering to the requirements of end-user agility and control. Many organizations are under pressure to provide these same service levels within the secure and compliant confines of the on-premises data center. As a result, IT departments need to create cost-effective alternatives to public cloud services alternatives that do not compromise enterprise features, such as data protection, disaster recovery, and guaranteed service levels. This solution for Microsoft applications on EMC Hybrid Cloud integrates the best of EMC and VMware products and services, and empowers IT organizations to accelerate implementation and adoption of a hybrid cloud while still enabling customer choice for the compute and networking infrastructure within the data center. This solution caters to customers who want to preserve their investment and make better use of their existing infrastructure and to those who want to build out new infrastructures dedicated to a hybrid cloud. This solution takes advantage of the strong integration between EMC technologies and the VMware vcloud Suite. As developed by the EMC and VMware product and services teams, this solution includes: EMC scalable storage arrays, integrated EMC and VMware monitoring, and data protection suites to provide a foundation for cloud services within customer environments. 13

14 Chapter 1: Executive Summary Key components This solution is based on the EMC Hybrid Cloud solution presented in the EMC Hybrid Cloud Solution with VMware Foundation Infrastructure 2.5. With the addition of vcloud Application Director, you can automate Microsoft application deployments, as shown in Figure 1. Figure 1. EMC Hybrid Cloud components Data center virtualization and cloud management VMware vcloud Automation Center VMware vcloud Automation Center (vcac) enables customized, self-service provisioning and lifecycle management of cloud services that comply with established business policies. vcac provides a secure portal where authorized administrators, developers, and business users can request new IT services and manage existing computer resources from predefined user-specific menus. VMware vcloud Application Director vcloud Application Director automates application provisioning in the cloud, including deploying, configuring, and updating the application's components and dependent middleware platform services on infrastructure clouds. vcloud Application Director simplifies complex deployments of custom and packaged applications on infrastructure clouds. 14

15 Chapter 1: Executive Summary VMware vsphere ESXi and VMware vcenter Server VMware vsphere ESXi is a virtualization platform for building cloud infrastructures. vsphere enables you to confidently run your business-critical applications to meet your most demanding service level agreements (SLAs) at the lowest total cost of ownership (TCO). vsphere combines this virtualization platform with the awardwinning management capabilities of VMware vcenter Server. This solution gives operational insight into the virtual environment for improved availability, performance, and capacity utilization. VMware vcenter Orchestrator VMware vcenter Orchestrator (vco) is an IT process automation engine that helps automate the cloud and integrates the VMware vcloud Suite with the rest of the management systems. vco enables administrators and architects to develop complex automation tasks within the workflow designer. The vco library of pre-built activities, workflows, and plug-ins help accelerate the customization of vcac standard capabilities. VMware NSX for vsphere VMware NSX for vsphere is the next generation of software-defined network virtualization and offers additional functionality and improved performance over traditional network and security devices. This additional functionality includes distributed logical routing, distributed firewalling, logical load balancing, and support for routing protocols such as Border Gateway Protocol (BGP), Intermediate System to Intermediate System (IS-IS), and Open Shortest Path First (OSPF). Where workloads on different subnets share the same host, the distributed logical router optimizes traffic flows by routing locally. This enables substantial performance improvements in throughput, with distributed logical routing and firewalling providing line-rate performance distributed across many hosts instead of being limited to a single virtual machine or physical host. NSX also introduces Service Composer, which integrates with third-party security services. VMware vcenter Operations Manager VMware vcenter Operations Manager (vc Ops) is the key component of the vcenter Operations Management Suite. It provides a simplified approach to operations management of vsphere and physical and cloud infrastructures. vc Ops provides custom dashboards to gain insights and visibility into the health, risk, and efficiency of Microsoft Applications running on EMC Hybrid Cloud. VMware vcenter Hyperic VMware vcenter Hyperic is a component of the VMware vcenter Operations Management Suite. It is used to monitor metrics specifically related to SQL Server, SharePoint and Exchange. VMware vcenter Log Insight VMware vcenter Log Insight delivers automated log management through log aggregation, analytics, and search. With an integrated cloud operations management approach, it provides the operational intelligence and enterprise-wide visibility needed to proactively enable service levels and operational efficiency in dynamic hybrid cloud environments. 15

16 Chapter 1: Executive Summary VMware IT Business Management Suite VMware IT Business Management (ITBM) Suite provides transparency and control over the cost and quality of IT services. By providing a business context to the services that IT offers, ITBM helps IT organizations move from a technology orientation to a service-broker orientation, delivering a portfolio of IT services that aligns with the needs of business stakeholders. EMC storage services EMC ViPR EMC ViPR is a lightweight, software-only solution that transforms existing storage into a simple, extensible, and open platform. ViPR extends current storage investments to meet new cloud-scale workloads, and enables simple data and application migration out of public clouds and back under the control of IT (or vice versa). ViPR gives IT departments the ability to deliver on-premises, fully automated storage services at price points that are at or below public cloud providers. EMC ViPR SRM EMC ViPR SRM, storage resource management software, provides comprehensive monitoring, reporting, and analysis for heterogeneous block, file, and virtualized storage environments. It enables you to visualize applications to storage dependencies, monitor and analyze configurations and capacity growth, and optimize your environment to improve return on investment. EMC VNX and EMC Symmetrix VMAX EMC VNX and EMC Symmetrix VMAX are powerful, trusted, and smart storage array platforms that provide the highest level of performance, availability, and intelligence in the hybrid cloud. VNX and VMAX storage systems offer a broad array of functionality and tools, such as Fully Automated Storage Tiering for Virtual Pools (FAST VP), enabling multiple storage service levels to support ViPR-driven storage-asa-service offerings in the hybrid cloud environment. Software components Table 1 provides the Microsoft application versions used in this solution. For a complete list of other software requirements refer to EMC Hybrid Cloud with VMware Foundation Infrastructure 2.5. Table 1. Solution software requirements Software Version Notes Enterprise Applications on EMC Hybrid Cloud Microsoft Windows Server 2008 R2 Used for deployment of Domain Controllers, SQL 2008 R2 and SharePoint 2010 Microsoft Windows Server 2012 Used for deployment of Microsoft Exchange, SQL and SharePoint Microsoft Exchange 2010 and 2013 A version of Microsoft Exchange used for deployments 16

17 Chapter 1: Executive Summary Software Version Notes Microsoft SQL Server 2008 R2 and 2012 A version of Microsoft SQL Server used for deployments Microsoft SharePoint EMC storage 2010 SP2 and 2013 SP2 A version of Microsoft SharePoint used for deployments EMC ViPR 2.0 P1 EMC ViPR software-defined storage EMC Unisphere for VMAX Management software for EMC VMAX EMC Enginuity Operating environment for VMAX EMC VNX Operating Environment Release 33 Operating environment for VNX block EMC Solutions Enabler CLI software for Symmetrix VMAX storage management EMC SMI-S Provider SMI-S Provider for Solutions Enabler 7.6 EMC PowerPath Virtual Edition 5.9 SP1 Multipathing and load balancing for block access EMC and VMware integration EMC Hybrid Cloud Foundation Module 2.5 A customization package for STaaS and foundation workflows EMC Virtual Storage Integrator 6.2 EMC plug-in for VMware vsphere Web Client EMC ViPR plug-in for VMware vcenter Orchestrator EMC ViPR plug-in for vcenter Orchestrator workflows Additions to EMC Hybrid Cloud VMware vcloud Application Director Accelerates streamlining and optimization of applications deployment through logical application blueprints by leveraging preapproved, standardized OS and middleware components VMware vcenter Hyperic A component of vcenter Operations Manager 17

18 Chapter 1: Executive Summary Terminology Table 2 provides definitions for some of the terms used in this guide. Table 2. Terminology Term Microsoft Active Directory (AD) Application Programming Interface (API) Application blueprint Backup-as-a-Service (BaaS) Business group Database availability group (DAG) AlwaysOn Availability Group (AAG) high availability (HA) Infrastructure-as-a- Service (IaaS) Definition Provided with Windows Server as a special-purpose database or directory that is designed to store systemspecific data for handling a large number of read and search operations, which are hierarchical, replicated, and extensible. A set of routines, protocols, and tools for building and communicating with software applications. Logical topology of an application for the deployment in a virtual cloud. A blueprint captures the structure of an application with logical nodes, their corresponding services and operating systems, dependencies, default configurations, and network and storage topology requirements. The blueprint is published as a catalog item in the common service catalog. Uses a cloud infrastructure to backup data to a shared, rather than a dedicated, backup infrastructure. A set of users, often corresponding to a line of business, department, or other organizational unit, that can be associated with a set of catalog services and infrastructure resources. A set of highly available Microsoft Exchange Mailbox servers that host a set of databases and provides automatic database-level recovery from failures that affect individual servers or databases. A high-availability and disaster-recovery feature included with SQL Server as an enterprise-level alternative to database mirroring. Enables a system or infrastructure to continue to provide applications and access to data if a single component or resource fails and service is interrupted for only a brief time, which might or might not be apparent to users. A standard of automated resources that include compute, storage and networking capabilities through a host or service provider. 18

19 Chapter 1: Executive Summary Term IT-as-a-Service (ITaaS) Key performance indicator (KPI) Logical template Public-key infrastructure (PKI) vcloud Application Director Properties vcloud Application Director Service Secure Sockets Layer (SSL) VMware vcloud Automation Center (vcac) virtual local area network (VLAN) virtual extensible LAN (VXLAN) Definition Enterprise IT that acts and operates as a competitive service provider for an organization with many IT service options. Additional service options for providers, other than the internal IT organization, might include outsourcing companies and public cloud providers. A quantifiable measure that compares performance criteria, including strategic and operational goals of an organization. A predefined virtual machine definition in vcloud Application Director that can be mapped to a cloud template in the cloud catalog and supporting services enabling an application blueprint to remain cloudagnostic. A system of digital certificates or authorities that provide public-key encryption. It authenticates the validity of each party involved in an Internet transaction and establishes and maintains a trustworthy networking environment across a wide variety of applications for an organization. vcloud Application Director configuration name-value pairs for services and application components that are variables used by scripts to set parameters and run various configurations. vcloud Application Director scripted software that can be installed on a virtual machine and reused in multiple applications. A language used by an application to communicate with another application that provides services. Enables customized, self-service provisioning and lifecycle management of cloud services that comply with established business policies Enables a geographically dispersed network of computers and users to communicate in a simulated environment as if they exist in one LAN and are sharing a single broadcast and multicast domain. VLANs quickly adapt to changes in network requirements and relocation of workstations and server nodes. Runs an overlay, virtual network that is built on top of existing network Layer 2 and Layer 3 technologies to support elastic compute architectures, which enables network engineers to scale out a cloud computing environment while logically isolating cloud apps and tenants. 19

20 Chapter 1: Executive Summary Term web front-end (WFE) Definition A Web-based user interface for a back-end service, such as a database. It is a Web server that handles Web page requests from users. A SharePoint farm can use multiple WFE servers and a Network Load Balancer (NLB) to distribute requests for scalability and redundancy. 20

21 Chapter 2: Hybrid Cloud Overview Chapter 2 Hybrid Cloud Overview This chapter presents the following topics: Overview Solution architecture Self-service and automation Multitenancy and secure separation Workload-optimized storage Security and compliance Monitoring and service assurance

22 Chapter 2: Hybrid Cloud Overview Overview This EMC Hybrid Cloud solution brings new functionality to IT organizations, developers, end users, and line-of-business owners. In addition to delivering baseline infrastructure as a service (IaaS) built on the software-defined data center (SDDC) architecture, EMC Hybrid Cloud also delivers feature-rich capabilities that enable businesses to expand from IaaS to IT-as-a-service (ITaaS). Backup-as-a-service (BaaS) and disaster-recovery-as-a-service (DRaaS) are policies that can now be enabled with just a few clicks. End users and developers can quickly gain access to a marketplace of application resources from Microsoft, Oracle, SAP, EMC Syncplicity, Pivotal, and add third-party packages, as needed. All these resources can be deployed on private cloud or public cloud services as cloud service providers powered by EMC, including VMware vcloud Air. This solution includes the following features and functionality, as shown in Figure 2: Self-service and automation Multitenancy and secure separation Workload-optimized storage Security and compliance Monitoring and service assurance Figure 2. EMC Hybrid Cloud features and functionality 22

23 Chapter 2: Hybrid Cloud Overview Solution architecture Figure 3 shows the architecture for this EMC Hybrid Cloud solution. The addition of VMware vcloud Application Director and VMware vcenter Hyperic enables automated deployment of Microsoft applications and application monitoring during the application lifecycle. Figure 3. Solution reference architecture Self-service and automation This solution provides self-service provisioning of automated cloud services to both end users and infrastructure level administrators. EMC Hybrid Cloud uses VMware vcloud Application Director and VMware vcloud Automation Center integrated with EMC ViPR and VMware NSX to provide the compute, storage, network, and security virtualization platforms for the SDDC. These platforms enable you to rapidly deploy 23

24 Chapter 2: Hybrid Cloud Overview and provision business-relevant cloud services across your hybrid cloud and physical infrastructure. Cloud users can request and manage their applications and compute resources within established operational policies; this can reduce IT service delivery times from days or weeks to minutes. Features include: Cross-cloud storefront Acts as a service governor that provisions workloads based on business and IT policies Role-based self-service portal Delivers a user-appropriate catalog of IT services Resource reservations Enables resources to be allocated for use by a specific group and ensures that those resources are inaccessible to other groups Service levels Defines the amount and type of resources a specific service can receive, either during the initial provisioning or as part of any configuration changes Build specifications Contains the automation policies that specify the process for building or reconfiguring compute resources In this solution, vcac and vcloud Application Director enable businesses to rapidly deploy and provision applications and services to the cloud platform on demand. vcac enables you to divide a shared infrastructure into logical units and capacities that can be assigned to different business units. Using role-based entitlements, you can choose from your own self-service catalog of custom-defined services and blueprints. Each catalog presents only the virtual machines, applications, and service blueprints that users have permission to view, based on their assigned role within the business. vcloud Application Director blueprints are created and published to vcac. These published blueprints contain virtual machine deployment information, as well as any application deployments and ancillary scripts for deploying services to a virtual machine (Hyperic agents, for example). Virtual machine and application blueprints can apply to single systems or multiple systems, covering both bare-metal server deployments and virtual machine deployments. From predefined blueprints, you can easily deploy multitier enterprise applications requiring multiple application, database, and Web components, and related services. Figure 4 shows an EMC Hybrid Cloud self-service portal in vcac. 24

25 Chapter 2: Hybrid Cloud Overview Figure 4. Self-service provisioning through the vcac portal You can apply data protection policies to virtual machine resources at provisioning time, which enables users to request on-demand backup and restore operations on their virtual machines and to generate backup reports, all from the vcac self-service portal. As part of the vcac provisioning process, you can use NSX virtual routing to provide an on-demand deployment model for creating custom networks, which support NSX edge routers and logical switches. This enables you to build a custom configuration as part of a multi-machine provisioning process. This solution is built to work with new and existing infrastructures. It supports the differing requirements of an enterprise s many business units and integrates with a wide variety of existing IT systems and best practices. Multitenancy and secure separation Multitenancy requirements in a cloud environment can range from shared, open resources to completely isolated resources that are secure from any access, depending on the organization s end-user requirements. This solution provides the ability to enforce physical and virtual separation for multitenancy, offering different levels of security to meet business requirements. This separation can encompass network, compute, and storage resources, to ensure appropriate security and performance for each tenant. 25

26 Chapter 2: Hybrid Cloud Overview The solution supports secure multitenancy through vcac role-based access control (RBAC), enabling vcac roles to be mapped to Active Directory groups. vcac uses existing authentication and business groupings. The self-service portal shows only specific views, functions, and operations based on the user s role within the business. You can achieve physical resource separation in vcac to isolate tenant resources or to isolate and contain compute resources for licensing purposes. You can also achieve resource separation between and within resource groups, depending on the level of separation required. Virtualized compute resources within the hybrid cloud are objects inherited from the vsphere endpoint, most commonly representing VMware vsphere ESXi hosts, host clusters, or resource pools. You can configure compute resources at the vsphere layer to ensure physical and logical separation of resources between functional environments, such as between Production, Test, and Development (Test/Dev). Valid concerns exist for information leakage and nosy neighbors on a shared network infrastructure. Consumers of the provisioned resources must operate in a dedicated environment to benefit from infrastructure standardization. To address these concerns, this solution has been designed for multitenancy. We approached this from a defense-in-depth perspective by: Workload-optimized storage Implementing virtual local area networks (VLANs) to enable isolation at Layer 2 in the cloud management pods and where the solution intersects with the physical network Using VXLAN overlay networks to segment tenant and business group traffic flows Integrating with firewalls functioning at the hypervisor level to protect virtualized applications and enabling security policy enforcement in a consistent fashion throughout the solution Deploying provider and business group edge firewalls to protect the business group and tenant perimeters This solution enables you to take advantage of the proven benefits of EMC storage in a hybrid cloud environment. Using EMC ViPR storage services and the capabilities of VNX and VMAX, this solution enables you to manage the policies of software-defined block- and file-based virtual storage. With scalable storage architecture that uses the latest flash and tiering technologies, VNX and VMAX storage arrays enable you to meet any workload requirements with maximum efficiency, performance, and cost-effectiveness. With ViPR, the storage configuration is abstracted and presented as a single storage control point, enabling cloud administrators to access all heterogeneous storage resources within a data center as if they were a single large array. 26

27 Security and compliance Chapter 2: Hybrid Cloud Overview As a result, storage administrators are able to maintain control of their storage resources and policies while enabling the cloud administrator to automatically provision storage resources into the cloud infrastructure. This solution enables you to enhance security by establishing a hardened security baseline across the hardware and software stacks supporting their EMC Hybrid Cloud infrastructure. The solution helps to reduce concerns around the complexities of the underlying infrastructure by demonstrating how to tightly integrate an as-a-service solution stack with public key infrastructure (PKI) and a common authentication directory to provide centralized administration and tighter control over security. The solution addresses the challenges of securing authentication and configuration management to aid compliance with industry and regulatory standards as follows: Securing the infrastructure by integrating with a PKI to provide authenticity, non-repudiation, and encryption Converging the various authentication sources into a single directory to enable a centralized point of administration and policy enforcement Using configuration management tools to generate infrastructure reports for audit and compliance purposes VMware NSX for vsphere You can use NSX for vsphere in EMC Hybrid Cloud to enable a richer networking and security feature set than that provided by traditional solutions. Enhanced networking and security features in NSX include: NSX logical routing and firewalls provide high line-rate performance distributed across many hosts instead of being limited to a single virtual machine or physical host. Distributed logical routers contain East-West traffic within the hypervisor where workloads reside on the same host. Logical load balancer enables load sharing across a pool of virtual machines with configurable health check monitoring and application-specific rules for high availability service, URL rewriting, and advanced Secure Sockets layer (SSL) handling. A distributed firewall enables consistent data-center-wide security policies. Security policies can be applied directly to security groups enabling greater flexibility in enforcing security policies. Monitoring and service assurance For application administrators, this solution provides detailed monitoring and alerting capabilities with Microsoft SQL Server, Exchange, and SharePoint deployments that are running on an EMC Hybrid Cloud. These abilities enable indepth analysis of real-time workloads on applications, which allows anomalies to be identified promptly, reducing potential performance degradation and any impact to users. vcenter Hyperic and vc Ops are EMC Hybrid Cloud components that make up 27

28 Chapter 2: Hybrid Cloud Overview this functionality. The Management Pack for vcenter Hyperic provides metrics reports specific to Microsoft applications in vc Ops. Customized dashboards can be created providing at-a-glance views of the availability and utilization of applications. This enables application teams to fine tune applications guaranteeing service levels across the various business groups configured on EMC Hybrid Cloud. You can configure notifications to ensure the appropriate application teams are notified in the event of a KPI or threshold breach. Figure 5 shows an example of a Microsoft Application dashboard on vc Ops. Figure 5. Sample Microsoft application dashboard 28

29 Chapter 3: Provisioning Microsoft Applications Chapter 3 Provisioning Microsoft Applications This chapter presents the following topics: Overview VMware vcloud Application Director Publishing application blueprints Service Catalog Approval Policies Storage tiering Provisioning Microsoft Active Directory Services Provisioning Microsoft Exchange Provisioning Microsoft SQL Server Provisioning Microsoft SharePoint

30 Chapter 3: Provisioning Microsoft Applications Overview This chapter describes the key components for this solution and how to provision Microsoft applications on EMC Hybrid Cloud with VMware, including: Microsoft SQL Server 2008 R2, Microsoft SQL Server 2012, Microsoft SharePoint 2013 SP2, Microsoft SharePoint 2010 SP2, and Microsoft Exchange The EMC Hybrid Cloud with VMware 2.5 provides a foundation for successful and consistent deployments of Microsoft applications. Generic blueprints are available for each application that can then be adapted to specific organizational requirements to guarantee a standard industry level of service. This section provides the high-level process and methodology required to successfully deploy these applications by using VMware vcloud Application Director with VMware vcac as the portal. Figure 6 illustrates the workflow used in this solution for each of the Microsoft applications deployed. Figure 6. Workflow for publishing a vcloud Application Director blueprint 30

31 Chapter 3: Provisioning Microsoft Applications VMware vcloud Application Director VMware vcloud Application Director enables you to construct application blueprints with a drag and drop GUI, which enables customers to quickly deploy Microsoft applications on an EMC Hybrid Cloud. These blueprints are easily transportable across EMC Hybrid Cloud environments. You can create application blueprints for each application and set of business requirements. You can then deploy these blueprints either directly from vcloud Application Director or publish them to a specific business group on vcac where users can request them. For Microsoft application deployments, users can request multiple versions of SQL Server, SharePoint, and Exchange from a self-service portal. An application requested from vcac allows application-related parameters to be modified prior to submitting the request. Marketplace You can enable a global setting where users can import application blueprints from the VMware Solutions Exchange Marketplace in vcloud Application Director, as shown in Figure 7. Figure 7. Importing application blueprints from the Marketplace Importing Microsoft Application blueprints from the Marketplace provides the preconfigured services and scripts required to install and customize applications in an EMC Hybrid Cloud environment. Figure 8 shows a sample of the options. The blueprints imported from the Marketplace can then be customized to meet the requirements of the application and the business. 31

32 Chapter 3: Provisioning Microsoft Applications Figure 8. Sample of Marketplace import options Cloud providers To enable application blueprints to be published to a particular business group on vcac, a cloud provider needs to be registered on vcloud Application Director, as shown in Figure 9. The cloud provider enables vcloud Application Director to communicate with vcac. Figure 9. Adding a cloud provider and vcac blueprints After a cloud provider is created for a specific business group, blueprints from vcac can be added to the cloud provider and then to a logical template, as shown in Figure 10. Figure 10. vcac Blueprints and Logical Templates are added to a cloud provider 32

33 Chapter 3: Provisioning Microsoft Applications Important parameters, such as the minimum and maximum CPU and memory, are defined within the vcac blueprints. A reservation policy can be specified in a vcac blueprint, or alternatively in a deployment environment on vcloud Application Director. The virtual machine templates used for application deployments are identified within a vcac blueprint. As shown in Figure 11, the Clone from field on the vcac blueprint is set to use a Windows 2008 R2 virtual machine template. Figure 11. Setting build information for a vcac cloud blueprint Deployment environments Application owners and business groups Logical templates vcloud Application Director Services Before application blueprints can be published from vcloud Application Director to vcac, a deployment environment must be configured. A Deployment Environment can have several reservations associated with it. The application deployment design in vcloud Application Director is managed by application owners, such as SQL Server administrators. These owners can then publish application services to vcac for deployment to meet business requirements. Additionally, specific users within business groups (for example, finance or HR) can be given permission to request application deployments from the vcac Catalog, which are then approved or denied by the application owners. A logical template associates a vcac blueprint to a vcloud Application Director blueprint. A supported operating system version is specified to ensure that only supported services can be used when constructing an application blueprint. The option to add a service to the logical template is available while building a logical template. Alternatively, services can be added while designing the application blueprint. Multiple vcac blueprints can be added to one logical template, which allows application blueprints to be published by using different reservation policies. Services are a fundamental element in creating Microsoft application blueprints with vcloud Application Director. These services enable reusable parts of the code to be used for the installation and customization of applications. Services can include scripts created with Windows PowerShell, the Windows Command line, and Linux Bash shell. External Services can be designed for Microsoft applications that require scripts for deployment, such as a load-balancer or a preinstalled database service. Similar to building a logical template, tags and a supported operating system version are required when creating a service. 33

34 Chapter 3: Provisioning Microsoft Applications Predefined property values can be added to a service that can then be overridden by a user with the vcac self-service portal. These properties are specific to the deployed application. The same service can house multiple scripts, such as an application installation, an application configuration, or an update script. These services are reusable and available for selection during the creation of a new application blueprint in vcloud Application Director, as shown in Figure 12. Figure 12. Adding a service created on vcloud Application Director When Microsoft applications are implemented, the scripts contained within the service will run after the virtual machine is deployed. A number of services can be added to a single logical template and a service installation order can be specified. The same order applies when deploying multiple virtual machines within the same application blueprint. Application blueprints An application blueprint can be created after the required elements on vcloud Application Director are established, as shown in Figure 13. These requirements include a cloud provider, a deployment environment, one or more logical templates, and the services which contain the scripts. Tags are added to indicate the type of service used and in which category to list the service. 34

35 Chapter 3: Provisioning Microsoft Applications Figure 13. Creating an application blueprint vcloud Application Director provides a drag and drop GUI where Logical Templates are positioned on a blank canvas. Depending on the application requirements, multiple logical templates can be added and clustered. Services and Application components are placed into logical templates, where associated scripts are executed during the deployment process. Figure 14 shows an example of a completed application blueprint where components have been taken from the left and right menus to create reusable Microsoft application blueprints that can be deployed into an EMC Hybrid Cloud. Compute resources and host name can be edited. The host name can also be assigned randomly on each execution of a blueprint by adding ${random}. After the application blueprint is created, it is ready to be published to the required business unit on vcac where Microsoft applications can be requested. Figure 14. Dragging and dropping GUI in vcloud Application Manager 35

36 Chapter 3: Provisioning Microsoft Applications Publishing application blueprints Application blueprints can be published to vcac. Figure 15 shows the Deploy option used to initiate these steps. Figure 15. Publishing application blueprints to vcac During the publishing process, an option to map details that can be used to ensure Logical Templates in vcloud Application Director and blueprints in vcac correlate. Application properties can be edited prior to publishing the blueprint, as shown in Figure 16. Administrators can use the overridable checkbox associated with each parameter in a service to enable requesters to change property values at deployment. Compute resources can also be modified during this process to ensure Microsoft applications are deployed on virtual machines that meet the performance requirements of a business group. The ability to edit parameters before publishing enables the same application blueprint to be published with different specifications. Figure 16. Using the overridable option for an application parameter The execution plan can be reviewed before an application blueprint is published. This provides the opportunity to review the sequence of an implementation prior to execution, which ensures that the correct application services are being deployed in the correct order. As shown in Figure 17, the next step is to review all application related properties and select Publish. The name and description of the item are published and visible later within the vcac catalog to the requester. 36

37 Chapter 3: Provisioning Microsoft Applications Figure 17. Reviewing and publishing the application blueprint to vcac catalog Application blueprints that are published to vcac are not immediately visible in the catalog. These are initially listed as Inactive catalog items, as shown in Figure 18. After activation, the item changes to Active and can then be added to an applicable service. Figure 18. Viewing application blueprints added to vcac Catalog Items 37

38 Chapter 3: Provisioning Microsoft Applications Service Catalog The Service Catalog in vcac shows the catalog items that an end user, an application owner, or a business group, can request. After the request is approved, the application virtual machine is deployed and the owner is notified. Figure 19 shows the different application deployments available based on EMC deployments. Figure 19. Viewing the vcac Service Catalog Figure 20 shows a subset of catalog items for SQL Server 2012 that includes multiple deployments with varying virtual machine specifications. 38

39 Chapter 3: Provisioning Microsoft Applications Figure 20. Viewing the vcac Service Catalog for SQL Server 2012 Services Services can be activated and deactivated in vcac. Activated Services will appear in the vcac catalog to users with appropriate entitlements, as shown in Figure 21. When application administrators select a Service, catalog items associated with the chosen service can be viewed. Figure 21. Viewing vcac Services The catalog items are published to vcac from different sources. For this solution, the items are from vcloud Application Director because they are all application deployments. These catalog items are linked to a service, as shown in Figure

40 Chapter 3: Provisioning Microsoft Applications Figure 22. Viewing vcac Catalog Items Actions The Actions section enables an administrator to decide what actions users can do for the specified catalog item. This helps to control the level of actions that users can perform. For example, the administrator might want to prevent a user from destroying a virtual machine so maintenance tasks can be performed, as specified by the business unit. Figure 23. Viewing vcac Actions Entitlements Entitlements in vcac control which users or groups have access to the catalog items, as shown in Figure 24. This ensures that only specified users can request specific deployments. For example, administrators can specify that only SQL Server application owners can view and select SQL Server catalog items in vcac. 40

41 Chapter 3: Provisioning Microsoft Applications Figure 24. Viewing vcac Entitlements Approval Policies Approval policies are created in the Admin tab in vcac, where new approval policies can be added and edited for items being requested from the catalog. Approval Policies are then added to a particular Entitled Catalog Item by selecting the modify policy option. When an entitled catalog item has an approval policy set up, the approver will receive an in their vcac inbox. The request can then either be approved or rejected with a justification message. The deployment can proceed after the request has been approved. Implementing approval processes provides essential control over Enterprise applications deployments and provides important governance over EMC Hybrid Cloud environments. A wide range of approval policy types can be engaged. Various approval levels can be used to ensure that single approvers or a group of users are approved or declined a request. Figure 25 shows a view of an approval request sent to an approver. Figure 25. Approving or rejecting a request 41

42 Chapter 3: Provisioning Microsoft Applications Storage tiering The Microsoft applications deployed in this solution take advantage of storage tiering within EMC Hybrid Cloud. Applications are provisioned on storage tiers to meet the workload requirements of SQL Server, SharePoint, and Exchange. As described in Publishing application blueprints, a vcac blueprint is selected when publishing an application blueprint. The vcac blueprint enables the administrator to choose the correct storage tier for user applications, as shown in Figure 26. Figure 26. Selecting a storage tier When applications are requested from the vcac Service Catalog, users can choose the appropriate catalog item and storage tier for which an application is to be deployed. Figure 27 highlights one of the storage tiers available for a SQL Server deployment. Figure 27. Selecting a storage tier for SQL Server in vcac In this solution, we implemented storage tiers by using VMAX and VNX storage arrays. Storage offerings can include a dedicated storage type or mixed storage. We created the following multiple tiers based on the requirements for each application: Tier 1 Extreme performance tier with all flash drives Tier 2 Balanced capacity and performance tier with FC/SAS drives Tier 3 Capacity tier with large SATA/NL-SAS drives 42

43 Chapter 3: Provisioning Microsoft Applications The ability to select the required storage tier and compute resources from the vcac catalog ensures that applications can perform workloads with guaranteed input/output operations per second (IOPS). For example, for the SQL Server deployment, the all-flash tier was used to optimize performance. For the Microsoft Exchange Server deployment, the capacity tier was used to provide the required mailbox capacity and performance. Through the use of EMC array-based technologies, such as EMC FAST Cache and FAST VP, applications of varying I/O profiles can be added to the storage tiers. This can include storage offerings made up of different disk technologies. The workloads can then be promoted or demoted by EMC FAST Suite to best serve the operating requirements of an application. For this solution, EMC ViPR is a central component of EMC Hybrid Cloud that centralizes and automates storage management on a single platform. Through the vcac self-service catalog, you can create volumes on ViPR and provision them to the required ESXi Servers. This allows the tiers required for Microsoft applications to be assigned with a fully automated process. These volumes are then used to make up reservations on vcac. Note: For more details on Storage Tiering for EMC Hybrid Cloud, refer to the EMC Hybrid Cloud Solution with VMware Foundation Infrastructure 2.5. Provisioning Microsoft Active Directory Services Some cloud tenants require their own environment with an Active Directory infrastructure. Usually, most of the tenants already have their own established Active Directory infrastructure and would not require a deployment of a Domain Controller. This option would be more appropriate for building a development lab, where Microsoft applications would be deployed for testing purposes. For successful deployments of Microsoft applications, such as Exchange and SQL Server, users need to provide information about their existing Active Directory infrastructure components. This information is necessary because these applications are heavily integrated with Active Directory. Users who were granted appropriate rights can also choose to deploy a Domain Controller and customize its settings to create an Active Directory domain before the application is provisioned. During deployment, the Domain Controller settings can be modified to specify an IP address, Domain Name, and administrator credentials. DNS can also be configured during Domain Controller deployment. Provisioning a Microsoft Active Directory Domain Controller involves the following tasks: Creating a Domain Controller application blueprint in Application Director Publishing the Application Director blueprint to vcac 43

44 Chapter 3: Provisioning Microsoft Applications To provision Microsoft Active Directory from vcac: 1. Select a Domain Controller from the catalog and click Request, as shown in Figure 28. Figure 28. Provisioning Microsoft Active Directory from vcac 2. After setting the required property values as prompted, click Submit. 3. After the Domain Controller is deployed, record the IP address and host name, because these values are required when provisioning each Microsoft application. Provisioning Microsoft Exchange Microsoft Exchange Server application blueprints that are published from vcloud Application Director facilitate the deployment of multiple editions of Exchange Server across any business group within an organization, whether the business group is a highly utilized production environment or a Test and Development unit. These versions can be provisioned easily and are ready for use within minutes of being requested. To provision Microsoft Exchange Server on EMC Hybrid Cloud, the cloud administrator must first create an application blueprint in vcloud Application Director, and then publish the blueprint into a vcac catalog. The following are prerequisites for deploying Exchange from EHC Hybrid Cloud self-service catalog: The Active Directory Infrastructure with DNS services must exist before Exchange can be installed. The account used to perform the Exchange installation must have the rights necessary to make changes to AD schema. Refer to Microsoft documentation for this information. The following options are currently available for provisioning Microsoft Exchange Server: Option 1 deploys a stand-alone Exchange Server with a preconfigured number of CPUs, memory, and storage resources in the template for a specified number of users. Mailbox server role and Client Access roles are combined in this deployment. 44

45 Chapter 3: Provisioning Microsoft Applications Option 2 deploys an Exchange Server in a high-availability configuration as part of an Exchange database availability group (DAG) with a preconfigured number of CPU, memory, and storage resources in the template for a specified number of users. This option deploys two servers in a DAG with two database copies. Mailbox server and Client Access roles are combined in this deployment. Option 3 deploys a new Exchange server with a preconfigured number of CPUs, memory, and storage resources to an existing DAG. Mailbox server and Client Access roles are combined in this deployment. Note: Option 2 is described in High Availability for Microsoft Applications on EMC Hybrid Cloud. Option 3 is described in Elasticity for Microsoft Exchange The versions of Microsoft Exchange Server deployments supported in this solution are as follows: Exchange Server 2010 Standard and Enterprise Editions on Windows Server 2012 and Windows 2008 R2 Exchange Server 2013 Standard and Enterprise Editions on Windows Server 2012 and Windows 2008 R2 Note: If installing a Mailbox server role as a member of a DAG, Windows Server 2012 Standard or Datacenter Edition, or Windows Server 2008 R2 SP1 Enterprise Edition are required. Windows Server 2008 R2 SP 1 Standard Edition does not support the features needed for DAGs. Exchange Server application blueprints To deploy a stand-alone Exchange Server, you must first configure the blueprint in vcloud Application Director. The application blueprint consists of services and custom scripts to automatically deploy and provision Exchange Server. In this solution, for a small configuration of 1,000 users, the deployment option combines the Exchange Mailbox Server and Client Access roles on one server. For larger configurations, you can deploy separate servers to host each role. After the application blueprint is configured, you can create the deployment profile and publish the configuration in vcac. vcloud Application Director ensures that Exchange Server application blueprints can be easily created and customized. A number of components are required to create an application blueprint, including a blueprint on vcac, a logical template on vcloud Application Director, and related Services that contain the scripts necessary to install and customize Exchange Server. The installation and customization scripts were created with Microsoft Windows PowerShell for this solution. Figure 29 and Table 3 show the Exchange Server service properties created within the application blueprint, which include the organization name, administrator credentials, and source location for the installation files. Additional properties can be introduced based on the deployment requirements of the application. You can edit these properties to customize the installation of the Exchange Server prior to requesting the application. During installation, you can change these parameters, provided they are made overridable within the blueprint. You can customize and reuse these installation scripts for multiple blueprints. 45

46 Chapter 3: Provisioning Microsoft Applications Figure 29. Properties and actions for Exchange 2013 (stand-alone) blueprint The table below lists some of the Exchange application properties that can be configured within an application blueprint. Other properties can be added as required. Table 3. Exchange 2013 (stand-alone) blueprint property values Property Blueprint value example Description Domain exlab.local Your Windows Domain name User Administrator Domain user account with admin rights to perform Exchange installation Password Password User account password Install_repository c:\software\exchange Location of the Exchange installation files Organization_name Exchange Your Exchange organization name Additional services Based on the requirements of the Exchange Server deployment, you can create and add additional services to the application blueprint. For example, a Join Domain script service for which the specified user chooses which domain the Exchange Server virtual machine joins. You can also add services to Exchange Server application blueprints that enable the application monitoring after the installation is complete. Monitoring Microsoft Applications on page 27 provides more details. 46

47 Chapter 3: Provisioning Microsoft Applications Publishing a stand-alone Exchange Server The following describes how to publish a stand-alone Exchange 2013 Server with both a Mailbox Server role and a Client Access Server role into a vcac catalog. To provision a stand-alone Exchange Mailbox 2013 Server: 4. In the Application Director, select Applications, and then select an Exchange 2013 (Stand-alone) application blueprint, as shown in Figure 30. Figure 30. Selecting a stand-alone Exchange server blueprint 5. Hover the cursor over the blueprint and click View Blueprint to view and edit the properties, as shown in Figure 31. Figure 31. Editing a stand-alone Exchange application blueprint properties 6. Select the template to view and edit the properties, such as the number of CPUs and memory, as necessary, and then click Deploy in the upper right corner, as shown in Figure

48 Chapter 3: Provisioning Microsoft Applications Figure 32. Editing options for a stand-alone Exchange blueprint After the Exchange Server application blueprint has been created, it can be published to vcac. Publishing application blueprints provides instructions for this process. Requesting Exchange Server from vcac catalog After services and entitlements are configured by the cloud administrator, a user (for example, an Exchange Administrator) can view and select only specific Exchange Server catalog items. Figure 33 shows an example of the Service Catalog that the Exchange administrator can see based on user-assigned permissions. Figure 33. Viewing vcac Service Catalog items for Exchange 48

49 Chapter 3: Provisioning Microsoft Applications After a request has been initiated and a request description and reason are entered, the parameters specific to the Exchange Server and Domain can be edited, as shown in Figure 34. These are the parameters that were made overridable in the application blueprint on vcloud Application Director prior to publishing to vcac. Figure 34. Viewing vcac application parameters for Exchange Server After a request is submitted, the deployment begins. The status of requests submitted by the user can be viewed in the Requests tab. After the request is complete, the state of the request changes to successful. The details of the implementation, including information relating to the virtual machine deployed, can be viewed under the Items tab. The request remains in a Pending Approval State until approved if an approval process has been implemented. Validating an Exchange Server deployment When an Exchange Server request has completed, the status of the request changes from In Progress to Successful on the Requests page, as shown in Figure 35. Users can see the status of their own submitted requests on this page. Figure 35. Confirming a successful Exchange Server deployment 49

50 Chapter 3: Provisioning Microsoft Applications The details of the virtual machine can be accessed by selecting Application Deployments in the Items tab, as shown in Figure 36. Figure 36. Viewing a provisioned application for Exchange Server To verify that the Exchange Server was deployed correctly, the Exchange Server administrator can connect to the virtual machine or log on to the Exchange admin center, as shown in Figure 37. Figure 37. Exchange admin center: newly deployed Exchange Server verification 50

51 Chapter 3: Provisioning Microsoft Applications Provisioning Microsoft SQL Server Microsoft SQL Server application blueprints published from vcloud Application Director facilitate the deployment of multiple editions of SQL Server across any business group within an organization, whether the business group is a highly utilized production environment or a Test and Development unit. These versions can be provisioned easily and are ready for use within minutes of being requested. Approval processes can also be implemented by using vcac to guarantee that the application is being deployed based on the best practices within an enterprise. The following versions of Microsoft SQL Server deployments are supported in this solution: SQL Server 2008 R2 Enterprise, Standard, and Express Editions on Windows 2008 R2 SQL Server 2012 Enterprise, Standard, and Express Editions on Windows 2012 Anti-affinity rules for SQL Server virtual machines SQL Server application blueprints In this solution, anti-affinity rules were enabled manually using the vsphere Web Client on all SQL Server virtual machines deployed. This ensures that AlwaysOn members are never located on the same ESXi Host. vcloud Application Director ensures that SQL Server application blueprints can be easily created and customized. A number of components are required to create an application blueprint on vcloud Application Director for SQL Server. These components include a blueprint on vcac, a logical template on vcloud Application Director, and related services, which contain the scripts necessary to install and customize SQL Server. The installation and customization scripts can be created with Windows PowerShell. The properties in services used for SQL Server on vcloud Application Director can be edited before requesting the application, as shown in Figure 38. These properties include SQL Server related parameters, such as the instance name, the systems administrator password, query timeout values, and the installation path. Additional properties can be introduced based on the requirements of the application. These properties are used to create and build a SQL Server configuration file, which is used to customize the installation. The Setup location for the SQL Server installation files is an example of a property used. These files are automatically downloaded from a central repository that can be an automated step performed during deployment. The other option is to house the installation files on the virtual machine template (local drive) where the files are deleted after installation. 51

52 Chapter 3: Provisioning Microsoft Applications Figure 38. Viewing properties and actions for a SQL Server application blueprint deployment The table below lists some of the SQL Server application properties that can be configured within an application blueprint. Other properties can be added as required. Table 4. SQL Server blueprint property values Property Blueprint value example Description Domain msapps.com Your Windows domain name User Administrator Domain user account with admin rights to perform Exchange installation Password Password User account password Install_repository \\IP of Repository Server\Software\SQL2 012\Enterprise Location of the SQL Server installation files 52

53 Chapter 3: Provisioning Microsoft Applications Property Blueprint value example Description SYSADMIN_ACCOUNT SQL The Windows groups or individual accounts to add to the sysadmin fixed server role SA_PWD Password The password for the SQL Server sa account Instance name Production The name of the instance of SQL Server User connections 4 The maximum number of simultaneous user connections that are allowed on an instance of SQL After the SQL Server application blueprint has been created, it can be published to vcac. Publishing application blueprints provides instructions. Additional services Requesting a SQL Server Based on the requirements of the SQL Server deployment, additional services can be created and then added to the application blueprint. An example of this service is a Join Domain script where the requester can choose which domain the virtual machine will join. Services can also be added to SQL Server Application blueprints that enable the application monitoring after the installation. Monitoring Microsoft Applications provides more details. Figure 39 shows an example of the Service Catalog that a SQL Server user can use to view and select specific SQL Server catalog items, based on assigned permissions. 53

54 Chapter 3: Provisioning Microsoft Applications Figure 39. Viewing vcac Service Catalog for SQL Server After a request has been initiated, users are prompted for a description and a reason. They can also specify the SQL Server instance and other related properties, which were made overridable in the application blueprint in vcloud Application Director prior to publishing to vcac, as shown in Figure 40. Figure 40. Viewing vcac application properties for SQL Server The deployment can begin after a request is submitted. The status of requests submitted by a user can be viewed in the Requests tab. After the request is complete, the state of the request changes to successful and the details of the implementation, including information relating to the virtual machine deployed, can be viewed in the Items tab. 54

55 Chapter 3: Provisioning Microsoft Applications A SQL Server user can then connect to the virtual machine and view the SQL Server instance that was created with Microsoft SQL Server Management Studio, which was installed during the deployment process for this solution. Approving a request If an approval process has been implemented, the request will remain in a Pending Approval status until approved, as shown in Figure 41. Refer to Approval Policies for more details. Figure 41. Viewing Pending Approval of vcac requests for SQL Server Validating a SQL Server deployment To validate a SQL Server deployment in vcac: 1. When a SQL Server request has completed, the status of the request will change to Successful on the Request page. Users can see the status of their own submitted requests on this page, as shown in Figure 42. Figure 42. Confirming a successful SQL Server deployment 2. The details of the virtual machine can be accessed by selecting Application Deployments in the Items tab, as shown in Figure

56 Chapter 3: Provisioning Microsoft Applications Figure 43. Viewing a provisioned application 3. To verify that the SQL Server instance was deployed correctly, connect to the virtual machine and open Microsoft Management Studio, as shown in Figure 44. Figure 44. Example of a completed SQL Server deployment Provisioning Microsoft SharePoint Microsoft SharePoint application blueprints published from vcloud Application Director facilitate the deployment of multiple SharePoint editions across any business group within an organization whether the business group is a highly utilized production environment or a Test and Development unit. These versions can be provisioned easily and are ready for use within minutes of being requested. Approval processes can also be implemented by using vcac to guarantee that the application is being deployed based on the best practices within an enterprise. The following versions of Microsoft SharePoint deployments are supported for this solution: SharePoint 2010 on Windows 2008 R2 SharePoint 2013 on Windows

57 Chapter 3: Provisioning Microsoft Applications Provisioning SharePoint 2010 Figure 45 shows the SharePoint application deployment choices created by the administrator. This is visible in vcloud Application Director and multiple versions can be published to vcac catalog based on each Application. SharePoint 2010 is preinstalled on the Template virtual machine, so the only configuration needed is after it is cloned with the blueprint. Figure 45. Application Director SharePoint blueprints available for deployment SharePoint application blueprints Figure 46 shows the services available for SharePoint virtual machine deployments for the selected application blueprint. The blueprint contains the scripts for deploying and configuring new SharePoint virtual machines. 57

58 Chapter 3: Provisioning Microsoft Applications Figure 46. vcloud Application Director services for SharePoint deployments Figure 47 shows a SharePoint 2010 application blueprint in vcloud Application Director. Administrators can have multiple versions of a blueprint for different templates and services. Figure 47. vcloud Application Director application blueprint for SharePoint Figure 48 shows an example of different application server types, templates, and services that can make up the selected blueprint. A deployment can be created with the drag and drop GUI with vcloud Application Director. 58

59 Chapter 3: Provisioning Microsoft Applications Figure 48. SharePoint service types, templates, and services for the vcac blueprint A set of properties can be set up for each service. For SharePoint, the installation types and location of the installer are included in the properties, as shown in Figure

60 Chapter 3: Provisioning Microsoft Applications Figure 49. Application Director service properties for a SharePoint blueprint Table 3 provides a sample of the SharePoint application properties that can be configured within an application blueprint. Many other properties can be configured and added to blueprints, as required. Table 3. SharePoint blueprint property values Property Blueprint value example Description Location C:\Software Location of the SharePoint installation files Machine IP Self:IP Deployed virtual machine IP Role Application SharePoint Server role Password Password SharePoint Administrator password Port 7001 SharePoint application connection port 60

61 Chapter 3: Provisioning Microsoft Applications After the SharePoint 2010 Server application blueprint has been created, it can be published to vcac. Publishing application blueprints provides instructions. Requesting a SharePoint deployment After the deployment is published and made visible in the Service Catalog, users can see and request the deployment, as shown in Figure 50. Figure 50. Viewing SharePoint service catalog selections in the vcac When prompted, the user can add a description and a reason for the deployment request. Figure 51. Adding information for a SharePoint deployment request The user can then change the service options for the application, as shown in Figure

62 Chapter 3: Provisioning Microsoft Applications Figure 52. Changing service options for a SharePoint deployment Validating a SharePoint deployment After the request is approved, the virtual machine is listed on the Machines page in vcac. The user has several actions available for the virtual machine, as shown in Figure 53. Figure 53. Viewing deployed SharePoint virtual machine in vcac After the user is notified of the approval, the user can log into the SharePoint virtual machine and access Central Administration to see the SharePoint configuration. For example, Figure 54 shows a small single-server SharePoint deployment. 62

63 Chapter 3: Provisioning Microsoft Applications Figure 54. SharePoint farm deployment information The template used for the farm enables the user to then decide which type of site they want to create, as shown in Figure

64 Chapter 3: Provisioning Microsoft Applications Figure 55. Selecting a SharePoint template Provisioning SharePoint 2013 Provisioning SharePoint 2013 requires the same deployment steps as SharePoint SharePoint 2013 is also pre-installed on a template virtual machine, so the required configuration is implemented after the virtual machine is deployed. The vcac blueprint in Figure 56 is different from the SharePoint 2010 blueprint. Figure 56. Deploying a SharePoint 2013 blueprint in Application Director In vcac, a separate service for SharePoint 2013 is provided with specific items that can be requested, as shown in Figure

65 Chapter 3: Provisioning Microsoft Applications Figure 57. Viewing vcac Catalog items for SharePoint 2013 Validating a SharePoint deployment After deployment is complete, the user can log in and connect to Central Administration in SharePoint to check the deployment. Figure 58 shows a deployment with a default Human Resources template that can be used to specify which users and groups have access to the new SharePoint 2013 Human Resources site. Figure 58. Viewing a successful SharePoint 2013 deployment Figure 59 shows how users can now configure the SharePoint farm, as specified in the deployment. 65

66 Chapter 3: Provisioning Microsoft Applications Figure 59. Configuring a new SharePoint farm for HR 66

67 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Chapter 4 High Availability for Microsoft Applications on EMC Hybrid Cloud This chapter presents the following topics: Overview High availability Microsoft Exchange DAG Microsoft SQL Server with AAG Microsoft SharePoint availability

68 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Overview High availability Microsoft Exchange DAG When enterprise applications are deployed in a Hybrid Cloud, application administrators want to maintain application performance and high availability by following application design and best practices. Microsoft applications on EMC Hybrid Cloud with VMware are protected at multiple levels with this solution. The first level of protection is virtual machine protection with VMware vsphere High Availability, which provides crash-consistent, virtual machinelevel protection for applications. The next level of protection is consistent application protection, such as Exchange DAG and SQL Server AlwaysOn Availability Groups. At the lower level, EMC storage automatically protects data and VMware NSX provides network redundancy. This chapter describes how to set up this solution for virtual machine and application protection with high availability. VMware vsphere delivers the high availability (HA) required by most applications running in virtual machines, independent of the operating system and applications. HA provides uniform, cost-effective failover protection against hardware and operating system outages within a virtualized IT environment. HA can monitor VMware vsphere hosts and virtual machines to detect hardware and guest operating system failures. It can also restart virtual machines on other vsphere hosts in the cluster without manual intervention when a server outage is detected. HA can also reduce application downtime by automatically restarting virtual machines when an operating system failure is detected. Microsoft Exchange 2013 environments are built for HA. In large deployments, client access servers can be deployed in arrays that are load balanced. Exchange Mailbox Servers are usually deployed in a Database Availability Group (DAG) for HA. A DAG is a group of Exchange Mailbox Servers that provides automatic database-level recovery from a database, server, or network failure. A DAG provides a non-shared storage failover cluster solution and uses asynchronous log shipping technology to distribute and maintain passive copies of each database in the DAG. DAGs can be extended to multiple sites to provide resilience and prevent datacenter failures. A DAG with HA ultimately provides the availability required for most deployments. However, if hardware failures occur, utilization of the remaining client access servers can increase as new connections are established, and DAG protection is reduced as passive databases are activated. In physical deployments, administrators must address problems quickly to restore availability levels and mitigate any further outages. With a vsphere infrastructure, a hardware failure results in virtual machines powered back on by vsphere HA, restoring availability levels quickly and keeping 68

69 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud utilization balanced. This chapter provides recommendations for using vsphere HA with Exchange vsphere HA with Exchange DAGs In a physical environment, DAGs are often deployed with three or more database copies to protect from hardware and disk failures. In these environments, when a physical server or storage component fails, the DAG is still protected with the multiple database copies. This protection requires the overhead of managing those multiple database copies. Virtualized Exchange environments are typically designed with two database copies to utilize vsphere HA and RAID to protect from hardware and storage failures. vsphere HA restarts a DAG member if the host has a hardware failure, and RAID protects databases from storage failure. When enabling a vsphere cluster for HA to protect DAG members, consider the following best practices: Members of the same DAG should not reside on the same vsphere host for an extended period of time when databases are symmetrically distributed between members. Allowing two members to run on the same host for a short period of time (for instance, after a vsphere HA event) does enable database replication to resume. However, DAG members should be separated as soon as the ESXi host has been restored. To adequately protect from an extended server outage, vsphere clusters should be designed in an N+1 configuration, where N is the number of DAG members. If a hardware failure occurs, causing vsphere HA to power-on a failed DAG member, the DAG maintains the same level of protection at all times. Use anti-affinity rules to keep DAG members separated. vsphere HA might violate this rule during a power-on operation (one caused by a host failure), but DRS fixes the violation during the next interval. Refer to Anti-Affinity rules for Exchange virtual machines for more details. Note: Anti-affinity rules were configured manually, using the vsphere Web Client after Exchange virtual machines were deployed. vsphere DRS with Exchange DAG Anti-Affinity rules for Exchange virtual machines Distributed Resource Scheduling (DRS) provides active load balancing of virtual machine workloads within a vsphere cluster. In addition to active monitoring and load balancing functions, DRS helps make a virtualized Exchange 2013 environment more agile. The following sections provide recommendations for using DRS with Exchange DRS provides rules for keeping virtual machines apart or together on the same ESXi host or group of hosts. In an Exchange environment, the common use case for antiaffinity rules is to keep Exchange virtual machines with the same roles installed apart from each other. Client Access servers in a CAS array can run on the same ESXi host, but DRS rules should be used to prevent all CAS virtual machines from running on a single ESXi host. Microsoft recommends symmetrically distributing mailbox databases among DAG members. Unlike traditional active/passive configurations, this design allows all DAG members to support active users as well as reserve a portion of compute power for 69

70 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud failover capacity. In the case of failure of a single DAG member, all remaining members might take part in supporting the failed databases. Because of this, it is recommended that no two members of the same DAG run on the same ESXi host for an extended period of time. Because of a DRS rule, anti-affinity rules enforce virtual machine separation during power-on operations and vsphere vmotion migrations. This includes times when a host is entering maintenance mode. If a virtual machine is enabled for vsphere HA and a host failure occurs, vsphere HA might power-on a virtual machine and, in effect, violate a DRS anti-affinity rule. This occurs because vsphere HA does not inspect DRS rules during a recovery task. However, during the next DRS evaluation (set for every five minutes), the virtual machine is migrated to fix the violation. Figure 60 shows the Enable rule setting for the Anti-Affinity DRS rule for Exchange DAG servers. Figure 60. Anti-Affinity DRS rule for Exchange DAG servers Provisioning an Exchange DAG For this solution, Microsoft Exchange high availability was achieved by deploying multiple servers in a DAG. Each mailbox server can have a copy of the database deployed on any server that is a member of the DAG. With this solution, users can initially deploy a two-member DAG and later deploy additional servers to join the DAG. The following is an example of how to deploy an Exchange 2013 Server in a DAG. These steps are similar to deploying an Exchange 2013 (stand-alone) blueprint: 1. In Application Director, select the Exchange 2013 DAG blueprint, as shown in Figure

71 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Figure 61. Selecting an Exchange server blueprint from available Applications 2. Hover your cursor over the blueprint and click View Blueprint to view the properties, as shown in Figure 62. Figure 62. Viewing the application blueprint for an Exchange 2013 DAG 3. Select the template to view and edit the properties, such as the number of CPUs and amount of memory, and then click Deploy in the upper right corner, as shown in Figure 63. Table 5 lists the required blueprint property values for an Exchange DAG. These properties can then be edited to customize the installation of the Exchange DAG prior to requesting the application. During installation, users can change these properties, provided the properties are made overridable within the blueprint. 71

72 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Table 5. Exchange DAG blueprint property values Property Blueprint value example Description Domain exlab.local Your Windows Domain name DAGIP DAG IP address DAGNAME DAG1 DAG Name WitnessServer FSW-SRV File Share Witness server WitnessDirectory C:\FSW File Share Witness server directory User Administrator User account with admin rights to perform Exchange installation Password Password User account password DBNAME DB1 Database name After the Exchange 2013 DAG application blueprint has been created, it can be published to vcac. Refer to Publishing application blueprints for instructions. Figure 63. Submitting a blueprint for deployment 72

73 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Figure 64. Selecting and deploying the Exchange DAG template in the vcac catalog 4. When prompted, set the required values, click Next, and then click Submit to finalize your request. Microsoft SQL Server with AAG The AlwaysOn Availability Groups feature is a high-availability and disaster-recovery solution that provides an enterprise-level alternative to database mirroring. Introduced in SQL Server 2012, AlwaysOn Availability Groups maximizes the availability of a set of user databases for an enterprise. An availability group supports a failover environment for a discrete set of user databases, known as availability databases which fail over together. An availability group supports a set of read-write primary databases and one to eight sets of corresponding secondary databases. Optionally, secondary databases can be made available for read-only access and/or some backup operations. Provisioning SQL Server 2012 AAG SQL Server Always-On Availability Group (AAG) deployment is an option in the Service Catalog that can be requested by the user, as shown in Figure 65. Figure 65. Viewing the SQL Server AAG catalog items in vcac 73

74 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Application Director Blueprint for SQL Server AAG Figure 66 shows the Catalog item that is published from vcloud Application Director. Figure 66. Viewing the AAG application blueprint Figure 67 shows more detail about the vcloud Application Director blueprint. Figure 67. Viewing the AAG application blueprint description Figure 68 shows the blueprint deployment of two SQL Server virtual machines with interrelated dependencies. The arrows show the first SQL Server virtual machine to join the domain and the second dependent SQL Server virtual machine to join. The installation of SQL Server 2012 and the creation of a failover cluster for AAG occur independently on each virtual machine. The first SQL Server virtual machine creates a database. The SQL Agent script runs on the first SQL Server virtual machine and the dependent AAG script runs on the second SQL Server virtual machine. This completes the process required to create a full AAG deployment on two SQL Server virtual machines. 74

75 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Figure 68. Viewing AAG service dependencies Figure 69 shows the server installation portion of the deployment plan (workflow) in Application Director. This is a different view of the workflow that shows each active task as it runs and completes. Figure 69. Reviewing task execution workflow for AAG Verifying SQL Server 2012 AAG deployment After the workflow is run, the AAG is listed in SQL Server Management Studio, as shown in Figure 70. The SQL Server application is now protected from node failure and read-only copies can be used for backup purposes on the secondary copy. Each SQL Server virtual machine can also be configured to be on different datastores to improve redundancy. 75

76 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Figure 70. Viewing the deployed Availability Replicas in SQL Server Microsoft SharePoint availability Microsoft SharePoint as a federated application has some built-in redundancy. For example, each farm can have multiple web front-ends (WFEs), so the failure of some WFEs does not lead to a farm outage or downtime for users. SharePoint Search can also be deployed redundantly (at least two copies of the Index and two copies of the Query role), so that the failure of one or more virtual machines in the farm does not cause down time. The SQL Server back-end can be split among multiple smaller SQL Server virtual machines, so that at least some of the sites (ContentDBs) can remain available when a SQL Server is down. SQL Server AlwaysOn availability groups can also be used to protect the backend SQL Server. All of these virtual machines are protected at another level by vsphere HA. Figure 71 shows that vsphere HA Protection is turned on for the ESX hosts that host the resources and virtual machines for EMC Hybrid Cloud. With this solution, SharePoint farm virtual machines are protected from ESX host failure and the protection is crashconsistent. 76

77 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud Figure 71. SharePoint virtual machine protection by vsphere HA 77

78 Chapter 4: High Availability for Microsoft Applications on EMC Hybrid Cloud 78

79 Chapter 5: Monitoring Microsoft Applications Chapter 5 Monitoring Microsoft Applications This chapter presents the following topics: Overview VMware vcenter Hyperic VMware vcenter Operations Manager Monitoring Microsoft Exchange Monitoring Microsoft SQL Server Monitoring Microsoft SharePoint

80 Chapter 5: Monitoring Microsoft Applications Overview VMware vcenter Hyperic Microsoft applications residing on an EMC Hybrid Cloud can now be monitored based the requirements of specific business groups. VMware vcenter Hyperic and VMware vcenter Operations Manager are integrated to ensure that VMware vcenter Operations Manager provides a single UI for monitoring a wide range of metrics relating to the availability and utilization of Microsoft applications in real-time. Key performance indicators (KPIs) can be applied to specific metrics to further ensure that application thresholds are being monitored in accordance with the best practices and service level agreements within an organization. Issues relating to utilization can be identified early and corrected or prevented. To guarantee that Microsoft applications deployed in an EMC Hybrid Cloud have monitoring capabilities, each deployed application virtual machine requires a Hyperic agent to communicate with a monitoring server, also known as the Hyperic Server. This agent is installed seamlessly during the automated provisioning of the requested applications with the vcac catalog. vcenter Hyperic is a core component in this solution that provides application monitoring. Using the Management Pack for vcenter Hyperic, downloadable from the VMware Solution Exchange, Hyperic can be integrated with vcenter Operations Manager, thus providing a single UI for monitoring Microsoft applications. A wide range of application metrics are enabled by default within Hyperic for Microsoft applications. Additional metrics can be enabled and viewed in vc Ops. Custom plugins are available for Microsoft applications, which are downloadable from the VMware Solutions Exchange Marketplace. Figure 72. vcenter Hyperic Plugin Manager 80

81 Chapter 5: Monitoring Microsoft Applications Supported versions vcenter Hyperic Agent The latest versions of the Microsoft applications that are supported in this solution with vcenter Hyperic are as follows: Microsoft SQL Server 2012 Microsoft Exchange 2013 Microsoft SharePoint 2010 Further plugins are released on a regular basis and made available on the Solution Exchange Marketplace to support additional versions. The Hyperic agent is a requirement to allow communications between Microsoft application virtual machines and the vcenter Hyperic Server. vcloud Application Director automates the installation of the agent. Automation was achieved by creating a Hyperic service for Windows on vcloud Application Director and adding this to the various application blueprints published to vcac. In this solution all application deployments installed the Hyperic agent by default. Figure 73. Adding the Hyperic Service on vcloud Application Director Auto-Discovery After a deployment has completed successfully, applications and server resources can be monitored and are automatically discovered by Hyperic. Application resources must be added to the Hyperic Inventory to allow application-specific counters to be monitored by vc Ops. To do this, select Add to Inventory on the Hyperic dashboard, as shown in Figure

82 Chapter 5: Monitoring Microsoft Applications Figure 74. Auto-Discovery window on vcenter Hyperic Resources added to the Hyperic inventory, appear under the Resources tab where they can be added to a group if required. Grouping resources allows Microsoft assets on an EMC Hybrid Cloud to be added as a collection of inventory resources within Hyperic. VMware vcenter Operations Manager Although vcenter Hyperic is required to monitor Microsoft applications running on an EMC Hybrid Cloud, it is vcenter Operations Manager that provides the portal needed to monitor and provide insight into the availability, utilization and the overall health of SQL Server, SharePoint and Exchange deployments. Custom dashboards can be created for each of the Microsoft applications and alerting can be enabled based on thresholds required for each application, where notifications can be sent to the necessary application teams once an application alert triggers. Custom UI dashboards can be configured ensuring that the correct metrics associated with applications are being monitored, as shown in Figure 75. The metrics enabled on vc Ops can be selected to best suit the monitoring requirement of the organization or specific business groups. 82

83 Chapter 5: Monitoring Microsoft Applications Figure 75. vc Ops custom UI VC OPS integration with Hyperic To enable metrics to populate from Hyperic to vc Ops, the Management Pack for Hyperic must be installed and set up: 1. From vcenter Operations Manager Administration, click Browse and choose the PAK file and then select update, as shown in Figure 76. Figure 76. Installing and configuring the Hyperic Management Pack 83

84 Chapter 5: Monitoring Microsoft Applications 2. In vc Ops, click ADMIN to launch the support page. 3. In Adapters Info, confirm that Management Pack for Hyperic is listed, as shown in Figure 77. Figure 77. Confirming the Management Pack for Hyperic is listed 4. In Hyperic, select Administration and then select HQ Server Settings. 5. Set the required vcenter Server details and click OK. 6. In vc Ops, select Environment > Configuration > Adapter Instances. 7. In Adapter Kind, select MP for Hyperic, as shown in Figure

85 Chapter 5: Monitoring Microsoft Applications Figure 78. Managing Adapter Instance 8. In Add Adapter Instance, select Add New Adapter Instance, set the required values for the Hyperic and VC OPS servers, and click Test to verify the details, as shown in Figure After test is complete, click OK. Figure 79. Adding and setting up the Hyperic Adapter Instance 85

86 Chapter 5: Monitoring Microsoft Applications Monitoring Microsoft Exchange To support the monitoring of Microsoft Exchange 2013 on VMware vcenter Hyperic a plugin is required which is added by using the Plugin Manager. In this solution when Exchange 2013 is requested from the service catalog the Hyperic agent is installed as part of the deployment. In order for Exchange 2013 to be discovered and monitored the Hyperic Agent on Windows must be run as a domain user with an Exchange Organization Management Role. A wide range of metrics relating to Exchange 2013 can be enabled in Hyperic to monitor specific Exchange deployments across business groups in an EMC Hybrid Cloud, as shown in Figure 80. After Exchange 2013 related metrics are enabled on Hyperic, these counters are visible in vc Ops. Individual components in Exchange 2013 environments, such as databases, database instances, and counters relating to Exchange mailboxes, can be monitored for availability, utilization, and performance. Figure 80. Sample metrics in Hyperic Exchange 2013 Metrics In vcenter Operations Manager, metrics enabled on Hyperic can be configured as KPIs and thresholds can be configured to ensure that Exchange Administrators are notified if thresholds are exceeded. The ability to monitor Exchange specific counters, such as failed or pending deliveries, ensures that administrators can resolve potential problems quickly. KPIs and thresholds are configured by setting up an Exchange 2013 Attribute package for the Hyperic adapter in vc Ops. Figure 81 shows the All Attributes package for 86

87 Chapter 5: Monitoring Microsoft Applications Exchange 2013 in vc Ops. Existing attribute packages can be edited or new packages can be created. Figure 81. Sample Exchange attribute package Some of the following key Exchange 2013 metrics can be monitored in vcenter Operations Manager: IO Database Reads/Sec metric monitors the rate of database reads per second. IO Database Writes/Sec counter monitors the rate of database writes per second. Client RPC Failed metric is used to monitor the number of failed client Remote Procedure Calls. Failed Deliveries Per Second indicates the number of failed delivery messages per second. Pending Deliveries counter is used to identify the current number of pending message deliveries. Note: For a full range of Exchange metrics supported by vcenter Hyperic refer to the VMware vcenter Hyperic Resource Configuration and Metrics Guide on the VMware website. Microsoft Exchange dashboards is a mission critical application and it is vital that any delays in delivery or degraded performance are identified early and the cause of the slowdown determined quickly. The ability to create customizable at-a-glance dashboards of Exchange 2013 environments by using vc Ops enables application teams to view the overall health and performance of Exchange Servers, Services, and mail traffic running on EMC 87

88 Chapter 5: Monitoring Microsoft Applications Hybrid Cloud. This allows potential problems to be identified before end users experience any declines in the service. Figure 82 shows a custom dashboard created on vc Ops for Exchange 2013 deployments. The dashboard shows the overall health of Exchange environments as well as Exchange 2013 alerts and key metrics, such as messages sent per minute and IO database reads and writes. Dashboards such as these can be created to suit the specific monitoring requirements of an organization. Figure 82. Exchange dashboard Monitoring Microsoft SQL Server In order to monitor SQL Server from vc Ops, a custom plugin is required on Hyperic. This plugin is available from the VMware Solutions Exchange Marketplace and installed by using the plugin manager on Hyperic. After the plugin has been installed Hyperic is capable of monitoring and reporting SQL Server metrics. When the metrics required have been enabled on Hyperic they can be viewed from vc Ops and added to custom dashboards. The versions of SQL Server monitored in this solution were Microsoft SQL Server 2012 and SQL Server 2008 R2. SQL Server Metrics vcenter Hyperic supports a range of SQL Server metrics to ensure instances and databases are utilized and performing within the expected thresholds of a business group on EMC Hybrid Cloud. A number of metrics are enabled by default on Hyperic. Additional metrics can be turned on depending on the SQL Server monitoring needs within an organization. In order for these metrics to be viewed on vc Ops, they must first be enabled for collection within Hyperic. From vc Ops the SQL Server metrics enabled can be viewed and modified within attribute packages. Here KPI s and alert thresholds can be set, as shown in Figure

89 Chapter 5: Monitoring Microsoft Applications Figure 83. Managing attribute packages This solution enables valuable SQL Server metrics relating to availability and utilization to be monitored 24x7, enabling application administrators to prevent potential performance or capacity related problems before they arise. SQL Server metrics can be presented in an at-a-glance dashboard where individual metrics and trending can be viewed. Dashboards such as these can be used to plan for future workloads on SQL Server databases. Figure 84 shows the Resources Details view of a SQL Server deployment monitored by vc Ops. 89

90 Chapter 5: Monitoring Microsoft Applications Figure 84. Viewing SQL Server Resource Details Some of the key SQL Server metrics that can be monitored in vc Ops are: SQL Server Availability ensures that SQL Server is available 24x7. User Connections monitors the number of connections to a SQL Server instance. Transactions monitor the number of active transactions to a SQL Server database. SQL Server Cache memory monitors the amount of memory that is used by SQL Server. Database free Percent measures the percentage of disk space that is available for a SQL Server database. Log Growth measures the growth of transaction logs. Note: For a full range of SQL Server metrics supported by vcenter Hyperic, refer to VMware vcenter Hyperic Resource Configuration and Metrics Guide on the VMware website. SQL Server dashboards SQL Server dashboards can be created and customized in vcenter Operations Manager to provide a quick way to monitor Microsoft SQL Server and database metrics. A range of widgets can be added to SQL Server dashboards, each with specific metrics. These dashboards can be used to easily identify and quickly correct any possible problems. Figure 85 shows the editing page used to customize dashboards with a selection of widgets to create a unique view for SQL Server databases and database instances. 90

91 Chapter 5: Monitoring Microsoft Applications Figure 85. Customizing a SQL Server dashboard The custom dashboard shown in Figure 86 is used to monitor alerts relating to KPI s created for SQL specific metrics. For example, if SQL Server cache memory is underutilized for a specific period, an alert is triggered and appears on the dashboard. An notification is also sent to the administrators responsible for the SQL Server resource which logged the alert. Custom relationships were also added to ensure the underling virtual environments that Microsoft SQL Server instances are deployed on are also being monitored. Metric Graphs were used to monitor counters, such as lock-wait times and page lookups. The overall health of all SQL Server resources can be viewed in the Resources widget, as shown in Figure 88. Figure 86. SQL Server customized dashboard sample 91

92 Chapter 5: Monitoring Microsoft Applications Monitoring Microsoft SharePoint Microsoft SharePoint monitoring capabilities are performed from vc Ops. A custom plug-in for Hyperic is also required for SharePoint, which is downloadable from the VMware Solutions Exchange Marketplace. Although this solution supports the provisioning of SharePoint 2010 and SharePoint 2013, the monitoring capabilities in this solution relate to SharePoint 2010 only. A plug-in will be available in the future that will enable the monitoring competencies of Microsoft SharePoint SharePoint server metrics A wide range of SharePoint metrics and counters relating to core SharePoint components can be monitored from vc Ops, including Windows services, web server services, and cache publishing services. These metrics can be enabled for the specific requirements of an organization. By default, a number of SharePoint specific metrics are enabled in Hyperic. Additional metrics can be configured to automatically be visible in vc Ops for customizing dashboards for individual SharePoint instances or SharePoint farms. Through vc Ops KPI s can be configured by using discovered metrics, which enables SharePoint administrators to identify problems before they arise. These KPI s are configured by selecting attribute packages and then by choosing the SharePoint Resource Kind in vc Ops, as shown in Figure 87. Figure 87. Managing attribute packages for SharePoint Figure 88 shows a Resource Details page for a SharePoint standalone server; here individual metrics can be graphed and used to identify trending of key counters, such as incoming page requests and SQL query response times. This enables administrators to predict futures workloads on SharePoint environments deployed on EMC Hybrid Cloud. 92

93 Chapter 5: Monitoring Microsoft Applications Figure 88. Viewing SharePoint Resource Details Some of the key SharePoint metrics which can be monitored include: Incoming Page Request Rate is used to return the number of incoming requests. Executing SQL Queries is a metric that calculates the average execution time of SQL queries by the databases used for SharePoint deployments. Reject Page Request Rate is a counter that identifies the number of requests rejected. Responded Page Request Rate is a metric that is used to monitor the number of requests returned. Executing Time/Page Request monitors the average execution response time of requests. Note: For a full range of SharePoint metrics supported by vcenter Hyperic refer to VMware vcenter Hyperic Resource Configuration and Metrics Guide on the VMware website. SharePoint dashboards vc Ops customized dashboards can be created to provide an at-a-glance view of key metrics associated with Microsoft SharePoint. Dashboards such as these can be used to easily identify any anomalies that may occur, allowing remedial action to be taken quickly. As shown in Figure 89, required widgets can be dragged onto a SharePoint template and customized. A range of widgets can be added to SharePoint dashboards, each allowing specific metrics to be included. 93

94 Chapter 5: Monitoring Microsoft Applications Figure 89. Creating a custom SharePoint dashboard Figure 90 shows a custom dashboard that was created for this solution to monitor a number of SharePoint standalone servers. This dashboard is divided into four widgets, where metric graphs are used to monitor SharePoint services, such as the web services and Page requests. The application overview window displays the status of the overall health and availability of SharePoint components, such as Windows SharePoint Service content (WSS_Content) and SQL resources. The Mashup charts were created in this solution to assist in identifying any anomalies that might occur. An alerts view was added to ensure that SharePoint alerts can be identified quickly. Notification of these alerts can also be sent to SharePoint administrators responsible for these resources. Similar dashboards can be used to monitor SharePoint farms. Figure 90. SharePoint customized dashboard sample 94

95 Chapter 6: Elasticity for Microsoft Applications Chapter 6 Elasticity for Microsoft Applications This chapter presents the following topics: Overview Threshold Alerts Elasticity for Microsoft Exchange Elasticity for Microsoft SQL Server Elasticity for Microsoft SharePoint

96 Chapter 6: Elasticity for Microsoft Applications Overview Threshold Alerts Elasticity of EMC Hybrid Cloud 2.5 can involve scaling resources up and down, such as CPU, memory, or storage for a virtual machine or for an application. If an application no longer needs the same amount of resources, then these can be adjusted on demand. However, multi-server applications and platforms add another level of elasticity, because the addition of another virtual machine can expand the service capability. For example, the addition of a Web Front-End server to a SharePoint farm allows the farm to expand to accommodate more users. Servers can also be retired when an application or platform no longer needs them. In this way the organization has better, more intelligent control over cloud resources and can adapt to constant change and varied demands. Application specific alerts and thresholds can be configured from vcenter Operations Manager. With notifications, the correct application personnel are notified when thresholds are breached. This ensures that both over- and under-utilized application resources can be scaled up or down, allowing administrators to increase or decrease application resources when required. Alerts triggered on vc Ops are visible from either the alerts overview page shown in Figure 91, from customized at-a-glance dashboards or application teams can be notified via . Figure 91. Alerts Overview Alerts specific to Microsoft applications can be configured to trigger based on particular thresholds set within an attribute package. Different application servers running on EMC Hybrid Cloud might have different threshold requirements for application-specific counters. In this case, additional Attribute packages can be created and allocated to certain resources. For each of the metrics used to monitor Microsoft applications, thresholds and KPIs can be enabled to ensure essential counters are operating in accordance with the requirements of a business group. Figure 92 shows the advanced configuration settings of an Exchange alert, where Critical, Intermediate, Warning, and informational thresholds can be assigned. 96

97 Chapter 6: Elasticity for Microsoft Applications Figure 92. Configuring an alert Notification vcenter Operations Manager allows notifications be configured to ensure that Microsoft Application teams are notified when threshold limits are reached. Configuration details for notification on vc Ops are described in VMware vcenter Operations Manager Documentation on the VMware website. To enable application specific notification, the adapter kind must be specified in the filter.xml file where the adapter kind name is HyperApiAdapter. Elasticity for Microsoft Exchange When an Exchange administrator requests an additional server to be added to the infrastructure, the request can be fulfilled with the deployment of a new Mailbox server that will be automatically added to an existing Database Availability Group (DAG). After the server is deployed, the Exchange Administrator will have full control of the server and can manually configure database replication options and other properties as necessary. The following is a quick overview of the deployment process. The process starts with publishing a prepared blueprint from vcloud Application Director into vcac and configuring it to be available in the catalog. The Application Director blueprint is specifically created for adding a new Exchange Server to an existing DAG, as shown in Figure

98 Chapter 6: Elasticity for Microsoft Applications Figure 93. Blueprint for Exchange 2013 DAG expansion Figure 94 shows a blueprint with several specific services, each with configuration properties and actions that run a PowerShell script. The script will add the new Exchange virtual machine to an existing Windows Domain and specified DAG. Figure 94. Configuration properties for Exchange 2013 DAG expansion blueprint Table 5 lists the required property values for Exchange DAG service that is included in the Exchange 2013 DAG expansion blueprint. These properties can be edited to customize the installation prior to requesting the application. During installation, these parameters can be changed, provided they are made overridable within the blueprint. 98

99 Chapter 6: Elasticity for Microsoft Applications Table 6. Exchange DAG expansion blueprint property values Property Blueprint value example Description Install_repository c:\software\exchange Location of the Exchange installation files Organization_name Exchange Your Exchange Organization name Domain exlab.local Your Windows Domain name DAGIP DAG IP address DAGNAME DAG1 DAG Name User Administrator User account with admin rights to perform Exchange installation Password Password User account password DBNAME DB1 Database name After the blueprint is published into a vcac Service Catalog, users with the correct permissions can request it, as shown in Figure 95. Figure 95. vcac Exchange DAG expansion request information and description Users must then fill in a few details to justify the deployment, as shown in Figure

100 Chapter 6: Elasticity for Microsoft Applications Figure 96. vcac Exchange DAG expansion properties Users have more control over where and how the new Exchange Server virtual machine is deployed by accepting the defaults or changing the configurable properties, as shown in Figure 97. Figure 97. Deployment configuration properties for Exchange DAG expansion After the deployment is successful, the new Exchange Server virtual machine is visible to the user in the vcac Items tab. As soon as server is deployed, the Exchange administrator can perform any necessary configuration actions, such as allowing configuring database replication to the newly deployed server. 100

101 Chapter 6: Elasticity for Microsoft Applications Elasticity for Microsoft SQL Server Through the use of alerting and notification from vc Ops, SQL Server application administrators can increase or decrease the resources used by a SQL Server deployment by using vcac, as shown in Figure 98. In this solution, for example, alert thresholds were implemented to notify the applicable application administrators when CPU usage ran under 20 percent for a defined number of wait cycles. Figure 98. SQL Server alert After these alerts were triggered, an notification was sent to appropriate recipients. These were defined in the filter.xml file on the vc Ops analytics Virtual Machine. The notification contained the alert details as well as the responsible SQL Server name. The filter rule within this file must also contain the adapter kind and the resource kind in the format of: HypericApiAdapter:MsSQL. Remedial action was taken by using vcac to decrease the amount of CPU resources, as shown in Figure 99, where the number of CPUs was changed from four to two. This opened up resources within EMC Hybrid Cloud and allowed the CPU resources to be used by applications requiring additional compute assets. This operation required a reboot of the SQL Server virtual machine, which can be set up as a scheduled task in vcac. Figure 99. Editing CPU resources for SQL Server After the request was submitted to decrease the number of CPU s used, the status of the request could be viewed under the Requests tab on vcac. Through the monitoring capabilities of vc Ops and the use of vcac, SQL Server deployments running on EMC Hybrid Cloud can be scaled up or down depending on the requirements of a business group, as illustrated in this use case. 101

102 Chapter 6: Elasticity for Microsoft Applications Elasticity for Microsoft SharePoint For a federated platform like SharePoint, the addition of a virtual machine can easily expand the capacity of the farm and allow more users to connect. Specific SharePoint roles can be added as necessary, such as WFE, Excel Services, and Search, so that the farm adapts directly to specific requirements. In our example we are adding a WFE to the SharePoint farm so that more users can be accommodated during a busy period. When the busy period is over, the extra WFE can be removed so that resources are not wasted. Figure 100 shows the CPU on a WFE going over 80% on the SharePoint Intranet farm. This graph and alert are from a customized dashboard in vc Ops. To alleviate the load on this WFE, we added extra WFEs to the farm. Figure 100. CPU usage for SharePoint WFE in vc Ops SharePoint 2010 We created a blueprint specifically for adding a WFE to the existing, multi-virtual machine SharePoint 2010 Intranet farm, which enabled us to add as many WFEs as necessary to expand the farm, as shown in Figure

103 Chapter 6: Elasticity for Microsoft Applications Figure 101. SharePoint application blueprint Figure 102 shows the blueprint with several specific properties and an Install action that runs a PowerShell script which add the new virtual machine as a WFE to the farm. Figure 102. SharePoint Application blueprint properties and actions In the Service Catalog in vcac, a user with adequate permissions can request the addition of the WFE, as highlighted in Figure

104 Chapter 6: Elasticity for Microsoft Applications Figure 103. SharePoint 2010 WFE selection from the vcac catalog The user then fills in a few details to justify the deployment, as shown in Figure 104. Figure 104. SharePoint 2010 request information Users can have more control over where and how the virtual machine is deployed by changing the properties. For additional servers, users can use the default properties, which are usually correct after the initial configuration, as shown in Figure 105. Figure 105. SharePoint 2010 request properties After the deployment is successful, the new virtual machine is visible to users in the Items tab, as shown in Figure

105 Chapter 6: Elasticity for Microsoft Applications Figure 106. Provisioned SharePoint 2010 virtual machines in vcac The script automatically adds the new virtual machine to the SharePoint farm and sets it up as a WFE. Within a few minutes the new WFE is ready to service requests from users, as shown in Figure 107. Figure 107. SharePoint 2010 Farm information The script can also change DNS or a load balancer to ensure that the new WFE has users intelligently redirected to it as part of the WFE group. This can also be manually done after deployment. 105

106 Chapter 6: Elasticity for Microsoft Applications After the new WFE has completed its task and accommodated the user load, it might not be used again until the situation reoccurs. In this case, the administrator can retire the additional WFE and allow its resources to be used for other cloud services. The WFE should first be removed from the SharePoint farm and DNS/load balancers, so that it is no longer servicing requests. The administrator or user can then choose to destroy the virtual machine in vcac, as shown in Figure 108. Figure 108. Options for virtual machines in vcac After the user confirms the Destroy action, as shown in Figure 109, the virtual machine is shut down and deleted. All its reservations and resources are returned to the reservation pool. 106

107 Chapter 6: Elasticity for Microsoft Applications Figure 109. Destroying virtual machine confirmation options in vcac SharePoint 2013 As for SharePoint 2010, a blueprint and catalog Item for adding a WFE to a SharePoint 2013 farm can be created, as shown in Figure 110. Figure 110. SharePoint 2013 WFE selection from the vcac catalog Figure 111 shows the request information and properties that are required from the user. 107

108 Chapter 6: Elasticity for Microsoft Applications Figure 111. SharePoint 2013 request information and properties The new SharePoint WFE is automatically added to the farm by the PowerShell script, as shown in Figure 112. The script can also add the WFE to DNS and/or load balancers, so that user traffic is redirected to the new WFE. This can also be done manually, if necessary. 108