VM Service Catalog Overview: The purpose of this document is to detail Virtual Resources and Blade(s) Server Hosting services offered by IT-DC. The CSUSB MPP of the Organization/Department/Affiliate herein will be referred to as User. Allocation Of Resources: A User will be given a standard Virtual Machine (VM) or multiple VM s within a VM Resource Pool (memory, processing power, storage and network). In some cases, a department may have domain over more than one Resource Pool. A System s Administrator/ITC(s) working as an agent/employee of that business unit can be designated as a VM Admin for the objects within that Resource Pool, however a VM Admin is not required. Be aware that having a Resource Pool and a VM Admin will allow for the autonomy of that department, under restrictions, to do administrative tasks for the User s VM s within their designated Resource Pool(s). If that User does not have a System s Administrator/ITC(s) for these tasks, IT-DC may assist in the administration of the User s Resource Pool, if agreed upon by the User and IT-DC. Variables to be allocated for the User include but may not be limited to Storage, Memory, Network, and Processing Power. These resources are subject to change as the environment changes. Services IT-DC Offers to the User The following services are offered to the User, for housing their resources within the IT-DC equipment. A full description of each service is detailed below in the section labeled Service Levels of Understanding. 1. Virtual Environment Administration 2. Operating System Maintenance & Administration 3. Application (Non Native) Administration 4. System Monitoring 5. Data Backup/Restoration Service Service Levels of Understanding Items: Note: The client may perform the following tasks, however these are also services offered by IT-DC: 1. Virtual Environment Administration If there is an understanding between IT-DC and the User, to manage the Virtual Environment Resource Pool, IT-DC requires that the User keep up-to-date maintenance software support licenses, and may have to purchase/obtain any required updates (as appropriate). 2. Operating Systems Maintenance and Administration. If there is an understanding between IT-DC and the User, to support/maintain an Operating System(s) for the User, IT-DC requires that the User keep maintenance software support licenses up-to-date with the vendor, and obtain any required updates (as appropriate). These updates typically include planned enhancements, but can also include fixes for security vulnerabilities and functional issues discovered, before or after the system has been installed. IT-DC reserves the right to modify the configuration of the system or to change certain types of practices/access to the system. These changes will be done in coordination with the User. These changes may be done to protect the system or any part of the system that IT-DC feels may be at risk of becoming compromised/corrupted by an authorized or unauthorized individual(s). IT -DCHS may also require or recommend that modifications be done to that system, for the purpose of moving towards maintaining the integrity and reliability of that system. 1
If User chooses to administer non-native application(s) housed within an Operating System that IT-DC is administering for the User, IT-DC requires that the User maintain the application(s) so that it does not negatively impact, interfere or affect the Operating System, this includes supporting the application(s) to where they are properly configured and maintained, according to IT-DC. IT-DC also requires that the User notify IT-DC via email prior to the User making any changes that may affect that system. IT -DCHS may not be able to provide technical support for all Operating Systems or may discontinue technical support for previously supported Operating Systems, depending on available IT-DC resources. If IT -DCHS agrees to give technical support to a User for a particular Operating System and at a further point in time, can no longer continue providing that support, IT-DC will contact the User and an amendment will be made to the previous agreement stating the changes. Examples of Operating Systems Maintenance and Administration: - Installation and Configuration of Operating System and native services. - Regular Operating System updates. - Provide support to native services to maintain vendor desired operations and communications. - Provide support or work with the application administrators(s) to keep the system functioning as intended by the vendor. 3. Application (Non Native) Administration If there is an understanding between IT-DC and the User regarding assistance in the support of an application(s), then IT-DC requires that the User keep up-to-date maintenance software support license(s) with the vendor, and obtain any required updates, as appropriate. These updates typically include planned enhancements, but can also include fixes for security vulnerabilities and functional issues discovered before and after a system has been installed. If IT-DC assists with administering the User s application(s), IT-DC reserves the right to enforce a policy of using strong passwords or disallowing certain types of practices/access to the system, and if IT-DC feels that a practiced method of communication/activity is placing the system or any part of that system at risk or of becoming compromised/corrupted by an authorized/unauthorized party, IT-DC may require that a modifications be done to that system, in moving towards maintaining the integrity and reliability of that system. IT-DC may not be able to provide technical support for all applications or may discontinue technical support for previously supported applications, depending on available IT-DC resources. If IT-DC agrees to give technical support to a particular application and at a further point in time can no longer continue providing that support, then IT-DC will contact the User and an amendment will be made to previous agreement stating that IT-DC will no longer provide technical support for that application. Examples of providing Assistance with Non-Native Application(s): - Installation and Configuration of Application - Install Application updates upon request of Application owner, - Support operation and communication of Application as intended by vendor 4. System Monitoring If there is an understanding between IT-DC and the User, to monitor the User s System(s), IT-DC will attempt to notify the User for any system failures detected as stated in the IT-DC Escalation Procedures. In order to provide monitoring services to the User, current contact information must be supplied to IT-DC by the User. This information will be noted for the User s VM or related resource in IT-DC s Escalation Procedures. The User may be required to either provide technical details on monitoring the User s system or collaborate with IT-DC to monitor the User s system. Examples of providing System Monitoring: - Monitor Operating System for the following variables: - CPU - Memory - Storage - Perform ping requests to ensure network connectivity - Follow escalation procedures to notify owner of any system errors - Collect default System Logs. 2
5. Data Backup/ Restoration Service If there is an understanding between IT-DC and the User, in regards to providing backup services for the User, on and off-site data storage will be provided to the User. A backup schedule can be provided to the User if requested by the User; however, backup schedules may change as time elapses and availability of resources changes. Recovery of data from the IT-DC backup system may be requested during or after regular business hours by contacting IT-DC. If irregular data recovery is requested by the User, for instance, data recovery during nonnormal business hours or for data to be brought to CSUSB from off site, the User may incur a financial cost. The IT-DC backup system is very reliable but it does have limitations. Any files that change between backups should be included in each subsequent backup run. However, it is possible that a file could be created and lost or damaged between backup cycles in which case those file(s) cannot be recovered. IT-DC may not be able to backup some particular application(s), due to the design or requirements of that application. If the User desires for IT-DC to back up their system(s), IT-DC may require the User to purchase special backup software so as to be included with the IT-DC backup system. In rare cases, Backup Software may not be available or may have of been discontinued by the vendor of that application and so backup functions for that application may not be performed. Because of limited resources, IT-DC has a Backup retention practice and a schedule that has a time frame limitation. On a rotations basis, backup tape media is overwritten, usually but not always, on a cycle. For any deviations or special backup requests to be made, outside the normal backup schedule, the User has to make a request to IT-DC. IT-DC will attempt to meet these requests but so long as there is no negative impact made to the normal backup schedule and/or there are available resources for this request. If irregular data backup functions are requested by the User, the User may incur a financial cost. For the User s data being backed up by IT-DC, it is the responsibility of the User to arrange for periodic data recovery testing of any/all data belonging to the User. IT-DC may be able to provide the restoration of raw data but IT-DC is not responsible for applications/systems properly functioning after the data has been restored, unless there is an understanding by the User and IT-DC that states that IT-DC will administer the User s system, such as the Operating System(s) / Application(s). For this reason, it is the responsibility of the User to arrange for and to do periodic data recovery with IT-DC, for testing any/all data belonging to the User. And if IT-DC is not responsible for administering the User s System (Operating System/Application), it is the responsibility of the User to ensure that the Data recovery process properly restores the User s System (Operating System/Application). Examples of providing Data Backup/ Restoration Service: - File Level Backup and Recovery Every day to be kept for 30 days. DCHS can restore raw data for User. User is responsible for manipulating restored files/system into a working state. - System Level Backup and Recovery - snap-shot of VMDK file (image of system)- Done 1 time a week To be kept for 1 week after backup occurs DCHS Staff can restore VMDK file for User. Important Note In order for DCHS Staff to restore a Virtual Machine, the user needs to have the available data storage space. For example, if a user wants to restore a VM with a 2 TB hard drive, but the user only has 900 GB of available space, that VM will not be able to be restored. - Testing Recovery of System - For the User s data being backed up by IT-DC, it is the responsibility of User to arrange for periodic data recovery testing of any/all data belonging to the User. DCHS can provide raw data, technical support and information about the restore process. DCHS requires at least 1 week of prior notice when User whishes to conduct a system recovery test; notification via email. - Archiving: (System State Snap-shot) In accordance with the Academic Calendar, every December. 3
Service Exclusions IT-DC does not guarantee timeframes for the following situations: Issues referred to a third party service provider Systems in a disaster recovery state Issues that involve troubleshooting the operating system, applications, or content on a VM or Server User Responsibilities: Complete one Service Levels of Understanding (SLU) per one VM or associated resource, if a form does not exist for a particular VM/Resource, IT-DC is not responsible for providing services to that VM/Resource, the data housed within that VM, applications residing with in that VM or for Data belonging to the User. 1. Management of VM Environment and VM Lifecycles Because resources for supporting VM s are limited, every VM should be absolutely necessary for the User s official operational needs. This will prevent the unnecessary creation of VM s, (A.K.A. VM Sprawl Prevention ). A review of VM s or VM resources may be done prior or on a periodic basis, to granting new or additional resources. It will be the responsibility of the User to power off, remove or notify IT-DC when a VM or VM resources are no longer needed. If the User needs assistance for the removal of a VM, steps may be taken between IT-DC and the User to either move the data to another VM, to archive that data, or to delete the VM(s). IT-DC recommends turning off the testing/development VM(s) after the testing/development phase have been completed; in order to conserve allocated resources and keep performance optimal for the other VM s within the User s Resource Pool. Also, please keep in mind that the User is responsible for upgrading the tools needed to interact/manage the Resource Pool, unless otherwise specified by IT-DC. VM Naming Convention: In order for DCHS to keep a consistent inventory, it is required that all Virtual Machines use the following naming convention reflecting department ownership of the VM. E.g. DCHS- VMname. VMware Tools: In order for DCHS to provide a reliable service in virtualization, all virtual machines hosted within vcenter.dchs.csusb.edu must have the latest version of VMware Tools installed and properly running. If VMware tools are not installed, updated, or running, DCHS reserves the rights to proceed with the installation and the update of VMware Tools during the DCHS maintenance windows (please refer to the DCHS maintenance calendar). Prior to the installation or update of VMware Tools, DCHS will notify the VM Admin 10 days in advanced via email. VMware Snapshots: VMware Snapshots are only to be used temporarily. Please be aware that snapshots exceeding 72 hours from creation will be deleted by DCHS. In the event that a VM Admin has formally requested services for Data backup from DCHS, please be aware that having snapshots will result in an unsuccessful backup during the backup window(please reference section 5 Data Backup/ Restoration Service, of the Service Levels of Understanding Items). Snapshots are designed to be used as a temporary rollback solution, not as a backup. 2. Backup or Disaster Recovery Unless the User makes arrangements with IT-DC to create backups of their data/vm(s), IT-DC is not responsible for the backup and recovering the User s data/vm(s). IT-DC offers Backup and Recovery services only upon the Users documented request and approval by IT-DC. IT-DC is not responsible for the User s failure to implement a working backup and recovery plan for any of the User s system(s). Even if there is an understanding with IT-DC, for IT-DC to do data backup for the User s data, the User is responsible for developing, implementing, testing and maintaining a Business Continuity Plan of their Systems, to ensure that their System functions after a data restoration. 4
3. Maintaining system updates/network security on the VM(s)/Applications IT-DC is not responsible for maintaining the software updates/configuration levels on the Operating System/Application belonging to the User, unless there is a documented agreement between the User and IT-DC. A security scan/analysis by the Information Security Office may be conducted for any new VM/applications before being placed into production or granted network access. After a VM/application is placed into production, the IT-ISO may do periodic security scans/audits on those systems. 4. Network Management In order to increase efficiency but limit unnecessary risk, the Users may be given the ability to add and remove Virtual Machines from segmented parts of the CSUSB network (VLANS). Each User (MPP) is responsible for the actions of their staff, malicious or accidental. 5. Storage Management In order to limit the unnecessary usage of resources, storage for the Users is subject to these restrictions: What storage is used should be absolutely necessary for official CSUSB/department operational needs. The review of storage usage may be done periodically. Also, to keeping the allocated storage space from becoming prematurely filled, the User must properly manage their data, according to IT-DC practices. Examples include but are not limited to: a. Proper system data/log rotation/removal/archival practices b. Removal of data that is not part of the operations of that department and removal of data in which its relevance to the function of the department is no longer valid c. Thin provisioning of virtual hard-drives whenever possible Upon request to IT-DC, for an increase in Data Storage, the requesting User may be required to provide evidence of proper Data Storage Management. User Contact Details: Updating IT-DC with the User s contact information is solely the User s responsibility. This information will be placed into the Escalation procedures. The User needs to provide IT-DC with the required contact details; on whom, how and when these individuals should be contacted. Emergency System Safeguard: Under normal circumstances, IT-DC will not access, use or modify any systems/applications belonging to the User, that is not directly under the care of IT-DC. However, in the event of an unforeseen emergency occurring, IT-DC will attempt to contact the owner of the system(s), as designated by the Escalation Procedure, and notify them of the perceived emergency and may require for those designated contacts to take action so as to suppress any negative impacts caused to or by this system/application. If the designated contacts of the User s department are unreachable, and it is deemed necessary, IT-DC may take steps to suppress any perceived negative situations caused to/by the User s system/application. Such action may include cutting off normal communication to that systems and/or performing a Cold Shut Down of that system. Note: When a cold shut-down is performed; this action may cause loss of data and/or application failure/corruption, so it may be reserved as a last resort. Service Request Change A new SLU form is always required for a service, however if the request is for a change to an existing service/slu, or if User wishes to cancel a service currently performed by IT-DC, User may send an email to the director of IT-DC and that may be used as an amendment. The email(s) may serve to assist with updating the existing SLU. IT-DC may choose to print out and attached the emails to the SLU. 5
Example of IT-DC Level of Escalation: Impact Criteria Escalation and Procedure Urgent A component, application or critical - (24x7) (365 days/year) feature is down and as a result, no work can be performed. Non-urgent Abnormal or inconsistent system behavior or a system problem that does not prevent work on the system. Report during normal business hours. - (8am 5pm) Monday-Friday - Summer Schedule:(7am 5:30pm) Mon- Thursday - Excludes: Holidays and Furloughs Service Request Routine request for maintenance. - (8am 5pm) Monday-Friday - Summer Schedule:(7am 5:30pm) Mon- Thursday Business Inquiry A question regarding a change to (new, increased/decreased, disconnected) the contracted service. - Excludes: Holidays and Furloughs - (8am 5pm) Monday-Friday - Summer Schedule:(7am 5:30pm) Mon- Thursday - Excludes: Holidays and Furloughs Last Updated: June-17-2014 6