Solaris 10 - CPU/Memory Allocation

How to add memory on LDOM

1. Login to your LDOM where you will be adding extra ram and find out the control domain.
# virtinfo -a
Control domain: "Name_of_Control_Domain"

2. Find the memory currently assigned to your system.
# prtdiag -v | grep -i mem
Memory size: 1234 Megabytes

3. Now, Login to your control domain and check if you have enough resource available to assign to LDOM

a. Check the memory allocation on all LDOM
# ldm list | awk '{print $1 "\t" $6}'
or
to see detail allocation
# ldm ls -o memory
# ldm ls -o cpu
# ldm ls -l <MY_LDOM>

b. Check available memory that you can assign to LDOM,
# ldm list-devices memory
Memory
PA SIZE
0x13c0000000 16G
This output shows there is 16GB available space. If no value returned, that mean you don't have any memory available.


5. Now, assign 16GB of memory to LDOM
# ldm list
a. Set memory to 32GB
# ldm set-memory 32G <MY_LDOM>

b. Add 16 GB of ram
# ldm add-memory 16G <MY_LDOM>

c. Remove 16GB of ram
# ldm remove-memory 16G <MY_LDOM>

6. Now, go back to your LDOM and verify the added memory
# prtconf | grep -i mem

---------------------------------------

To work on CPU/Processor

1. Login to your LDOM and check the no of cpu assigned to the system.
# psrinfo | wc -l

2. Login to Control Domain and check the available CPU
a. Check available cpu,
# ldm list-devices cpu
# ldm list-devices vcpu | wc -l
You will see number of vcpus assigned.
VCPU - no of cpu display is a thread acts like a vpu
Note: Most systems (t4/5, not all) come with 1 core = 8 thread
Some place, they assign by core and some place its by thread.

b. To set to the specific no. of CPU
# ldm set-vcpu 32 <MY_LDOM>

c. To add 16 CPU
# ldm add-vcpu 16 <MY_LDOM>

d. To remove CPU
# ldm remove-vcpu 16 <MY_PDOM>


Some folks prefer to do this way,
1. Shutdown the LDOM
- Login to control domain, and login to LDOM through console
# ldm list
# telnet 0 5000
# init 0
{ok}

2. Allocate cpu/mem from Control domain
# ldm set-vcpu 16 <MY-LDOM>
# ldm set-memory 32G <MY-LDOM>

3. Start LDOM and boot the system
# ldm start <MY_LDOM>
# telnet 0 5000
{ok} boot


Note: If you are using cores rather than thread (vcpu) then you can do this way as well.
a. First check the LDOM config
# ldm list-bindings <my_ldom> | more
Look at the value under CONSTRAINT, you will see something like this, cpu=whole core, then you can use core. Most environment 1 core = 8 vcpu.
    cpu=whole-core
    max-cores-unlimited


# ldm remove-core 2 <my_ldom>
# ldm add-core 2 <my_ldom>


Resource capping
-----------------
When you reduce the memory, I would suggest you to reboot the system if memory utilization is high. Say you have 32 GB of ram and you see 20 GB used and they want you to reduce by 16 than you would probably want to cap the memory. Most application run under specific user, find the user and cap the memory.

Whatever way you want to do, just add entry to /etc/projects. Lets say, you want to cap (10GB) to a user called wauser

10GB = 10x1024x1024x1024 = 10737418240 byte

# vi /etc/project
user.wauser:100::wauser::project.max-shm-memory=(privileged,8589934592,deny);rcap.max-rss=10737418240


Set zfs arc size
-----------------

vi /etc/system

* zfs arc setting 2g max, 64mb min
set zfs:zfs_arc_max=2684354560
set zfs:zfs_arcmin=67108864
* set max file descriptors
set rlim_fd_max=65536
wq!




A swap (or paging file) is an extension of RAM, but it is stored on the hard drive. The swap
file is rebuilt each time the system is rebooted



and reboot your system.

DMZ

a DMZ is a buffered zone between an internal network and the Internet. The DMZ provides a layer of protection for Internet-facing servers, but servers in the DMZ are available
on the Internet.

Public Key Infrastructure (PKI)

Exploring PKI Components
A Public Key Infrastructure (PKI) is a group of technologies used to request, create, manage,
store, distribute, and revoke digital certificates. Asymmetric encryption depends on the use of
certificates for a variety of purposes, such as protecting email and protecting Internet traffic with SSL
and TLS. For example, HTTPS sessions protect Internet credit card transactions, and these
transactions depend on a PKI.

A primary benefit of a PKI is that it allows two people or entities to communicate securely
without knowing each other previously. In other words, it allows them to communicate securely
through an insecure public medium such as the Internet.

For example, you can establish a secure session with Amazon.com even if you’ve never done so
before. Amazon purchased a certificate from VeriSign. The certificate provides the ability to establish a secure session.
A key element in a PKI is a Certificate Authority.

Certificate Authority
A Certificate Authority (CA, pronounced “cah”) issues, manages, validates, and revokes
certificates. In some contexts, you might see a CA referred to as a certification authority, but they are
the same thing. CAs can be very large, such as VeriSign, which is a public CA. A CA can also be very small, such as a single service running on a server in a domain.

Public CAs make money by selling certificates. For this to work, the public CA must be trusted.
Certificates issued by the CA are trusted as long as the CA is trusted.

This is similar to how a driver’s license is trusted. The Department of Motor Vehicles (DMV)
issues driver’s licenses after validating a person’s identity. If you want to cash a check, you may
present your driver’s license to prove your identity. Businesses trust the DMV, so they trust the
driver’s license.

Although we may trust the DMV, why would a computer trust a CA? The answer is based on the
certificate trust path.

How Digital signature works?

Digital signature process
Lisa creates her message in an email program, such as Microsoft Outlook. Once Microsoft
Outlook is configured, all she has to do is click a button to digitally sign the message. Here is what
happens when she clicks the button:
1. The application hashes the message.
2. The application retrieves Lisa’s private key and encrypts the hash using this private key.
3. The application sends both the encrypted hash and the unencrypted message to Bart.
When Bart’s system receives the message, it verifies the digital signature using the following
steps:
1. Bart’s system retrieves Lisa’s public key, which is in Lisa’s public certificate. In some
situations, Lisa may have sent Bart a copy of her certificate with her public key. In domain
environments, Bart’s system can automatically retrieve Lisa’s certificate from a network
location.
2. The email application on Bart’s system decrypts the encrypted hash with Lisa’s public key.
3. The application calculates the hash on the received message.
4. The application compares the decrypted hash with the calculated hash.
If the calculated hash of the received message is the same as the encrypted hash of the digital
signature, it validates several important checks:

Authentication. Lisa sent the message. The public key can only decrypt something encrypted
with the private key, and only Lisa has the private key. If the decryption succeeded, Lisa’s
private key must have encrypted the hash. On the other hand, if another key was used to
encrypt the hash, Lisa’s public key could not decrypt it. In this case, Bart will see an error
indicating a problem with the digital signature.

Non-repudiation. Lisa cannot later deny sending the message. Only Lisa has her private key
and if the public key decrypted the hash, the hash must have been encrypted with her private
key. Non-repudiation is valuable in online transactions.

Integrity. Because the hash of the sent message matches the hash of the received message, the
message has maintained integrity. It hasn’t been modified.

A digital signature is an encrypted hash of a message. The sender’s private key encrypts the hash of the message to create the digital signature. The recipient decrypts the hash with the sender’s public key. If successful, it provides authentication, non-repudiation, and integrity. Authentication identifies the sender. Integrity verifies the message has not been modified. Non-repudiation prevents senders from later denying they sent an email.

Source: Darril Gobson

Fire categories

The different components of a fire are heat, oxygen, fuel, and a chain reaction creating the fire.
Fire suppression methods attempt to remove or disrupt one of these elements to extinguish a fire. You
can extinguish a fire using one of these methods:

Remove the heat. Fire extinguishers commonly use chemical agents or water to remove the
heat. However, water should never be used on an electrical fire.

Remove the oxygen. Many methods use a gas, such as carbon dioxide (CO2) to displace the
oxygen. This is a common method of fighting electrical fires because CO2 and similar gasses
are harmless to electrical equipment.

Remove the fuel. Fire-suppression methods don’t typically fight a fire this way, but of
course, the fire will go out once all the material is burned.

Disrupt the chain reaction. Some chemicals can disrupt the chain reaction of fires to stop
them.

The class of fire often determines what element of the fire you will try to remove or disrupt.
Within the United States, fires are categorized in one of the following fire classes:
Class A—Ordinary combustibles. These include wood, paper, cloth, rubber, trash, and
plastics.

Class B—Flammable liquids. These include gasoline, propane, solvents, oil, paint, lacquers,
and other synthetics or oil-based products.

Class C—Electrical equipment. This includes computers, wiring, controls, motors, and
appliances. On computer-centric environment, you should especially understand that a Class C fire is from electrical equipment. You should not fight Class C fires with water or water-based materials, such as foam, because the water is conductive and can pose significant risks to personnel.

Class D—Combustible metals. This includes metals such as magnesium, lithium, titanium,
and sodium. Once they start to burn, they are much more difficult to extinguish than other
materials.

You can extinguish a Class A fire with water to remove the heat. However, water makes things
much worse if you use it on any of the other classes. For example, using water on live equipment
actually poses a risk because electricity can travel up the water stream and shock you. Additionally,
water damages electrical equipment.

Comparing Backup Types - Back up and Restore

Comparing Backup Types

Backup utilities support several different types of backups. Even though third-party backup
programs can be quite sophisticated in what they do and how they do it, you should have a solid
understanding of the basics.
The most common media used for backups is tape. Tapes store more data and are cheaper than
other media, though some organizations use hard disk drives for backups. However, the type of media doesn’t affect the backup type.

The following backup types are the most common:
Full backup. A full (or normal backup) backs up all the selected data.
Differential backup. This backs up all the data that has changed or is different since the last
full backup.
Incremental backup. This backs up all the data that has changed since the last full or incremental backup.

Full Backups
A full backup backs up all data specified in the backup. For example, you could have several
folders on the D: drive. If you specify these folders in the backup program, the backup program backs
up all the data in these folders.
Although it’s possible to do a full backup on a daily basis, it’s rare to do so in most production
requirements. This is because of two limiting factors:

Time. A full backup can take several hours to complete and can interfere with operations.
However, administrators don’t always have unlimited time to do backups and other system
maintenance. For example, if a system is online 24/7, administrators may need to limit the
amount of time for full backups to early Sunday morning to minimize the impact on users.
Money. Backups need to be stored on some type of media, such as tape or hard drives.
Performing full backups every day requires more media, and the cost can be prohibitive.
Instead, organizations often combine full backups with differential or incremental backups.
However, every backup strategy must start with a full backup.

Restoring a Full Backup
A full backup is the easiest and quickest to restore. You only need to restore the single full
backup and you’re done. If you store backups on tapes, you only need to restore a single tape.
However, most organizations need to balance time and money and use either a full/differential or a
full/incremental backup strategy.

Differential Backups
A differential backup strategy starts with a full backup. After the full backup, differential
backups back up data that has changed or is different since the last full backup.
For example, a full/differential strategy could start with a full backup on Sunday night. On
Monday night, a differential backup would back up all files that changed since the last full backup on
Sunday. On Tuesday night, the differential backup would again back up all the files that changed since the last full backup. This repeats until Sunday, when another full backup starts the process again. As the week progresses, the differential backup steadily grows in size.

Restoring a Full/Differential Backup Set
Assume for a moment that each of the backups was stored on different tapes. If the system
crashed on Wednesday morning, how many tapes would you need to recover the data?
The answer is two. You would first recover the full backup from Sunday. Because the
differential backup on Tuesday night includes all the files that changed after the last full backup, you
would restore that tape to restore all the changes up to Tuesday night.

Incremental Backups
An incremental backup strategy also starts with a full backup. After the full backup, incremental
backups then back up data that has changed since the last backup. This includes either the last full
backup, or the last incremental backup.

As an example, a full/incremental strategy could start with a full backup on Sunday night. On
Monday night, an incremental backup would back up all the files that changed since the last full
backup. On Tuesday night, the incremental backup would back up all the files that changed since the
incremental backup on Monday night. Similarly, the Wednesday night backup would back up all files
that changed since the last incremental backup on Tuesday night. This repeats until Sunday when
another full backup starts the process again. As the week progresses, the incremental backups stay
about the same size.

Restoring a Full/Incremental Backup Set
Assume for a moment that each of the backups was stored on a different tape. If the system
crashed on Thursday morning, how many tapes would you need to recover the data?
The answer is four. You would first need to recover the full backup from Sunday. Because the
incremental backups would be backing up different data each day of the week, each of the incremental backups must be restored and in the chronological order.
Sometimes, people mistakenly think the last incremental backup would have all the relevant
data. Although it might have some relevant data, it doesn’t have everything.

As an example, imagine you worked on a single project file each day of the week, and the system
crashed on Thursday morning. In this scenario, the last incremental backup would hold the most
recent copy of this file. However, what if you compiled a report every Monday but didn’t touch it
again until the following Monday? Only the incremental backup from Monday would include the most recent copy. An incremental backup from Wednesday night or another day of the week wouldn’t include the report.

Choosing Full/Incremental or Full/Differential
A logical question is, “Why are there so many choices for backups?” The answer is that different
organizations have different needs.
For example, imagine two organizations perform daily backups to minimize losses. They each
do a full backup on Sunday, but are now trying to determine if they should use a full/incremental or a
full/differential strategy.
The first organization doesn’t have much time to perform maintenance throughout the week. In
this case, the backup administrator needs to minimize the amount of time required to complete
backups during the week. An incremental backup only backs up the data that has changed since the
last backup. In other words, it includes changes only from a single day. In contrast, a differential
backup includes all the changes since the last full backup. Backing up the changes from a single day
takes less time than backing up changes from multiple days, so a full/incremental backup is the best
choice.
In the second organization, recovery of failed systems is more important. If a failure requires
restoring data, they want to minimize the amount of time needed to restore the data. A full/differential is the best choice in this situation because it only requires the restoration of two backups, the full and the most recent differential backup. In contrast, a full/incremental can require the restoration of several different backups, depending on when the failure occurs.

Remember this
If you have unlimited time and money, the full backup alone provides the
fastest recovery time. Full/incremental strategies reduce the amount of time
needed to perform backups. Full/differential strategies reduce the amount of
time needed to restore backups.

Testing Backups
I’ve heard many horror stories in which personnel are regularly performing backups thinking all
is well. Ultimately, something happens and they need to restore some data. Unfortunately, they
discover that none of the backups holds valid data. People have been going through the motions, but
something in the process is flawed.
The only way to validate a backup is to perform a test restore. Performing a test restore is
nothing more than restoring the data from a backup and verifying its integrity. If you want to verify that
you can restore the entire backup, you perform a full restore of the backup. If you want to verify that
you can restore individual files, you perform a test restore of individual files. It’s common to restore
data to a different location other than the original source location, but in such a way that you can
validate the data.
As a simple example, an administrator can retrieve a random backup and attempt to restore it.
There are two possible outcomes of this test, and both are good:
The test succeeds. Excellent! You know that the backup process works. You don’t
necessarily know that every backup tape is valid, but at least you know that the process is
sound and at least some of your backups work.
The test fails. Excellent! You know there’s a problem that you can fix before a crisis. If you
discovered the problem after you actually lost data, it wouldn’t help you restore the data.
An additional benefit of performing regular test restores is that it allows administrators to
become familiar with the process. The first time they do a restore shouldn’t be in the middle of a
crisis with several high-level managers peering over their shoulders.

Source:- Darril Gibson

Load Balancers for High Availability

Load Balancers for High Availability


Load balancing spreads the processing load over multiple servers to ensure availability when
the processing load increases. Many web-based applications use load balancing for higher
availability

A load balancer can optimize and distribute data loads across multiple computers or multiple
networks. For example, if an organization hosts a popular web site, it can use multiple servers hosting
the same web site in a web farm. Load-balancing software distributes traffic equally among all the
servers in the web farm.

The term load balancer makes it sound like it’s a piece of hardware, but a load balancer can be
hardware or software. A hardware-based load balancer accepts traffic and directs it to servers based
on factors such as processor utilization and the number of current connections to the server. A
software-based load balancer uses software running on each of the servers in the load-balanced
cluster to balance the load.

Load balancing primarily provides scalability, but it also contributes to high availability.
Scalability refers to the ability of a service to serve more clients without any decrease in
performance. Availability ensures that systems are up and operational when needed. By spreading the
load among multiple systems, it ensures that individual systems are not overloaded, increasing
overall availability.

Consider a web server that can serve 100 clients per minute, but if more than 100 clients connect
at a time, performance degrades. You need to either scale up or scale out to serve more clients. You
scale the server up by adding additional resources, such as processors and memory, and you scale out
by adding additional servers in a load balancer.

Figure 9.2 shows an example of a load balancer with multiple web servers. Each web server
includes the same web application. Some load balancers simply send new clients to the servers in a
round-robin fashion. The load balancer sends the first client to Server 1, the second client to Server
2, and so on. Other load balancers automatically detect the load on individual servers and send new
clients to the least used server.

Figure 9.2: Load balancing

An added benefit of many load balancers is that they can detect when a server fails. If a server
stops responding, the load-balancing software no longer sends clients to this server. This contributes
to overall high availability for the load balancer.

When servers are load balanced, it’s called a load-balanced cluster, but it is not the same as a
failover cluster. A failover cluster provides high availability by ensuring another node can pick up the
load for a failed node. A load-balanced cluster provides high availability by sharing the load among
multiple servers. When systems must share the same data storage, a failover cluster is appropriate.
However, when the systems don’t need to share the same storage, a load-balancing solution is more
appropriate, and less expensive. Also, it’s relatively easy to add additional servers to a loadbalancing
solution.

Remember this
Failover clusters are one method of server redundancy and they provide high
availability for servers. They can remove a server as a single point of failure.
Load balancing increases the overall processing power of a service by
sharing the load among multiple servers. Load balancers also ensure
availability when a service has an increased number of requests.

Source: Darril Gibson Book Sec +