xset s off

Recommended Method of Sending E-mail

Enterprise Agreement Customers

Pay-As-You-Go Customers:

MSDN, Azure Pass, Azure in Open, Education, BizSpark, and Free Trial Customers:

Cloud Service Provider (CSP)

Test VM Configuration

Azure settings

• OS disk type : Premium P10.
• Attached 4 data disks to VM:
  • 2x Premium P10 (128 GB - Disk limits: 500 IOPS or 100 MB/s - Disk Cache Setting: None)
  • 1x Premium P20 (512 GB - Disk limits: 2300 IOPS or 150 MB/s - Disk Cache Setting: None)
  • 1x Premium P30 (1024 GB - Disk limits: 5000 IOPS or 200 MB/s - Disk Cache Setting: None)

Guest OS settings

# lsblk
NAME      MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
fd0         2:0    1     4K  0 disk
sda         8:0    0    30G  0 disk
└─sda1      8:1    0    30G  0 part  /
sdb         8:16   0    14G  0 disk
└─sdb1      8:17   0    14G  0 part  /mnt
sdc         8:32   0  1023G  0 disk
└─sdc1      8:33   0  1023G  0 part  /p30
sdd         8:48   0   127G  0 disk
└─sdd1      8:49   0   127G  0 part
  └─md127   9:127  0 253.9G  0 raid0 /p10_RAID
sde         8:64   0   511G  0 disk
└─sde1      8:65   0   511G  0 part  /p20
sdf         8:80   0   127G  0 disk
└─sdf1      8:81   0   127G  0 part
  └─md127   9:127  0 253.9G  0 raid0 /p10_RAID

Disk Performance target

VM Performance Target

How to measure Disk and VM Level Throttling using Metrics?

How to configure Linux Diagnostic Extension to collect Guest Metrics?

Configuration Through Command Line

Disk Metrics

• IOPS – Transfers Per Second

  {
    "unit": "CountPerSecond",
    "type": "builtin",
    "counter": "TransfersPerSecond",
    "counterSpecifier": "/builtin/Disk/TransfersPerSecond/sdc",
    "annotation": [
      {
        "locale": "en-us",
        "displayName": "sdc IOPS"
      }
    ],
    "condition": "Name=\"sdc\"",
    "class": "Disk"
  }

• Bps – Bytes per Second

  {
    "unit": "BytesPerSecond",
    "type": "builtin",
    "counter": "BytesPerSecond",
    "counterSpecifier": "/builtin/Disk/BytesPerSecond/sdc",
    "annotation": [
      {
        "locale": "en-us",
        "displayName": "sdc BPS"
      }
    ],
    "condition": "Name=\"sdc\"",
    "class": "Disk"
  }

• Average Latency

  {
    "unit": "Millisecond",
    "type": "builtin",
    "counter": "AverageTransferTime",
    "counterSpecifier": "/builtin/Disk/AverageTransferTime/sdc",
    "annotation": [
      {
        "locale": "en-us",
        "displayName": "sdc AvLat"
      }
    ],
    "condition": "Name=\"sdc\"",
    "class": "Disk"
  }

• Queue Length

  {
    "unit": "Count",
    "type": "builtin",
    "counter": "AverageDiskQueueLength",
    "counterSpecifier": "/builtin/Disk/AverageDiskQueueLength/sdc",
    "annotation": [
      {
        "locale": "en-us",
        "displayName": "sdc avQL"
      }
    ],
    "condition": "Name=\"sdc\"",
    "class": "Disk"
  }

Mount Point Metrics

• Mount Point IOPS – Transfers Per Second

  {
    "unit": "CountPerSecond",
    "type": "builtin",
    "counter": "TransfersPerSecond",
    "counterSpecifier": "/builtin/FileSystem/TransfersPerSecond/p10_RAID",
    "annotation": [
      {
        "locale": "en-us",
        "displayName": "p10_RAID IOPS"
      }
    ],
    "condition": "Name=\"/p10_RAID\"",
    "class": "FileSystem"
  }

• Mount Point Bps – Bytes per Second

  {
    "unit": "BytesPerSecond",
    "type": "builtin",
    "counter": "BytesPerSecond",
    "counterSpecifier": "/builtin/FileSystem/BytesPerSecond/p10_RAID",
    "annotation": [
      {
        "locale": "en-us",
        "displayName": "p10_RAID BPS"
      }
    ],
    "condition": "Name=\"/p10_RAID\"",
    "class": "FileSystem"
  }

• Mount Point _Total – Transfers Per Second and Bytes per Second

  {
    "unit": "CountPerSecond",
    "type": "builtin",
    "counter": "TransfersPerSecond",
    "counterSpecifier": "/builtin/FileSystem/TransfersPerSecond/_Total",
    "annotation": [
      {
        "locale": "en-us",
        "displayName": "_Total IOPS"
      }
    ],
    "condition": "Name=\"_Total\"",
    "class": "FileSystem"
  },
  {
    "unit": "BytesPerSecond",
    "type": "builtin",
    "counter": "BytesPerSecond",
    "counterSpecifier": "/builtin/FileSystem/BytesPerSecond/_Total",
    "annotation": [
      {
        "locale": "en-us",
        "displayName": "_Total BPS"
      }
    ],
    "condition": "Name=\"_Total\"",
    "class": "FileSystem"
  }

General Settings

Extension Installation

$my_resource_group=<VM Resource Group Name>
$my_linux_vm=<VM Name>
$my_diagnostic_storage_account=<Diagnostic Storage Account Name>
$my_config_file=<.json Public Configuration File>
$my_diagnostic_storage_account_sastoken=$(az storage account generate-sas --account-name $my_diagnostic_storage_account --expiry 9999-12-31T23:59Z --permissions wlacu --resource-types co --services bt -o tsv)
$my_lad_protected_settings="{'storageAccountName': '$my_diagnostic_storage_account', 'storageAccountSasToken': '$my_diagnostic_storage_account_sastoken'}"
az vm extension set --publisher Microsoft.Azure.Diagnostics --name LinuxDiagnostic --version 3.0 --resource-group $my_resource_group --vm-name $my_linux_vm --protected-settings "${my_lad_protected_settings}" --settings $my_config_file

How to review Collected Metrics?

How to configure Metric Alerts?

Disk Level Metric Alert

VM Level Metric Alert

How to test Metrics Alert Rules?

# fio --runtime 7000 fiowrite_p10_RAID.ini

[global]
size=30g
direct=1
iodepth=256
ioengine=libaio
bs=8k

[writer1]
rw=randwrite
directory=/p10_RAID
[writer2]
rw=randwrite
directory=/p10_RAID
[writer3]
rw=randwrite
directory=/p10_RAID
[writer4]
rw=randwrite
directory=/p10_RAID

• 1000 IOPS generated over /p10_RAID.
• 2300 IOPS generated over /p20
• 5000 IOPS generated over /p30

Where is the metrics data stored?

Conclusions

Next Steps

• Azure Premium Storage: Design for High Performance - Benchmarking
• Flexible-IO (fio)

• How to Attach a Data Disk to a Linux Virtual Machine
• Configure Software RAID on Linux

• Use Linux Diagnostic Extension to monitor metrics and logs
• System Center Cross Platform Provider for Operations Manager
• Open Management Infrastructure

• High-performance Premium Storage and managed disks for VMs
• Azure Premium Storage, now generally available

• General purpose Linux VM sizes

• Navigate to your VM "MonitorVM" in the Azure Portal.
• Select "Diagnostics settings" on the VM's blade. Switch to "Performance counters" tab (1.).
• Choose "Custom" (2.) to add new custom performance counter.
• Add text of new performance counter in textbox (3.) e.g. "\PhysicalDisk(0 C:)\Disk Transfers/sec".
• Click "Add" button (4.) to add performance counter to collection.
• Provide sample rate by adding number of seconds to textbox (5.).
• Finally click "Save" button at the top to save configuration.

1. Windows is configured with the appropriate KMS client setup key for that version of Windows.
2. Windows is configured to use the Azure KMS service, e.g. kms.core.windows.net:1688 for VMs in Azure public cloud regions.
3. VM has network connectivity to the KMS endpoint, e.g. kms.core.windows.net:1688 for VMs in Azure public cloud regions. For example, if the guest OS firewall or an Azure network security group (NSG) rule does not allow TCP port 1688 outbound, the activation request will be blocked.
4. Source IP address of KMS activation requests from the VM must be an IP address within the Azure IP ranges. This is necessary because the Azure KMS service only allow requests through if the source IP is within the Azure IP ranges. If you are using ExpressRoute, please see Azure VM may fail to activate over ExpressRoute. If you are using site-to-site VPN please see Use Azure custom routes to enable KMS activation with forced tunneling.

C:\>cscript c:\windows\system32\slmgr.vbs /dlv
Microsoft (R) Windows Script Host Version 5.812
Copyright (C) Microsoft Corporation. All rights reserved.

Software licensing service version: 10.0.14393.351

Name: Windows(R), ServerDatacenter edition
Description: Windows(R) Operating System, VOLUME_KMSCLIENT channel
Activation ID: 21c56779-b449-4d20-adfc-eece0e1ad74b
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 03612-03764-000-000000-03-1033-14393.0000-1642017
Product Key Channel: Volume:GVLK
Installation ID: 009858430382850574122213203392636030969202304948320740858134404
Partial Product Key: 8XDDG
License Status: Licensed
Volume activation expiration: 258206 minute(s) (180 day(s))
Remaining Windows rearm count: 1000
Remaining SKU rearm count: 1000
Trusted time: 6/14/2017 6:24:25 PM
Configured Activation Type: All

Most recent activation information:
Key Management Service client information
 Client Machine ID (CMID): 54653727-addd-4b5f-bde9-824359786b75
 Registered KMS machine name: kms.core.windows.net:1688
 KMS machine IP address: 23.102.135.246
 KMS machine extended PID: 06401-00206-001-010007-03-1033-9600.0000-2322016
 Activation interval: 120 minutes
 Renewal interval: 10080 minutes
 KMS host caching is enabled

cscript c:\windows\system32\slmgr.vbs /ipk <KMS client setup key>
cscript c:\windows\system32\slmgr.vbs /ato

cscript c:\windows\system32\slmgr.vbs /ipk CB7KF-BWN84-R7R2Y-793K2-8XDDG

Error(s):  Activating Windows(R), ServerDatacenter edition
 Error: 0xC004F074 The Software Licensing Service reported that the computer could not be activated. No Key Management Service (KMS) could be contacted. Please see the Application Event Log for additional information.

1. Download and extract the Psping tool to a local folder in the VM that is failing to activate.https://technet.microsoft.com/en-us/sysinternals/jj729731.aspxTo download the file, first go to Server Manager, Configure this local server, select IE Enhanced Security Configuration, and select Off under Administrators.
2. Go to Start, search on Windows PowerShell, right-click Windows PowerShell and select Run as administrator.
3. Make sure the VM is configured to use the Azure KMS server by running the following command. This is set at VM creation, so running this command is just a troubleshooting step to make sure the proper configuration is set.iex "$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /skms kms.core.windows.net:1688"The command should return:Key Management Service machine name set to kms.core.windows.net:1688 successfully. Note that the KMS endpoint differs for public versus national cloud regions as listed at the beginning of this article, so if the VM is in a national cloud region (e.g. China, Germany, or US Gov), replace kms.core.windows.net:1688 with the relevant KMS endpoint for the region where the VM resides.
4. Verify with Psping that you have connectivity to the KMS server. Switch into the folder where you extracted the Pstools.zip download, then run:.\psping.exe kms.core.windows.net:1688In the second-to-last line of the output, make sure you see:Sent = 4, Received = 4, Lost = 0 (0% loss)If Lost is greater than 0, the VM does not have connectivity to the KMS server. In that case, if the VM is in a virtual network and has a custom DNS server specified, you must make sure that DNS server is able to resolve kms.core.windows.net. Or, change the DNS server to one that does resolve kms.core.windows.net. Note that if you remove all DNS servers from a virtual network, VMs will then use Azure's internal DNS service, which is able to resolve kms.core.windows.net.Aside from DNS issues, verify the guest firewall has not been configured in such a way that would block activation attempts. Note that the KMS endpoint differs for public versus national cloud regions as listed at the beginning of this article, so if the VM is in a national cloud region (e.g. China, Germany, or US Gov), replace kms.core.windows.net:1688 with the relevant KMS endpoint for the region where the VM resides.
5. After verifying successful connectivity to kms.core.windows.net:1688 (or the respective KMS endpoint for the national cloud region where the VM is running) run the following command from that elevated PowerShell prompt. This command attempts activation multiple times in a row.1..12 | % { iex "$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ato" ; start-sleep 5 }Successful activation will return:Activating Windows(R), ServerDatacenter edition (12345678-1234-1234-1234-12345678) ... Product activated successfully.
6. If activation still failed, and the VM is running Windows Server 2012 R2 Datacenter, Standard, or Essentials, try the command below for the specific SKU. You can verify the OS version by going to Start, searching on Msinfo32, double-clicking Msinfo32.exe, and looking at the OS Name in the right pane.For Windows Server 2012 R2 Datacenter, run the following from the elevated PowerShell prompt:iex "$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ipk W3GGN-FT8W3-Y4M27-J84CP-Q3VJ9"For Windows Server 2012 R2 Standard, run the following from the elevated PowerShell prompt:iex "$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ipk D2N9P-3P6X9-2R39C-7RTCD-MDVJX"For Windows Server 2012 R2 Essentials, run the following from the elevated PowerShell prompt:iex "$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ipk KNC87-3J2TX-XB4WP-VCPJV-M4FWM"After entering the specific command above for the SKU of Windows Server 2012 R2 the VM is using, try activating again:iex "$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ato"
7. At this point if you are still unable to activate the VM, check the Application event log for events from source Microsoft-Windows-Security-SPP to help understand why activation is failing.

3. Now you have the KEK URL, use the below ARM template to encrypt the VM, supply the KEK.

1. Stop the VM from Azure Management Portal. VM will go in Deallocated State.

2. Copy the VHD file of the OS disk to a storage account to create a backup. You can use storage explorer to copy the vhd file. (https://storageexplorer.com ).
3. Attach this copy of VHD file to a running Windows Server test VM as a data drive from azure portal.
4. RDP to the running test VM and you can see the data disk with a drive letter. It will be locked by BitLocker, so you will need to use below steps to get the secret from azure key vault and unlock the volume.

How can you recover BEK files stored in Key Vault

Disclaimer

Sample Scenario

• You have a requirement to create 15 PublicIpAddress resources in Azure
• You have written a simple for loop like this:for($i=0;$i -lt 15;$i++){New-AzureRmPublicIpAddress -Name "piptest$($i)" -ResourceGroupName contosoRg -Location "East US" -AllocationMethod Dynamic}
• Result: 15 PublicIpAddress resources are created in roughly 8 minutes, 30 seconds. This is not fast enough, so you decide to try this in Powershell jobs, like this:Start-Job -Name createPip -ScriptBlock {New-AzureRmPublicIpAddress -Name "piptest1" -ResourceGroupName contosoRg -Location "East US" -AllocationMethod Dynamic}
• Result: The Powershell job fails because you need to execute Login-AzureRmAccount. This happens because Start-Job does not execute within the context of your existing PowerShell session. The Azure PowerShell module will expect you to authenticate each job.

Final Solution

1. Save a .ps1 file containing the following code sample:

TechNet Gallery Code Sample

a. Count – Number of resources you need to create

b. NamePrefix – Resources will be created as “NamePrefixY” where Y is an integer counter for the count of resources created (i.e. – “PipTest1” – “PipTest15” where “PipTest” is the NamePrefix value)

c. RgName – Name of the Azure Resource Group within your Azure subscription (this must already exist, as the script sample does not create a new Resource Group)

d. Location – A valid Azure location (i.e. – “East US” or “North Europe”)

Sample Syntax

Sample Output