Windows Azure updates the host environment approximately once every 2-3 months to keep the environment secure for all applications and virtual machines running on the platform. This update process may result in your VM restarting, causing downtime to your applications/services hosted by the Virtual Machines feature. There is no option or configuration to avoid these host updates. In addition to platform updates, Windows Azure service healing occurs automatically when a problem with a host server is detected and the VMs running on that server are moved to a different host. When this occurs, you loose connectivity to VM during the service healing process. After the service healing process is completed, when you connect to VM, you will likely to find a event log entry indicating VM restart (either gracefully or unexpected). Because of this, it is important to configure your VMs to handle these situations in order to avoid downtime for your applications/services. 

To ensure high availability of your applications/services hosted in Windows Azure Virtual Machines,  we recommend using multiple VMs with availability sets. VMs in the same availability set are placed in different fault domains and update domains so that planned updates, or unexpected failures, will not impact all the VMs in that availability set. For example, if you have two VMs and configure them to be part of an availability set, when a host is being updated, only one VM is brought down at a time. This will provide high availability since you have one VM available to serve the user requests during the host update process. Mark Russinovich has posted a great blog post which explains Windows Azure Host updates in detail. Managing the high availability is detailed here.

While availability sets help provide high availability for your VMs, we recognize that proactive notification of planned maintenance is a much-requested feature, particularly to help prepare in a situation where you have a workload that is running on a single VM and is not configured for high availability. While this type of proactive notification of planned maintenance is not currently provided, we encourage you to provide comments on this topic so we can take the feedback to the product teams.

Windows Azure Virtual Machine SLA 

https://www.microsoft.com/en-us/download/details.aspx?id=38427 

Key words : VM , Restart, Shutdown, Unexpected reboot, Windows Azure

1. Log onto Windows Azure Management Portal


2. Navigate to “Cloud Services”


3. Select the cloud service you would like to configure Remote Desktop


4. Select configure option


5. Click on “Remote” at the bottom of the screen


6. Select the role you would like to configure Remote Desktop(You may choose “All” option to configure remote desktop for all the roles)


7. Select “Enable Remote Desktop” and configure all required fields (user name, password, certificate, expires on) and click “Complete”

Note: Please ensure you password does not contain username or portion of user name. For example, if the user name is “hari”, make sure password is not like “hari$999” or “ha-789”. This will result in “Your credentials did not work” error when you try to RDP.

Related Articles: 

“Your credentials did not work”

https://blogs.msdn.com/b/narahari/archive/2011/08/29/getting-quot-your-credentials-did-not-work-quot-when-connecting-to-windows-azure-vm-s.aspx

TechNet Radio: (Part 2) Windows Azure Virtual Machine FAQs

iFrame Embed Code:

<iframe style="height:288px;width:512px" src="https://channel9.msdn.com/Shows/TechNet+Radio/TechNet-Radio-Part-2-Windows-Azure-Virtual-Machine-FAQs/player?w=512&h=288" frameBorder="0" scrolling="no" ></iframe>

We’re here for 2 of our Windows Azure IaaS series and in this episode we tackle the top Windows Azure Virtual Machines FAQs and common gotchas. Tune in for this Q&A session and get the answers to some of the most common issues we’ve seen customers run into plus stick around for a quick demo on how to setup and create your own virtual network.

• [1:48] Help! My Virtual Machine disappeared!! What happened?
• [5:44] What is the Temporary Drive(D:) and why should I be worried about it?
• [7:30] Are VHDs deleted by default when you delete virtual machines?
• [10:03] Can I use PowerShell in Azure?  
• [11:25] Why am I having RDP connectivity problems?
• [15:20] What about securing my Azure Virtual Machine? What do I need to know?
• [19:32] Virtual Networks 101: What is it and why is it important?
• [23:12] DEMO: How to create a Virtual Network in Windows Azure

__________________________

Experience Microsoft's latest products with these FREE downloads!
Build Your Lab! Download  Windows Server 2012,  System Center 2012 SP1 and  Hyper-V Server 2012 and get the best virtualization platform and private cloud management solution on the market. Try it FREE now!

Don’t Have a Lab? Build Your Lab in the Cloud with Windows Azure Virtual Machines. Try Windows Azure for free with no cost or obligations, and use any OS, language, database or tool. FREE Download

__________________________
If you're interested in learning more about the products or solutions discussed in this episode, click on any of the below links for free, in-depth information:

Blogs & Articles:

• Matt Hester’s Blog
• Hari Dogiparthi’s Blog
• Read the article: “Windows Azure Virtual Machines FAQs and Common Gotchas”
• Read the article:  “Security Best Practices for Windows Azure”

Videos:

• (Part 1) Infrastructure as a Service – Windows Azure Virtual Machines & What’s in it for You

Virtual Labs:

• Windows Azure Virtual Labs

Follow @technetradio
Become a Fan @ facebook.com/MicrosoftTechNetRadio
Subscribe to our podcast via iTunes, Stitcher, or RSS

Download

• MP3 (Audio only)
• MP4 (iPod, Zune HD)
• High Quality MP4 (iPad, PC)
• Mid Quality MP4 (WP7, HTML5)
• High Quality WMV (PC, Xbox, MCE)

Password cracking. As soon as an attacker knows a valid administrator username and password combination they own your machine. If you use default account names, you are giving the attacker a head start. Then the attacker only has to crack the account’s password. The use of blank or weak passwords makes the attacker’s job even easier. The two main methods used to crack passwords are brute force and dictionary attacks.

Brute force attacks: An attacker guesses identity and/or credentials through the use of brute force.

Attacks that use the raw computer processing power to try different permutations of any variable that could expose a security hole. For example, if an attacker knew that access required an 8-character username and a 10-character password, the attacker could iterate through every possible permutation (256 multiplied by itself 18 times) in order to attempt to gain access to the machine. Scripts make this even easier so no programming knowledge is required.

Dictionary attacks: An attacker guesses identity and/or credentials through the use of common terms in a dictionary designed for that purpose.

The Confiker.B worm used a dictionary of weak passwords in order to compromise machines. Use of a list of likely credentials (usernames, passwords, coding methods) make gaining access relatively easy especially when delivered by a script. This approach is more socially focused than the "brute force" attack method, which increases the likelihood of success in a shorter amount of time.

Spoofing. An attempt to gain access to a system by using a false identity. This can be accomplished by using stolen user credentials or a false IP address. After the attacker successfully gains access as a legitimate user or host, elevation of privileges or abuse using authorization can begin.

Credential theft. An attacker gains access to credentials through data theft; for instance, phishing or social engineering.

• Using weak passwords.
• Storing clear text credentials in configuration files.
• Passing clear text credentials over the network.

Network eavesdropping. An attacker steals identity and/or credentials off the network by reading network traffic not intended for them.

Virtual Machines

Following are the best practices to be followed while working with Windows Azure Virtual Machines to protect from some of the threats, attacks mentioned above.

1) While setting up password, use a pass phrase to create a strong passwords:

Note: Complex passwords like p@assword1, password@1, are very easy to guess for hackers. You may find more examples of strong passwords that can be easy to remember here

Update: In the interest of security, portal does not allow using few common passwords. However there may be few common passwords it allows and we recommend you to avoid using any common passwords.

2) While creating a virtual machine, choose the random name that is not common. i.e. Administrator.

Note: 1) Choose the name that is easy to remember for you. i.e. Administrator-CompanyName, ADMSQLVM. Avoid using common user names mentioned here

          2) In the interest of security, portal does not allow using common names like Administrator while provisioning the VM.

3) Change the default public RDP port(if the public port is 3389) to an unused, non-standard port or if the VM is part of Virtual Network with site-site connectivity to your on-premise environments, remove the endpoint completely and connect to the VM via VPN connectivity.

Update : As of now, Portal generates random port instead of assigning default 3389 for RemoteDesktop. We recommend not to change this public port to 3389.

4) Allow RDP connections only from specific IPs to ensure RDP connectivity from specific machines. (If you do not have control over the IPs you are configuring here, it can potentially lead you to lose connectivity to VM, Please thoroughly discuss this with your network administrators before you attempt to configure this)

Additionally, Create a virtual network with IP/Subnet range and add that range to the whitelist here so that if you lose connectivity from your on-premise environments for any reason, you can spin up a new VM as part of the virtual network and connect to VM with in the virtual network.

For more details: Firewall Rule Properties Page: Scope Tab

5) Configure auditing events and monitor the failed logon attempts and block the IPs

• Configure auditing for failed logon events like 4625,4648 and configure alerts or schedule tasks to run a batch file which will extract the IP from event log entry and block it by adding a firewall rule.
• There seems to be many 3rd party tools available to block these IPs automatically. One I came across is RDPGuard. https://rdpguard.com/

Security and Protection in Windows Server 2008 , R2
Security and Protection in Windows Server 2012

6) Don’t use the same password for all virtual machines,  change the passwords frequently.

7) Use established password management policies. Password policies are established to lessen the vulnerability to dictionary or brute-force attacks against authentication. These policies include:

• Require strong passwords. Strong password policies should encompass minimum password length, and use of alpha-numeric and special characters.
• Enforce requirements when using a passphrase. Passphrases should also have minimum requirements for number of characters, and potentially special characters too.
• Enforce password complexity requirement by requiring long passwords with a combination of upper case, lower case, numeric and special (for example punctuation) characters. This helps mitigate the threat posed by dictionary attacks.
• Enforce password expiration periods.
• Use account lockout policies for end-user accounts.
• Support administrative disabling of accounts.
• Maintain a password history, but do not store the actual password as described above.
• Be aware of using email to distribute passwords or as part of your password reset procedures. Instead of passing the user credentials in email, consider an alternate approach allowing users to use alternate means to identify themselves (such as secrets) in the UI and reset the password.



8) Run best practices analyzer and take appropriate action to fix security issues reported by the tool 

9) Do NOT disable automatic updates or ensure VMs are up-to-date from patches perspective.

10) Evaluate best suitable anti virus software / Intrusion detection software available in the market for the use in Windows Azure Virtual Machines

Cloud Services

When setting up remote desktop for a cloud service in Windows Azure the same care must be taken to secure the machine.

1) When deploying in Visual Studio or with the PowerShell Enable-AzureServiceProjectRemoteDesktop command, choose a random User name account which is easy to remember for you. i.e. ADMSQLVM.  Choose a password, use a pass phrase to create a strong passwords.

2) Change your password frequently.

3) When not using the Remote Desktop Connection, you can disable it using the Disable-AzureServiceProjectRemoteDesktop command. This will substantially reduce your risk surface.

4) With Windows Azure diagnostics, you can monitor the event logs for failed logon events 4625, and 4648.

I’ve obtained some of the content (especially related to attacks) of this article from J.D.Meier’s blog. He has posted a great blog related to cloud security and covers various security aspects . It has tons of great information that will help windows azure virtual machines users to understand various security issues.

Many thanks to Corey Sanders, Flavio Muratore, Julian Gonzalez, Neil Carpenter, Steve Espinosa,  William Bellamy for their review, valuable inputs.

Keywords: Security, Best Practices, IaaS, VM, Windows Azure Virtual Machines.

1) Virtual machine disappeared or was deleted

When you hit the usage limit on your account, for example with a 90-day trial or the monthly access from an MSDN subscription, your storage accounts are set read-only, the VHD files for your VMs remain in the storage account as-is, but any deployed VMs are removed. This is done because deployed VMs reserve capacity even when stopped. Trial account users can enable pay-as-you-go, and for accounts with monthly limits like with an MSDN subscription, you will be able to deploy VMs from the existing VHDs when the next month’s billing cycle begins and the next month of usage is available. I’ve detailed this issue and mitigations in this blog post

Important Note: 90 day trial is associated with various quotas documented here. After a specific quota(s) are reached you will not be able to use the related services unless you enable charges on your subscription. So depending on the usage of the trial subscription, you may run out of quotas way before 90 days. For example, 90 day trial comes with 750 small compute hours.  That means you can run one single small VM for 750 hours. So,  if you were to create 4 extra large VMs, these VMs will run for 23+ hrs before they are deleted.

2) Underlying VHDs are not deleted by default when you delete virtual machines

VHD files for Azure VMs are blobs in your Azure storage account that are registered as disk objects and attached to a VM when a VM is created (in the case of the OS disk) or when you manually add one (in the case of data disks). Removing a VM only makes it so the disk objects are no longer attached to the a VM, but the disk objects still remain as do the physical VHD files in your storage account (which will continue to incur storage fees).

To delete virtual machines along with related resources, you need to: Delete virtual machines, Delete Disks, Delete VHDs

To remove disk objects and if desired, the physical VHD also, select Virtual Machines, then Disks, highlight the relevant disk and click Delete Disk which will then show you two options – Delete the associated VHD and Retain the associated VHD.

• To remove both the disk object and the physical VHD in your storage account, select Delete the associated VHD.
• If you want to keep the physical VHD file but just remove the disk object, select Retain the associated VHD.

Screenshot showing the Delete the associated VHD and Retain the associated VHD options that are displayed when clicking Delete Disk in the Disks section within Virtual Machines.

Note: Deleting VHDs may result in errors and may require you to break the lease to recover from the issue. Refer to point # 7 for more details.

3) Beware of “Temporary Disk” usage

We have seen a few customers that have used the D: drive to store important data, not realizing it is temporary storage.

The Temporary Storage (D:) drive is not persisted to Windows Azure storage as OS disks and data disks are. Data on the D: drive will be lost when the VM is moved to a different host server, when the host is updated or if it experiences a hardware failure or VM is moved to different host due to resize operation. The D: drive is only intended for storing temporary data (as indicated by the Temporary Storage volume label on the drive) such as temporary logs or databases. You must not use this temporary disk to store any data that you are not willing to lose. One key benefit that may motivate developers to use temporary disk is performance. I/O performance for temporary disks is higher than the IO permanence to OS disks, Data Disks. The reason is data is not persisted to Windows Azure Storage.

When using the D: drive for SQL TEMPDB, you will need to recreate the target folder when the VM is migrated to a different host, otherwise SQL may fail to start. For more information see the following article on the TechNet wiki: Change TEMPDB to Temporary Drive on Azure SQL IaaS

Screenshots showing the temporary drive Temporary Storage (D:)

       

4) Uploading existing VHDs

Customers can use various methods to upload VHDs to Windows Azure Storage. We recommend uploading VHDs with the Add-AzureVHD cmdlet from Azure PowerShell 0.6.9 or later, or with Csupload.exe (1.7 or later) from the Azure SDK.

Please make sure of the following when uploading a VHD for use with Azure VMs:

• A VM must be generalized to use as an image from which you will create other VMs. For Windows, you generalize with the sysprep tool. For Linux you generalize with the Windows Azure Linux Agent (waagent). Provisioning will fail if you upload a VHD as an image that has not been generalized.
• A VM must not be generalized to use as a disk to only use as a single VM (and not base other VMs from it). Provisioning will fail if you upload a VHD as a disk that has generalized.
• When using third-party storage tools for the upload make sure to upload the VHD a page blob (provisioning will fail if the VHD was uploaded as a block blob). Add-AzureVHD and Csupload will handle this for you. It is only with third-party tools that you could inadvertantly upload as a block blob instead of a page blob.
• Upload only fixed VHDs (not dynamic, and not VHDX). Windows Azure Virtual Machines do not support dynamic disks or the VHDX format.

           Note: Using CSUPLOAD or Add-AzureVHD to upload VHDs automatically converts the dynamic VHDs to fixed VHDs.

• Maximum size of VHD can be up to 127 GB. While data disks can be up to 1 TB, OS disks must be 127 GB or less.
• The VM must be configured for DHCP and not assigned a static IP address. Windows Azure Virtual Machines do not support static IP addresses.

This forum post contains the common issues(&workarounds) which may occur while uploading the VHDs. Also, you can find few details on several storage tools here

5) Unable to re-use the previous DNS name of VM even though VM is deleted

Deleting a VM does not remove the associated cloud service automatically and hence you are unable to re-use the same DNS name as previous VM. To reuse the DNS name, explicitly delete the cloud service in the Cloud Services section of the management portal, using Remove-AzureService from Azure PowerShell, Azure Service Delete from the Azure CLI tool, or the Delete Hosted Service API (the terms Cloud Service and Hosted Service are synonymous in this scenario).

Confused about cloud service? Let me explain. 

When you create an Azure VM, a cloud service is created automatically with the DNS name you’ve provided for the VM. Currently, new HTML5 management portal does not list this cloud service under "Cloud Services” section if it contains a single VM. You will see the cloud service there if it contains no VMs (is empty) or multiple VMs. You can check the cloud service by using the Azure PowerShell Get-AzureService cmdlet. You can group or connect up to 50 virtual machines under a single cloud service.

6) Securing Windows Azure Virtual Machines

In on-premise environments, security is an critical aspect when building machines, VMs. Building VMs in cloud is no different and one must take important measures to protect the VMs. This blog post summarizes the best practices to be used to protect Windows Azure Virtual Machines

7) Failed to start virtual machine xxxxxx.

While provisioning virtual machines, you may run similar error to below.

Failed to start virtual machine xxxxxx.
The operation cannot be performed because the virtual machine is faulted. The long running operation tracking ID was: 8d03b3e18cac33e5a52996b68b6aa16g.

We have one known issue that may cause this behavior and our internal teams are working very hard to get to the fix deployed to resolve the issue. Until then, you may resize the virtual machine to workaround the issue quickly. If the issue persists after resizing, you may open a new forum thread using the forum link(s) provided under "Production workloads and support during Windows Azure Virtual Machines “Preview” section.

Update: Windows Azure Virtual Machines went into General availability status on 16th April 2013. This issue has been resolved. If you are seeing this issue, please contact Windows Azure Support

8) Failed to create virtual machine linuxvm1.

While provisioning Linux based virtual machines, you may run into similar error to below.

 Successfully created virtual machine linuxvm1.

 Could not provision the virtual machine linuxvm1.

Linux defines a set of user names that you can't use and if you are using one of those user names, you will see the above error. Refer to  https://www.windowsazure.com/en-us/manage/linux/other-resources/user-names-in-linux/ for more details, user names that cannot be used for Linux images.

9) Capture Versus Snapshot

Capturing a VM creates an image(not meant for backup) that can be used to create multiple VMs based on that same image. You can capture a VM using the Capture option in the portal, the Save-AzureVMImage Azure PowerShell cmdlet, using azure vm capture in the Azure CLI tool, or the Capture Role API.

For VM backups, there is no equivalent to the Hyper-V snapshot feature for Azure VMs. However Azure storage has a blob snapshot feature that allows you to create a backup of the VHD blob in Azure storage. Microsoft does not currently provide a tool for creating blob snapshots, though third-party storage tools such as CloudXplorer include this feature. And you can write custom code to call the Snapshot Blob API to create a blob snapshot.

You can also create a copy of a VHD using Azure storage tools. If the tool uses the 2012-02-12 version or later of the Copy Blob API, it will allow for fast cross-account blob copies, for example to move a VHD between different storage accounts. Most of the commonly used Azure storage tools also allow you to download files to on-premises. This forum post has steps to download the VHD using CloudXplorer. You can use any similar storage tools to perform the same task.

10) How to break the lease on VHDs/blobs?

The Windows Azure platform holds an infinite lease on all the page blobs that it considers disks in your storage account so that you don’t accidently delete the underlying page blob, container, or storage account while the VHD is in use by the VM. If you want to delete the underlying page blob, the container it is within, or the storage account, you will need to detach the disk from the VM first or delete the VM and associated disk object.

In few scenarios, you may end up getting errors while deleting VHDs even though there are no disks/VMs referring to the VHD. In such cases you can manually break the lease using the powershell script. Craig Landis has a detailed forum post describing these errors, workarounds along with the script.

11) RDP connectivity issues

RDP connectivity issue is very common issue customer encounter and this could be due to several different factors ranging from simple client firewall issue to a platform issue. You should start eliminating all client side issues first.

• Investigate client-side firewall issues by pinging the TCP port for the RDP endpoint using tools such as PsPing, PortQry, Telnet, or Nmap. See if your machine allows outbound communication to the RDP endpoint (TCP port 3389 for the first VM deployed to a cloud service, a random ephemeral port between 49152-65535 for additional VMs in the same cloud service). Verify the port on the Endpoints section for the VM in the portal. Since corporate firewalls often block 3389 and/or the ephemeral range (49152-65535), try connecting to the VM from a different network – from home, a wifi hotspot, or a mobile broadband connection.
• Drew McDaniel has  a forum sticky post with common issue like cache credentials, endpoint related issues.
• If you none of the above resolved connectivity issue, you can quickly try restarting/resizing the VMs to see if the problem goes away. If the problem persists you can reach out to the support forum.

Important Note: If you changed your firewall settings on VM to block the RDP traffic or if you stopped RDP related services on the virtual machine, you will end-up losing connectivity to the VM. There is no easy to revert these settings. You would need to follow the below steps(involves lot of work) to revert those settings.

• Download the disk to on-premise environment
• Create a VM, attach the disk
• Change the firewall setting to allow the RDP traffic or enable the Remote Desktop Services
• Re-upload the disk to Azure and create a new Windows Azure Virtual Machine.

12) Platform updates to VM, restarts, shutdowns.

Windows Azure updates the host OS approximately once in every 1-3 months to keep the environment secure for all applications, virtual machines running on the platform. This update process may result in your VM to restart. You can use availability sets to ensure high availability for your applications running on virtual machines. Managing the high availability is detailed here. Mark Russinovich has posted a great blog post which explains Windows Azure Host updates in detail.

In addition to platform updates, Windows Azure service healing occurs automatically when the Windows Azure detects problematic nodes and moves these VMs to new nodes. When this occurs, you loose connectivity to VM during the service healing process and after the service healing process is completed, when you connect to VM, you will likely to find a event log entry indicating VM restart/shutdown (either gracefully or unexpected)

We recommend you to use availability groups to ensure high availability for your applications running in the VMs. Guidance for managing availability using availability sets can be found here

13) VM activations

While activating the OS on windows azure virtual machines, you may run into an error message stating the “A problem occurred when Windows tried to activate” Error Code 0xC004F074 with below details

Code:
0xC004F074
Description:
"The software licensing service reported that the computer could not be activated. No key management service could be contacted"

We are aware of this issue and working towards resolving this issue. Please note that activation status does not impact the services running on the server. Not activating will generate persistent notifications reminding you to activate the server. Services and remote administration are not affected.

Refer to forum post for more details.

Update: Platform bug has been identified and fixed to resolve this issue. If you are still seeing this issue, it is possible guest firewall is preventing connections to activation server. Try disabling the guest firewall and re-enable after activation is complete.

1. A registry export of  “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform” for backup purposes

2. Disable the Windows Firewall by running the command “netsh advfirewall set allprofiles state off” and proceed with activation by executing “SLMGR –ATO"

3. Re-enable the firewall after activation is completed by running the command “netsh advfirewall set allprofiles state on”

14) Production workloads and support during Windows Azure Virtual Machines “Preview”.

While some customers have chosen to run production workloads on Windows Azure Virtual Machines, we currently do not recommend that because the feature is still in preview and meant for testing workloads so that they can be migrated easily to Virtual Machines after the feature is moved to GA(General Availability) status.

Also note that during the preview, support is provided via forums only. Support issues should be posted to one of the following forums:

Windows Azure Virtual Machines for Windows
Windows Azure Virtual Machines for Linux
Windows Azure Virtual Machines Virtual Network
Windows Azure Virtual Machines for SQL Server

Update: Windows Azure Virtual Machines went into General availability status on 16th April 2013. For any issues related to Virtual Machines, please contact Windows Azure Support

15) Status of VMs after Windows Azure Virtual Machines reaches General Availability (GA) status

Because the Windows Azure Virtual Machines feature remains in preview, requirements may still change before it reaches general availability. We expect that VMs created during preview will continue to run after GA. Note that it is possible that guest OS requirements could change that may require updating the VM to remain supported.

Update: Windows Azure Virtual Machines went into General availability status on 16th April 2013. Virtual machines created before preview continued to work after the GA.

16) VM role Vs Virtual Machines

We have seen a few customers getting confused between “VM Role”, “Virtual Machines. In fact, few of them applied for “VM Role” access, but really wanted access for Windows Azure Virtual Machines. The confusion arises because of the naming convention and state of the two features

Virtual Machines – is part of IaaS offering (Stateful, Persistent) and currently in preview . (Update: Windows Azure Virtual Machines went into General availability status on 16th April 2013.)

VM role – is part of PaaS offering(Stateless, non-persistent) and works just like web role, worker role, but with a custom supplied OS image. This feature is currently in beta.

Below articles give you the overview of both features.

Overview of the Windows Azure VM Role
https://msdn.microsoft.com/en-us/library/windowsazure/gg433107.aspx
Virtual Machines
https://msdn.microsoft.com/en-us/library/windowsazure/jj156003.aspx

In a nutshell, if you’ve applied for access using old Silverlight portal, you’ve applied for “VM Role”. If you have used account management under new HTML5 portal, you’ve applied for “Virtual Machines”

17) Disks vs Images vs VHDs

Very often Windows Azure Virtual Machines users get confused by disks, vhds, images. I wanted to provide little information here. Below descriptions contains abstracts from this MSDN article.

VHD or Virtual Hard Disk

A VHD file is stored as a page blob in Windows Azure storage and can be used for creating images, operating system disks, or data disks in Windows Azure. You can upload a VHD file to Windows Azure and manage it just as you would any other page blob. VHD files can be copied or moved and they can be deleted as long as a lease does not exist on the VHD. For more information about page blobs, see Understanding Block Blobs and Page Blobs.

Disk

Disks are logical objects. You use disks in different ways with a virtual machine in Windows Azure. An operating system disk is a VHD that you use to provide an operating system for a virtual machine. A data disk is a VHD that you attach to a virtual machine to store application data. You can create and delete disks whenever you need to.

Note: When you create a disk and map to a VHD, lease is created on the mapped VHD. As long as there is a lease on VHD, it cannot be deleted. So often see customers who delete the VMs and then directly try to delete VHDs, but run into errors indicating there is a lease on the VHD. I’ve provided more details regarding this issue above(Point#2)

Image

An image is a VHD file that you can use as a template to create a new virtual machine. An image is a template because it doesn’t have specific settings like a configured virtual machine, such as the computer name and user account settings. You can use images from the Image Gallery to create virtual machines or you can create your own images.

Note: We often see customers trying to copy a VHD and create image based on the copied VHD. Creating an image requires you to perform sysprep on the OS. More details can be found here

18) Availability set & affinity groups, Connecting VMs – Three different, distinct purposes

Availability Set is a way to achieve high availability for your virtual machines. An availability set is a group of virtual machines that are deployed across fault domains and update domains. An availability set makes sure that your application is not affected by single points of failure, like the network switch or the power unit of a rack of servers. Guidance for managing availability using availability sets can be found here

Affinity groups are the way to group the services in your Windows Azure subscription that need to work together in order to achieve optimal performance.

When you create an affinity group, it lets Windows Azure know to keep all of the services that belong to your affinity group running at the same data center cluster. For example, if you want to keep the services running your data and your code together, you would specify the same affinity group for those services. That way, when you deploy those services, Windows Azure will locate them in a data center as close to each other as possible. This reduces latency and increases performance, while potentially lowering costs. Importance of affinity groups is described here

Connecting VMs – Load balancing

You group multiple VMs together under a single cloud service to distribute the load to multiple VMs. The way you group is during the second VM creation, you choose “Connect to Existing Virtual Machine” and then select the cloud service under which you wanted to group the VMs. This article details how to load balance virtual machines.

19) GA date?

At the time of publishing this blog there is no public announcement about the GA date. Our teams are working to launch GA at the earliest possible. Stay tuned to Windows Azure Portal for updated information.

Update: Windows Azure Virtual Machines went into General availability status on 16th April 2013.

Thanks to Abhuday Aggarwal, Avkash Chauhan, Corey Sanders, Craig Landis, Flavio Muratore for reviewing this blog post, providing valuable inputs.

We often hear from our Windows Azure customers who are using new preview feature “Windows Azure Virtual Machines” that they created a VM and one fine day, it suddenly disappeared or gone. I’m writing this post to give few details about the issue and what steps can be performed to recover from the situation.

Symptoms

You have created a VM and it worked fine for few days and all of a sudden VM is not being listed in the portal and it appears to be gone. There are two common reasons we see why the VMs are deleted.

Reason#1 VM is created under a trial subscription and the trial quotas are reached

This is by design behavior to ensure your account is not billed after the quotas are reached. Trial quotas are documented here. If the VMs are deleted due to quotas, an email will be send to account administrator and also, you can navigate to account.windowsazure.com to verify if the quotas are indeed reached.

Note: New preview portal now gives notification message when the trial period is about to end. 

Workaround: Though the VMs are deleted to ensure the account is not billed, the data(VHDs) itself is persisted to Windows Azure Storage and we can use these VHDs/Disks to create a new VM. To create a VM based on the disk, use the following steps. Also ensure that you enable charges on your subscription before you follow these steps so that you will not encounter the same problem again.

• Navigate to new preview portal (Note: if you are using the OrgId, you need to append the OrgId to the URL)
• Choose “Virtual Machines” , Select “New”
• Select “From Gallery” , Select “My Disks”
• Select the disk that was created for previous VM(which was missing from the list)
• Follow the wizard to complete other steps to create virtual machine.

Note: 1) If you do not see the disk in the list, it is possible that lease on VHD is not removed. You can follow this thread to break lease on the VHD.

2) To use the DNS name that was created for original VM, you need to delete the cloud service before creating the new virtual machine. Otherwise, you would get an error stating DNS name is already in use.

*** Efforts are in progress to improve the user experience for this issue.***

Reason#2 User performed capture operation on a VM

This is by design too. Capture operation is meant to create an image(or template) based on which multiple VMs can be created. Part of the process involves user to sysprep the VM which strips out system specific information (i.e. system name, etc.) from VM , so that it can be used as an Image. Since the system specific information is removed, VM cannot continue as-is. To create a new VM based on the image which was captured, use the following steps.

• Navigate to new preview portal (Note: if you are using the OrgId, you need to append the OrgId to the URL)
• Choose “Virtual Machines” , Select “New”
• Select “From Gallery” , Select “My Images”
• Select the Image that was created using “Capture” operation
• Follow the wizard to complete other steps to create virtual machine.

 I've posted another blog post about Windows Azure Virtual Machines - common issues, questions, gotchas that may be helpful.

Applies To : Windows Azure Virtual Machines

Key words : VM is missing, VM gone, Virtual Machine, Disappeared, Windows Azure

Tried to publish Windows Azure Service using Publish option in Visual Studio
or
Tried to create a service package using Package option in Visual Studio

Result

Package creation fails with similar messages to below in Visual Studio output window

Build started: Project: TestApp, Configuration: Release Any CPU ------
TestApp -> C:\Projects\TestApp\TestApp\bin\TestApp.dll
Build started: Project: TestApp.Azure, Configuration: Release Any CPU ------
Publish started: Project: TestApp.Azure, Configuration: Release Any CPU ------
Transformed Web.config using Web.Release.config into obj\Release\TransformWebConfig\transformed\Web.config.
Done building project "TestApp.Azure.ccproj" -- FAILED.

Build FAILED.
========== Build: 2 succeeded or up-to-date, 0 failed, 0 skipped =========
========== Publish: 0 succeeded, 1 failed, 0 skipped ================

Symptoms

• Issue does not occur for sample, small applications.
• There is no message box displayed detailing the exception other than the “Build Failed” message in VS output window

Cause

In most of the cases, issue seems to be occurring due to the OutOfMemoryException in devenv process. If you were to attach a debugger to devenv process which is building the package and troubleshoot the issue, you would see exception similar to below

Microsoft.Build.Shared.InternalErrorException was unhandled
Message=MSB0001: Internal MSBuild Error: Exception of type 'System.OutOfMemoryException' was thrown.
=============
System.OutOfMemoryException: Exception of type 'System.OutOfMemoryException' was thrown.
at System.IO.MemoryStream.set_Capacity(Int32 value)
at System.IO.MemoryStream.EnsureCapacity(Int32 value)
at System.IO.MemoryStream.Write(Byte[] buffer, Int32 offset, Int32 count)
at MS.Internal.IO.Packaging.PackagingUtilities.CopyStream(Stream sourceStream, Stream targetStream, Int64 bytesToCopy, Int32 bufferSize)
at MS.Internal.IO.Packaging.SparseMemoryStream.WriteToStream(Stream stream)
at MS.Internal.IO.Zip.ZipIOFileItemStream.Save()
at MS.Internal.IO.Zip.ZipIOLocalFileBlock.Save()
at MS.Internal.IO.Zip.ZipIOBlockManager.SaveContainer(Boolean closingFlag)
at MS.Internal.IO.Zip.ZipIOBlockManager.SaveStream(ZipIOLocalFileBlock blockRequestingFlush, Boolean closingFlag)
at MS.Internal.IO.Zip.ZipIOModeEnforcingStream.Dispose(Boolean disposing)
at System.IO.Stream.Close()
at System.IO.Packaging.PackagePart.Close()
at System.IO.Packaging.Package.DoClose(PackagePart p)
at System.IO.Packaging.Package.DoOperationOnEachPart(PartOperation operation)
at System.IO.Packaging.Package.System.IDisposable.Dispose()
at Microsoft.ServiceHosting.Tools.Packaging.PackageCreator.CreateRolePackages(ModelProcessor modelProcessor, PackageManifest applicationManifest, Package applicationPackage)
at Microsoft.ServiceHosting.Tools.Packaging.PackageCreator.CreatePackage(Stream outputStream)
at Microsoft.ServiceHosting.Tools.Packaging.ServiceApplicationPackage.CreateServiceApplicationPackage(String serviceModelFileName, String serviceDescriptionFile, Stream output, IPackageSecurity encrypt, Dictionary`2 namedStreamCollection, String userInfo, EventHandler`1 rolePackagePartAddedHandler)
at Microsoft.ServiceHosting.Tools.MSBuildTasks.CSPack.TryCreatePackage(ServiceDefinitionModel sm)
at Microsoft.ServiceHosting.Tools.MSBuildTasks.CSPack.Execute()
at Microsoft.Build.BackEnd.TaskExecutionHost.Microsoft.Build.BackEnd.ITaskExecutionHost.Execute()
at Microsoft.Build.BackEnd.TaskBuilder.ExecuteInstantiatedTask(ITaskExecutionHost taskExecutionHost, TaskLoggingContext taskLoggingContext, TaskHost taskHost, ItemBucket bucket, TaskExecutionMode howToExecuteTask, Boolean& taskResult)
at Microsoft.Build.BackEnd.TaskBuilder.InitializeAndExecuteTask(TaskLoggingContext taskLoggingContext, ItemBucket bucket, TaskHost taskHost, TaskExecutionMode howToExecuteTask, Boolean& taskResult)
at Microsoft.Build.BackEnd.TaskBuilder.ExecuteBucket(TaskHost taskHost, ItemBucket bucket, TaskExecutionMode howToExecuteTask, Dictionary`2 lookupHash)
at Microsoft.Build.BackEnd.TaskBuilder.ExecuteTask(TaskExecutionMode mode, Lookup lookup)
at Microsoft.Build.BackEnd.TaskBuilder.ExecuteTask(TargetLoggingContext loggingContext, BuildRequestEntry requestEntry, ITargetBuilderCallback targetBuilderCallback, ProjectTargetInstanceChild taskInstance, TaskExecutionMode mode, Lookup inferLookup, Lookup executeLookup)
at Microsoft.Build.BackEnd.TargetEntry.ProcessBucket(ITaskBuilder taskBuilder, TargetLoggingContext targetLoggingContext, TaskExecutionMode mode, Lookup lookupForInference, Lookup lookupForExecution)
at Microsoft.Build.BackEnd.TargetEntry.ExecuteTarget(ITaskBuilder taskBuilder, BuildRequestEntry requestEntry, ProjectLoggingContext projectLoggingContext)
at Microsoft.Build.BackEnd.TargetBuilder.ProcessTargetStack(ITaskBuilder taskBuilder)
at Microsoft.Build.BackEnd.TargetBuilder.BuildTargets(ProjectLoggingContext loggingContext, BuildRequestEntry entry, IRequestBuilderCallback callback, String[] targetNames, Lookup baseLookup)
at Microsoft.Build.BackEnd.RequestBuilder.BuildProject()
at Microsoft.Build.BackEnd.RequestBuilder.BuildAndReport()
at Microsoft.Build.BackEnd.RequestBuilder.RequestThreadProc()

Resolution

• If you have a 64 bit machine, easiest option to resolve the issue would be by creating a package using 64 bit high-end hardware machine. 64 bit machines will provide more system resources to application compared to 32 bit machines.
• If you do not have 64 bit machines, you can try stopping as many as services, programs you can and allow Visual Studio to use more memory to resolve the issue. If you are still getting the issue with bare minimum programs/services running on the machine, it is highly unlikely you can resolve the issue using 32 bit machines. I suggest using 64 bit machines.

Applies To:

Windows Azure SDK 1.6

Hope this helps!

Keywords: Windows Azure, Build Failed, Visual Studio, Package, Publish

Application using Windows Azure Cache has encountered "DataCacheException:ErrorCode<ERRCA0016>:SubStatus<ES0001>"

Symptoms

• Application is using Windows Azure Cache

• Intermittently or while storing larger objects, One of the below errors are encountered

[DataCacheException:ErrorCode<ERRCA0016>:SubStatus<ES0001>:The connection was terminated, possibly due to server or network problems or serialized Object size is greater than MaxBufferSize on server. Result of the request is unknown.]

[DataCacheException:ErrorCode<ERRCA0017>:SubStatus<ES0006>:There is a temporary failure. Please retry later. (One or more specified cache servers are unavailable, which could be caused by busy network or servers. For on-premises cache clusters, also verify the following conditions. Ensure that security permission has been granted for this client account, and check that the AppFabric Caching Service is allowed through the firewall on all cache hosts. Also the MaxBufferSize on the server must be greater than or equal to the serialized object size sent from the client.)]

Cause

Size of the object application is trying to store in Windows Azure Cache is more than 8 MB. As of now, Windows Azure Cache supports objects only up to 8 MB and size is measured post the serialization.

Resolution

Before storing the objects in Windows Azure Cache, serialize the object and find out the size of it and if the size is above 8 MB, split the object into smaller chunks, may be byte arrays, etc and then store the byte arrays in Cache.

References

API Reference for Windows Azure Caching
https://msdn.microsoft.com/en-us/library/windowsazure/gg278350.aspx

Capacity Planning for caching in Windows Azure
https://msdn.microsoft.com/en-us/library/windowsazure/hh689719(v=VS.103).aspx

Maximizing Scalability,Availability, and Performance
https://msdn.microsoft.com/en-us/library/hh868048.aspx

DevFC , DFAgent are crashing with a message stating "stopped working"

Symptoms

• Using latest Windows Azure SDK 1.6, tried to debug a sample application and getting two dialog boxes stating DevFC stopped working, DFAgent stopped working.
• DFAgent.log has below exception details

[2012/02/17, 10:35:26.706,  INFO, 00004648] StorageRoot: c:\dftemp
[2012/02/17, 10:35:26.735,  INFO, 00004648] Exception has been thrown by the target of an invocation.
[2012/02/17, 10:35:26.770,  INFO, 00004648]    at System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
at System.RuntimeMethodHandle.InvokeConstructor(Object[] args,SignatureStruct signature, RuntimeTypeHandle declaringType)
at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlagsinvokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
at System.Security.Cryptography.CryptoConfig.CreateFromName(String name,Object[] args)
at System.Security.Cryptography.MD5.Create(String algName)
at System.Security.Cryptography.MD5.Create()
at Microsoft.Windows.Azure.Fabric.Cfx.Tracing.CfxTraceSource.Init(StringtraceName, String directory, Guid providerGuid, CfxFileUploader uploader,Boolean enable)
at Microsoft.Windows.Azure.Fabric.Cfx.Tracing.CfxTraceSource..ctor(StringtraceName, String directory, Guid providerGuid) at main(Int32 argc, SByte** argv)

Cause

Local security policy “Use FIPS compliant algorithms for encryption, hashing and signing Properties” is enabled on the machine we were troubleshooting and MD5 algorithm is not compatible with this policy and hence resulting in unhandled exception

Resolution

Disable "System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing" policy. (Disabled is default option)

To disable FIPS compliant algorithms, follow these steps:

1.  In Control Panel, double-click Administrative Tools .
2.  In Administrative Tools , double-click Local Security Policy . 
3.  In Local Security Policy , expand Local Policies , expand Security Options , and then double-click System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing .
4.  In the System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing Properties dialog box, click the Local Security Setting tab.
5.  On the Local Security Setting tab, click Disabled , and then click OK . 
6.  Close Local Security Policy.

More Info

If the development environment is Visual Studio 2010, below error is displayed during the compilation stage itself.

error CS1504: Source file 'c:\users\user\documents\visual studio 2010\Projects\TempRole\WebRole1\Properties\AssemblyInfo.cs' could not be opened ('This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.')

System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing

https://technet.microsoft.com/en-us/library/cc780081(v=WS.10).aspx

https://support.microsoft.com/kb/811833

Key words: DevFC, DFAgent, FIPS, MD5, Windows Azure, SDK 1.6

ErrorCode<ERRCA0017>:SubStatus<ES0006>:There is a temporary failure. Please retry later. (One or more specified cache servers are unavailable, which could be caused by busy network or servers. For on-premises cache clusters, also verify the following conditions. Ensure that security permission has been granted for this client account, and check that the AppFabric Caching Service is allowed through the firewall on all cache hosts. Also the MaxBufferSize on the server must be greater than or equal to the serialized object size sent from the client.)

Thanks to "Transient fault handling application block" from patterns & practices team. It is now very easy to implement sophisticated retry logic in your application. I'm describing the instructions in 3 steps here.

1. Add the Transient Fault Handling Application Block to your application
1. Install latest version of NuGet from here https://nuget.org/.
2. Add a reference to the Transient Fault Handling Application Block assemblies. In Microsoft Visual Studio, right-click your project node in Solution Explorer, and then click Manage NuGet Packages.
3. Click the Online button, and then in the Search Online box, type topaz.
4. Click the Install button for the Enterprise Library 5.0 - Transient Fault Handling Application Block package.
5. Read and accept the license terms for the packages listed.
6. After NuGet has finished installing the packages, click Close.
7. NuGet has now updated your project with all the necessary assemblies and references that you need to use the Transient Fault Handling Application Block. The project now also includes a readme file that contains important information about the Transient Fault Handling Application Block.
2. Configure retry policy for your application.
   //Add below using statements to your project/module.

   using Microsoft.Practices.TransientFaultHandling;
   using Microsoft.Practices.EnterpriseLibrary.WindowsAzure.TransientFaultHandling;
   using Microsoft.Practices.EnterpriseLibrary.WindowsAzure.TransientFaultHandling.Cache;

    // I've defined retryStrategy, retryPolicy in page_load event. It is really up to your application requirement where you would like to define these

    // Define your retry strategy: in this sample, I'm retrying operation 3 times with 1 second interval
    var retryStrategy = new FixedInterval(3, TimeSpan.FromSeconds(1));

    // Define your retry policy here. This sample uses CacheTransientErrorDetectionStrategy
    var retryPolicy = new RetryPolicy<CacheTransientErrorDetectionStrategy>(retryStrategy);

    

3. Make azure cache calls inside ExecuteAction delegate as shown below.

          // Get notifications from retries from  Transient Fault Handling Application Block code

               retryPolicy.Retrying += (sender1, args) =>

               {

                   // Log details of the retry.

                   var msg = String.Format("Retry - Count:{0}, Delay:{1}, Exception:{2}",

                       args.CurrentRetryCount, args.Delay, args.LastException);

                   //Logging the notification details to the application trace.

                   Trace.Write(msg);

               };

               

               DataCache m_cache = CacheUtil.GetCacheConfig();

    

               try

               {

                   //In order to use the retry policies, strategies defined in Transient Fault Handling Application Block , user calls to cache must be wrapped with in ExecuteAction delegate

                   retryPolicy.ExecuteAction(

                       () =>

                       {

                          //I'm just storing simple string object here .. Assuming this call fails, this sample retries the same call 3 times with 1 second interval before it gives up.

                           m_cache.Put("MyDataSet", "StoreString");

                           //Getting the object from azure cache and printing it on the page.

                           Response.Write(m_cache.Get("MyDataSet"));

                       });

                                   

               }

               catch (DataCacheException dc)

               {

                   // Exception occurred after implementing the Retry logic.

                   //Ideally you should log the exception to your application logs and show user friendly error message on the webpage.

                   Trace.Write(dc.GetType().ToString() + dc.Message.ToString() + dc.StackTrace.ToString());

               }

    

    

Download the sample source code here

References

Windows Server AppFabric Caching - Table of Error Code Strings
https://msdn.microsoft.com/en-us/library/ff921008.aspx

Exception Handling Overview (Windows Server AppFabric Caching) – Also applicable to Azure AppFabric Caching
https://msdn.microsoft.com/en-us/library/ff637738.aspx

Handling Errors
https://msdn.microsoft.com/en-us/library/ff637704.aspx

Application Exceptions (Windows Server AppFabric Caching)
https://msdn.microsoft.com/en-us/library/ff921006.aspx  

Transient Fault Handling
https://msdn.microsoft.com/en-us/library/hh680901(v=PandP.50).aspx

Post your comments, feedback using comments section below!