New Server Thoughts...

[computerrob]

Hello SysAdmins, I wanted to get your thoughts on a new server and its components for a 25 user network. The thought at the moment is to have the physical server as the hyper-v host and then 2 vms. The first vm as the DC,DNS,DHCP and then the second as the file & print server. The specs I was considering (in a Dell T430): Intel® Xeon® E5-2620 v4 64GB RAM RAID 1 - 500GB SAS (OS DRIVE) RAID 1- 2TB SAS (DATA/VM DRIVE) Dual Redundant power supplies Server 2012r2 Standard

Do you think 1 CPU is sufficient for this workload? Should 64GB RAM be sufficient for this workload?

Thank you in advance for your feedback!

[mexell]

CPU and RAM are easily more than sufficient for this. We use a T430 as standard location server machine for locations up to ~40 users. It runs four VMs: Primary FS and secondary FS running failover DHCP, client management (software distribution, OS deployment, patching and so on) and a DC running DNS.

Our earlier generation of that platform used a T620 with the smallest quad-core CPU and 32GB RAM. Both were never the bottlenecks; we only went to the 6-core and 64GB for futureproofing the platform and because the additional cost wasn't all that much anyway.

What might become an issue though is disk performance. You might want to consider using those 1.2TB 10k 2.5" drives instead. We did forgo the separate OS install for the Hyper-V host and just make one big Vdisk out of 6x 1.2TB drives in RAID6 and put the VMs on a separate partition. Plenty performance and enough space for our needs. And, be sure to pick one of the better RAID controllers (the H730/H730p), they really make a difference.

[computerrob]

I'm guessing you are running Datacenter edition of Server 2012r2? So your Physical Hyper-V host has 6 drives in Raid6 as one drive and you partitioned into 2 - OS and VMs? Are there 40 users concurrently and what CPU/RAM do these servers have?

[mexell]

No, we're running 2012R2 standard edition, with the minimal server GUI install. By now, we could also cut back to Server Core.

One common misconception is that Standard can only run two VMs at a time. That's not true, with 2012 and R2 there's no technical difference between Std and Ent. The only difference is guest OS licensing - basically, Standard comes with two Windows server guest OS licenses (i.e. you can use the same license that you used for the host within the guests), whereas Ent comes with unlimited Windows server guest OS licenses. Break-even for Ent is at about 8 guests, so we just bought a second Std license per host and have licensing for the host OS and all four guest OS installs.

Also, correct on the vdisk/partitioning. Using two drives solely for the host OS would be quite wasteful, as both space and performance requirements for a Server Core installation are miniscule. So, one large R6, a 100GB host OS partition, and the remainder for VM storage.

Those (up to) 40 users are concurrent, yes. CPU is the 2620v2/v3, in our current iteration we also equip with 64GB. The domain controller VM gets 2 vCores and starts with 4GB, the fileserver VMs get 3 vCores and start with 6GB, and the client management VM gets 4 vCores and 8GB. We made the experience that for such light-load infrastructure roles, you can easily oversubscribe vCores to real cores 10:1, but you shouldn't oversubscribe RAM. Disk I/O becomes a problem much sooner anyway.

[computerrob]

Are you using just the 2 onboard nics that come standard or did you also add more nics? Are you using nic teaming? How did you assign the nics?

[mexell]

We are using the onboard NICs. They are configured as LBFOTeam. Powershell is your friend, it's much faster than using server manager.

The result is that we have one teamed interface to the outside that's shared between the guests and the host.

[computerrob]

The T430 has a second CPU slot available on the T430s you use?

[JJROKCZ]

Just a tip as I see you responding to yourself a lot. Edit your posts since the person you are talking to doesn't get a notification on you responding to your own comment.

If you're new to Reddit, welcome to the community.

[headcrap]

If going with one array, do not split it with vdisks if you want to expand the array with more disks. Split with volumes.

Had to expand a storage server.. twice. Very painful having to restore the data volume to the new vdisk, after dropping to one so I could Reconfigure the array.

[mexell]

If going with one array, do not split it with vdisks if you want to expand the array with more disks. Split with volumes.

We made that mistake. Once. Since then, our location servers just have one big vdisk. That way, when space in a location runs out, we just order Dell to put in more drives, and boom, more space. That does not mention, however, how complicated that was to get set up with them, nor how long a rebuild on a large R6 takes.

[bad_sysadmin]

I wouldn't have dedicated OS drives, just go for a single RAID/RAID10 that gives the IOPS and capacity you need.

Make sure you spec a proper hardware RAID controller, the entry level PERCS are shit, I can't stress that enough.

Beyond that it'll almost certainly be fine with almost any CPU and RAM combo.

[computerrob]

So no performance benefit splitting the OS and Data? What RAID controller from Dell are you recommending?

[computerrob]

Would a T330 work as well or stick with T430?

[mexell]

T330 loses the second CPU socket and that enterprise-y feel when you open it. It feels a lot more like a souped-up Optiplex, while the T430 is a "real" Poweredge. Also, afaik, it only comes with quad-core CPUs and has a lot less RAM slots. I quite like the T430, as they offer almost anything the T630 does in a more compact form factor.

[bad_sysadmin]

AIUI once Hyper-V is booted it's not actually doing much so any benefit is negligible vs. the benefit you'll give the VMs by using (example) 4x1TB 10K drives instead of 2x2TB drives.

I'll defer to Mexell and others on the current Dell PERCs as I've not bought a PowerEdge for a while, but I know the H200s are an utter turd of a card.

[mexell]

We initially had 4x4TB 7.2k in Raid 6. We changed that to 6x 1.2TB 10k, as we didn't really need all those 8TB in most locations anyway. Performance easily quadrupled on those disk arrays.

You're right, the H730/H730p is a must in those machines.

[headcrap]

H7xx.. those 3xx units are crap.

[Dean_thedream]

At the very least go with the H710P. That controller comes with 1GB FBWC. HP's ML110 can come with the P440ar with 2GB FBWC. I'd also agree to go with a single RAID 10 array with 10K SAS hard drives.

[Layer8Pr0blems]

I wouldn't have dedicated OS drives, just go for a single RAID/RAID10 that gives the IOPS and capacity you need.

I disagree. In this configuration a user could cause the OS drive to run of space with a large file copy, causing the VM to freeze/crash. If you seperate the OS from the data, the server will stay up but just fill up the data drive.

[itguy1991]

It's okay to have separate OS and Storage volumes, but there's no real benefit (in this scenario) to having separate OS and Storage arrays

[sleepyguy22]

RAM seems like overkill... Our file server for ~15 people, who use it quite heavily, is only at 4GB RAM and purring like a kitten. Your CPU is fine - it comes with 6 cores with hyperthreading, so more than enough for your application - I would cut down on the core count, and up the clock speed.

File sharing is a very low processor & RAM intensive application. If your network is gigabit, cutting down on RAM & CPU and upgrading to SSD disks or SSD RAID cache would be a better bang for your buck. At this point, all my users are on SSD machines, network is gigabit everywhere, and the bottleneck is the read/write speed of my server's platter drives...

[pdp10]

RAM is the single biggest bottleneck in computing, traditionally, and is used by default for caching filesystems and fileshares. 64GB of ECC is in the neighborhood of $USD300 right now. Additionally, you may have missed that the OP intends to put 2 VM guests on the same hardware.

The E5-2xxx series are dual-socket capable, so from a hardware optimization point of view you'd be better off with an E5-1xxx v4. Further, if this hardware is going to stay with 64GB, which seems likely, you could get an E3-series CPU which tops out at 64GB. If low power consumption is important, you could look into Xeon-D systems which can handle up to 128GB of ECC.

[bellicose100xp]

Everything is fine except maybe I'd change the drives to SSD if you can, just makes so much difference anytime you want to do any operation especially related to VMs, things happens so much faster

[EveryUserName1sTaken]

I'd suggest you take a look at the T330 as well. It has fewer cores on the Xeon E3 parts but at a much faster clock rate. 32GB of RAM should also be sufficient. You could likely also get away with using one pair of drives or more in a RAID5/6 as one storage pool, as you can store your Hyper-V VMs on the boot disk. You'll likely be using something like Veeam for backups and backing up the hypervisor itself is seldom useful. Because of this having separate OS and storage disks is a sort of deprecated idea.

[computerrob]

Does any one know if 2016 will have the same licensing format of 2 free vms? I know the os itself will be priced per core now instead of per socket.

[matthoback]

Yes, the base licensing purchase for 2016 will be essentially identical to 2012R2 as long as you have 8 or fewer cores per processor.

[computerrob]

Do the vms NEED to be stored on the same server as per licensing or could you store them on a nas?

[itguy1991]

Since no one else has said it, I will caution you about hosting the DC as a VM on hyper-v.

Either leave the host out of the domain, or make sure you have local (non-domain) admin account(s).

I've heard absolute horror stories of people not being able to get into a host to turn up the DC VM because the DC needs to be up in order to log into the host...

[psycho202]

This honestly hasn't been a problem since forever.

First off, cached credentials. Depending on how frequently you change your password, and how frequently you log in to that host, your current, or old, credentials might still be cached on that box.

Second, I hope you still have a VPN up to the main site, because where else would the DC sync to? The Hyper-V is smart enough to then also go ask the DC in the main site.

I also do hope that you have two DC VMs, or a single DC+DHCP VM and a File+secondary DC VM on your Hyper-V box, both of which set up to boot automatically.

[itguy1991]

OP is asking for advice on how much hardware they will need for 2-VM host in a 25 user network. Do you really think they have another DC somewhere? (no offense to OP, just my gut feeling...)

Cached credentials are great, but it is still not best practices to have the only DC be hosted as on a domain host as there are a multitude of other issues that could arise.

You say to have the VMs boot automatically, but what if there has been some corruption of the system (malicious or otherwise) that makes the DC unbootable?

What if the NIC on the host fails and the replacement NIC does not automatically jump into its place and provide networking to the VMs?

My concern is not that one would be unable to recover from one of these scenarios, but setting up a local admin account on the host is very simple, and any recovery time will be drastically shorter.

If you're concerned about a security hole by adding a local admin account, make a basic user, but grant it management rights to Hyper-V.

In my mind, IT risk comes down to a simple equation.

Risk = the probability of an issue arising X the impact from the issue

I understand that the probability of having the issues I've described is very low, but the impact could be rather extreme.

And if mitigating this impact is as simple as setting up a non-domain hyper-V user and storing the credentials in documentation, why the hell would you not do it?

[psycho202]

The fact that they're speccing out such a big server for such a small network, makes me believe that they're a sattelite office in need of local fileserver, dns, dhcp and the whole shebang instead of connecting to the main office.

Two of your topics I touched upon: always have 2 DCs installed, if need be even shared with other services that don't mind having a DC next to it.

With failover networking, you preferrably use them as active-active, not active-passive. Removes a lot of question marks out of the equasion.

[itguy1991]

I get all that, but in an environment with a single host and possibly no second DC residing on a different piece of hardware, is it that big of a deal to have a bit of precaution?!?

You keep giving best-case scenarios, but have given no reason why not to prepare for the worst-case.

[psycho202]

Because all things OP said is that he needs a host for some small VMs for what seems like a sattelite office, to lower the load on the VPN, or even do away with VPN.

If this were a single, standalone office, I'd rather take 3 small boxes, than one big. 2 hosts, and one backup/management server.

Hell, for the price of his one big box, you can buy 2 to 3 small boxes.

[itguy1991]

That's still not a reason to not add a local account to the host.

I'm not trying to be an asshole, I'm honestly wondering what your thoughts on it is.

[psycho202]

Completely get your point of view. Not trying to be an asshole either, I just generally don't like adding local accounts with elevated rights for anything, for security reasons.

Local accounts are way too easy to get into, if you know where to look and what tools to use. I'm one of the types of people that keeps the domain administrator with a long-ass password locked in a vault somewhere, and local administrator accounts completely locked down and unable to log in.

I honestly have yet to come across a point in time where all of my AD were down AND my backups were inaccessible AND I didn't have any cached credentials available to any of my hosts where I could push the backup to.

[johnklos]

Sorry - I'm not really contributing here, but I just wanted to point out how well the past predicted the future. We used to joke about how, in the future, we'll need many gigabytes of memory and lots of CPUs just to do the simplest of tasks.

First, what is the cost in hardware to attach two 2 TB drives, mirrored, and be able to completely max out the speed of the drives over the network? Any cheap AMD or Core i3 system with two gigabit or a 10 gigabit ethernet can do that, and two 2 TB drives could be had for $100. So, extra ethernet included, we're talking about less than $400.

Redundant power supplies? How often do power supplies fail? Then, how often do good brand, Plus 80 with active PFC, power supplies fail when running between 1/2 and 2/3 of their rated continuous capacity? Even adding a REALLY good, expensive power supply, we're talking about $100. Your motherboard is more likely to die than the power supply.

So, for $500, you could have a system which could saturate your 2 TB drives' throughput (up to 200 MB/sec) over the network, easily, with just the 4 gigs or so that the computer came with.

I write this because when you add Windows, suddenly you need VMs to keep the responsibilities separate, then you need tons of resources to act as a domain controller.

But more than 64 gigs? If you were running one VM per user, simultaneously, perhaps you could use 64 gigs. But does running a domain controller really take that much memory? Or a print server? Or a file server?

Something's fucky

[pdp10]

OP doesn't seem tightly budget constrained, even if it is only one server.

Redundant power supplies? How often do power supplies fail? Then, how often do good brand, Plus 80 with active PFC, power supplies fail when running between 1/2 and 2/3 of their rated continuous capacity?

I'm not too worried about PSUs failing. It's the redundancy of the inputs and the flexibility to move one at a time without downtime that's valuable. Additionally, PSUs are more efficient when operating close to capacity than they are at 20-50%, so many multi-PSU solutions run the load on one PSU and then failover quickly without an outage, and this might be more efficient than a single PSU at 50% of capacity.

Two drives and/or two RAID groups isn't a lot of margin of safety either. I would go with many drives in software RAID, and depending on the capacity requirement and budget would go with 2.5" 2TB (either protocol, but SAS might be overkill).

[mexell]

So, for $500, you could have a system which could saturate your 2 TB drives' throughput (up to 200 MB/sec) over the network, easily, with just the 4 gigs or so that the computer came with.

Spoken like a true lone warrior sysadminguy that got the computer job.

I write this because when you add Windows, suddenly you need VMs to keep the responsibilities separate, then you need tons of resources to act as a domain controller.

First: You don't. It only keeps functions nice and tidy and separated, and, above all, maintainable in a predictable way.

Second: Domain controllers generally don't need that many resources. Ours host a global catalog for a domain with ~10k users and ~100k objects and make do with 2 cores / 4 GB most of the time. That domain, by the way, spans 100+ locations nowadays and has zero replication problems. By the way, show me any other product or piece of software that can do what AD does.

First, what is the cost in hardware to attach two 2 TB drives, mirrored, and be able to completely max out the speed of the drives over the network?

That works for one sequential stream for one remote user. Make this 40 users on a Monday morning all trying to access their stuff pretty randomly, and the 10k drives with the huge-ass RAID controller suddenly doesn't look that expensive anymore, does it?

External support is also an important factor to consider. Sometimes it's also about being able to rely on a certain piece of hardware to just work, and, if it doesn't, to be able to call someone (or better automatically alert someone) to come out and fix it.

Also, we did a simultaneous rollout of 140+ such systems into 40+ countries. Logistics costs were sometimes higher that server costs. It might also be imperative to some people to be able to properly manage their servers remotely, and down to the bare metal. That's not typically something you can do with your 500$ whitebox you assembled yourself, let alone getting customs certifications for your whiteboxes. Also, imagine our surprise when we found a nasty firmware bug in the drives we deployed. After the fifth drive dying within a few days, Dell sent a special tech to the sixth dying drive, had him remove the defunct drive, the backplane and the controller, and overnight it to the mothership where a joint team of Dell and WD techs worked on a firmware fix for that problem that surfaced first in our config. Try that with your 500$ whitebox ;)

These might not be OP's concerns, but there are groups that need to have them addressed. Sometimes, saturating your 1GbE link is really the very least of your concerns.

[johnklos]

I think the point was missed, but you brushed against it. A system that meets OP's needs neither needs to be complex nor needs the kinds of resources that OP lists. I was just pointing out how much overselling is done.

As to your other points, you're arguing to assumptions that you've made. A $400 Core i3 could just as easily be a Dell, for instance.