Forensics is not really a question of snapshots or not. The question is what data you wish to get…. If you only want ‘INDISK’ data then that can be gotten by powering off the VM (as if you were pulling the plug) and duplicating the virtual disk contents, by mounting it to a read-only disk copying appliance. However, if you want a richer set of data then you also want all the files created with the VM whether they are snapshot, memory, disks, nvram, etc. Then the VM can be recreated, etc. Snapshots can be of use even in this case, but for the ‘INDISK’ case they are not even considered.

When preparing for forensics, where you store each of these files (snapshot, memory, disk, config) is more important than anything. You also need to understand how the underlying file system on which these sundry files are written so you can get all the proper information (as is the case for VMFS).

Best regards,
Edward

If all your hosts have the same chipset when you enable EVC it is an issue of finding the proper EVC mode for those hosts. In my case the EVC mode I needed was to mask off Westmere specific functionality…. This should work for all ‘like-to-like’ hosts. I.e. all mine are the same brand, chipset, CPUs, etc. If something does not match, then enabling EVC may be more difficult.

I also did not add hosts into a new cluster. I enabled EVC on the existing cluster. Granted I am running vCenter 5, but vSphere 4, perhaps there is something new there with respect to EVC. Or perhaps since all the CPU and chipsets match, then all VMs have the same elements presented to them therefore enabling EVC was easy to do.

My goal is to just add a new host into my EVC enabled cluster. But prior to vCenter 5, my experience was to reboot all the VMs as well. Unfortunately, I never tried to perform this action before upgrading vCenter!

Best regards,
Edward L. Haletky

You won’t always be able to add hosts into an empty cluster with any EVC mode enabled with powered on VMs. This is because the vCPU presented to your VMs already have any/all masks presented to them. In order to change those maskings (depending on the desired EVC mode) you would need to power off all VMs on that host.

Using a different EVC mode as Edward states seems to work for that particular chipset/EVC mode, but it definitely won’t work for all. I have ran into this multiple times and no EVC modes would enable without powering off of VMs.

It was even easier than that, I was able to successfully set the EVC mode to Westmere without doing anything on the running cluster. Since all three blades are identical, this works just fine. THe problem will be to ensure its set to Westmere on the new blade. So it is possible to set it up on a Cluster with running VMs but you need to mask off anything ABOVE your current chipset. Since I do not currently have Westmere, I masked off Westmere and viola it worked.

Best regards,
Edward

1. Add/Move host to Datacenter level out of a cluster.
2. Move host to EVC enabled cluster.

I am wondering if this step would allow you to set the EVC the way you want it, then migrate hosts in with live VMs.

Not sure as I never tried that but considered it. I imagine that for one round that would be fine, but otherwise it would be a more permanent failure.

– Edward

THis was a combination of failures, but if a battery fails and you loose power you could loose some acceleration of the array controller, and that would not be great. THe battery is for battery backed memory to speed up reads, etc.

Best regards,
Edward L. Haletky

I got that information direct from HP’s BladeSystem people I know. I also thought it was in some of the release notes for the firmware.

Best regards,
Edward