CHAPTER Maintaining Server Availability In this chapter, you will learn how to • Work with cluster services • Manage cluster services • Work with server load balancing • Manage Network Load Balancing using wlbs/nlb and NLB Manager • Identify system bottlenecks using System Monitor • Identify solutions for correcting system bottlenecks • Plan a backup and recovery strategy • Use volume shadow copy • Create ASR recovery disks 15 Ever since the first server was wheeled into a business, the need to provide uninterrupted access to mission-critical applications and data has been a priority for server administrators. The reasons for this are straightforward—when the server goes down, the business may lose money. In the past, maintaining high availability has not always been easy, often requiring specialized hardware and software and complex management tools. Windows Server 2003 builds on the technologies of past Windows versions and includes many enhanced tools and procedures for designing and implementing affordable high-availability server solutions. In this chapter, we look at some of these tools and procedures and how they are used to ensure continued access to applications and data. NOTE Server uptime is typically measured in a percentage as a number of nines. Today, the term “six nines” represents the Holy Grail of high availability. For example, 99.9999% server uptime translates to 32 seconds of downtime per year; 99.9% represents about 8.75 hours of downtime per year. 1 MCSE Windows Server 2003 All-in-One Exam Guide 2 Working with Clusters One of the features used to increase server availability is known as clustering. Clustering is a strategy in which a group of computers works together providing access to common applications and data. In a cluster configuration, a group of servers that are physically separate are viewed and accessed as if they were a single entity. Each server in a cluster is referred to as a cluster node. The entire node cluster is typically accessed through a single unique identifier such as a NetBIOS name, TCP/IP address, or MAC address. Each node in the cluster is not individually accessed by client systems. Rather, incoming requests to the servers are handled by the clustering software, which redirects the client’s request to a particular server within the cluster. In the case of a hardware failure, the cluster can function as long as there remains one operational node left. This means that a functioning server cluster can accommodate failure of multiple cluster nodes. This strategy goes a long way in ensuring server availability. The advantages of clustering technology include: • System redundancy Using multiple server nodes in a cluster avoids a single point of failure and provides increased availability to applications and data. • Centralized management Cluster nodes provide a central point from which network administrators can remotely or locally manage the cluster. • Scalability As the network grows, more servers can be added to a cluster to increase processing power and provide a greater degree of redundancy. Windows 2003 offers two clustering services, known as the Microsoft Cluster Service (MSCS) and Network Load Balancing (NLB). Microsoft Cluster Service MSCS is specifically designed to provide high availability to mission-critical databases and file and print services. To provide this high availability, the nodes within the cluster are in constant communication, exchanging periodic messages called heartbeats. If one of the server nodes does not respond, another one of the nodes automatically takes over and provides the appropriate network service. This is known as a failover configuration. The switch from servers is transparent to the end users, and service to applications is uninterrupted. MSCS is only available with the Windows Server 2003 Enterprise and Datacenter Editions and supports a maximum of eight cluster nodes. NOTE When designing a cluster configuration, remember that a cluster cannot be implemented if using systems running both Windows Server 2003 Enterprise and Windows Server 2003 Datacenter Editions. The different operating systems may be running incompatible versions of the cluster service. EXAM TIP Remember that MSCS is only available with the Windows Server 2003 Enterprise and Datacenter Editions and supports a maximum of eight cluster nodes. Chapter 15: Maintaining Server Availability 3 When you read about server clustering, you will no doubt run into the concept of quorums. Quorums are an important consideration when working with MSCS clusters. In each and every cluster, there is a dedicated resource that holds important configuration data that is used in the restoration of a failed cluster. This dedicated resource is known as the quorum resource. Quorums are actually recovery log files that contain cluster configuration information and must always be available for the cluster to run. For a device to qualify as a quorum resource, that resource has to be able to provide physical storage that can be accessed by any node in the cluster and it must use NTFS. When designing a clustering configuration, it is important to keep in mind the type of quorum resource you will use. In Windows Server 2003 there are three ways to three ways to set up the quorum resource: • Single node server cluster A single node server cluster is a unique configuration often used for system configuration testing. A single node server cluster can be configured with external cluster storage devices or without it. For single node clusters without an external cluster storage device, the local disk is configured as the cluster quorum device. • Single shared quorum As the name suggest, in this configuration the quorum is placed on a shared storage device in the cluster which all cluster nodes can access. • Majority nodes quorum New to Windows Server 2003, the majority nodes quorum requires that cluster configuration information be stored on the local disks of each node. The majority node set resource ensures that the cluster configuration data is kept consistent across the different disks. Majority nodes quorum is often used for geographically dispersed server clusters. Of these three models, the single shared quorum is the most popular design for maintaining the quorum resource. This design is well suited for environments where all of your cluster nodes are in the same location. The single shared quorum also allows a cluster to continue supporting users even if only one node is running. PART III EXAM TIP Although we didn’t get any questions on our exam specifically on quorums, they may be on there somewhere. However, a general knowledge of what they are designed for may be required to answer clustering-related questions. MCSE Windows Server 2003 All-in-One Exam Guide 4 Pre-Implementation Considerations In Windows Server 2003, the process of designing and implementing a server cluster is fairly straightforward. As with other implementations, there is a bit of planning that should occur to make things run smoothly. In this section, we review some of the general pre-implementation considerations to be aware of before attempting to install a server cluster. Hardware Verification Hardware verification is certainly nothing new and is as relevant for clustering hardware as any other hardware component you install in a server system. The hardware for the cluster should be verified with Microsoft’s Hardware Compatibility List (HCL). The list can be accessed at http://www.microsoft.com/hcl/. To simplify the installation and reduce potential errors, Microsoft recommends using identical hardware for all nodes. While this certainly isn’t always possible, it can greatly reduce administrative headaches. IP Addressing When planning the configuration of a server cluster, keep in mind that every network adapter on each cluster node requires an IP address. Microsoft recommends assigning static IP addresses to the nodes. It is possible to use DHCP, but there is a very logical reason why this is not often done. If you were to use DHCP to assign IP addresses to cluster nodes, you could inadvertently create a single point of failure. If the DHCP server becomes unavailable, the cluster nodes depending on it may be unavailable as they will be unable to get a valid DHCP address. If DHCP is used, it is recommended to ensure measures are in place to keep DHCP services available. Such measures may include having redundant DHCP servers. TIP If using DHCP, it is a good idea to use long leases for cluster node clients, which will help ensure that they maintain a valid IP address. EXAM TIP When working with IP addresses and server clusters, remember that a static IP address is used for the entire cluster entity and DHCP cannot be used. DHCP can be used for assigning IP addresses to the individual cluster nodes, however. Cluster Name When implementing the cluster, you will need to assign the cluster a name through which administrators can access it. The cluster name follows the rules of other network naming conventions: it must be unique in the network and not the same as any other domain or system in the network. As with other system names, the name length is limited by the rules of NetBIOS. NOTE As you might expect to work with and configure the cluster, you will need to have access to a user account that is part of the local Administrators group on each node. All nodes must have joined a domain (instead of a workgroup) and be members of the same domain. Chapter 15: Maintaining Server Availability 5 Deployment Considerations As discussed in the preceding sidebar, “The Quorum Query,” there are three cluster models: the single node cluster, single shared quorum device, and majority node set cluster models. If you use the single shared quorum device or majority node set cluster models, you have a variety of different cluster deployment options. The deployment option chosen will depend on the needs and budget of an organization. These cluster deployment methods include • N-node failover pairs The failover pair refers to the fact that each application is configured to failover only between two specified nodes. The drawback of this approach is that the failure of two servers in the same pair results in complete failure of all resources they own. To deploy N-node failover pairs, all cluster nodes have to be divided into pairs and assigned groups to each pair. • Hot-standby server/N+I Unlike the N-node failover pairs, a single node is designated as the failover for all remaining nodes in the cluster. The hot-standby server is capable of running the applications from each node pair in the event of a failure. • Failover ring In a failover ring configuration, an instance of all applications is run on each node in the cluster. In the event of failure, the responsibility to manage the failed server’s applications falls to the next node in sequence. The failover ring cluster requires that a circular list of nodes is created that form the failover sequence. • Random cluster In a random cluster, the failover sequence is random, left to the server cluster to choose. This works well in environments where clusters contain a large number of nodes and groups and other models are too complex to implement. PART III Setting Up a Server Cluster After the system prerequisites are satisfied and you have an idea of how you would like to implement the cluster, you are ready to build the cluster. There are two tools you can use to create the server cluster, the Cluster Administrator graphical tool and the cluster.exe command-line utility. We will start with creating a cluster using the Cluster Administrator. Select Run | All Programs | Administrative Tools and then the Cluster Administrator icon to start the Cluster Administrator. Alternatively, the cluadmin.exe command can be typed into the Run dialog box. Figure 15-1 shows the Cluster Administrator. As shown in Figure 15-1, as soon as the Cluster Administrator is started, the Open Connection To Cluster dialog box is displayed. The Action drop-down menu on this screen provides you with three options, Open Connection To Cluster, Add Nodes To Cluster, or Create A New Cluster. To create a new cluster, select this option from the menu to start the New Server Cluster Wizard. The following steps will guide you through the process of creating the server cluster. MCSE Windows Server 2003 All-in-One Exam Guide 6 Figure 15-1 The Cluster Administrator is used to configure server clusters. NOTE If after selecting the option to create a new cluster, things do not work, make sure you are a member of a domain and not a workgroup and that you are using NTFS partitions. 1. With the New Server Cluster Wizard displayed, take the time to read the requirements to complete the procedure on the first screen. When satisfied, click Next. 2. On the second screen of the wizard you will be required to specify the name of the new server cluster and the domain in which it will be created. 3. Next, you will be required to select the computer that will be the first node in the cluster. Click Next once you have identified the system. 4. The wizard will then analyze the system to make sure it meets all the requirements to complete the cluster creation. Successful components will be marked with a check mark, warnings with a yellow exclamation point, and failures with a red X. If there are problems, you can view the log or click Details to gather information on the process. To retest the configuration, click Re-Analyze. Figure 15-2 shows the five steps performed by the New Server Cluster Wizard. Chapter 15: Maintaining Server Availability 7 Figure 15-2 Verifying system requirements for creating a cluster PART III 5. In the next screen of the wizard, you will be required to enter a unique IP address that will be used to connect to the cluster. Enter the IP address and click Next. 6. The next screen of the wizard allows you enter the logon information for the domain account under which the cluster service will be run. 7. The final screen of the wizard provides an overview of the cluster information you have entered. From this screen you also have the ability to select the quorum resource; click Quorum to choose. Figure 15-3 shows the Proposed Cluster Configuration screen, which displays a summary of the cluster configuration, and the Cluster Configuration Quorum dialog box, which displays the options for quorum resources. EXAM TIP Before taking the exam, take the time to run through the process of creating a server cluster. Questions on the exam will be easier if you have had some hands-on experience working through the process. Once the final Next button is clicked, the creation of the cluster will begin. In the process, the system completes four steps: it reanalyzes the system to ensure cluster information is correct, configures cluster services and starts the cluster service, configures resource types, and finally configures the resource. Figure 15-4 shows the creation of the cluster. With the cluster created, you can view and manage it from the Cluster Administrator. Figure 15-5 shows the newly created cluster in the Cluster Administrator. MCSE Windows Server 2003 All-in-One Exam Guide 8 Figure 15-3 The Proposed Cluster Configuration screen and the Cluster Configuration Quorum dialog box Figure 15-4 Four final steps are completed to create and configuring the cluster So far we have covered creating a cluster using the graphical utility. All that is left is to do the same using the command-line utility cluster.exe. Creating clusters with the command line requires more effort, but those with experience working at the command line should feel right at home. Chapter 15: Maintaining Server Availability 9 PART III Figure 15-5 The Cluster Administrator is used to view and manage clustering services. To create a cluster using the cluster.exe command, the /create switch is used along with a variety of other information. To be specific, the following syntax is used: L 15-1 L 15-2 /create /node:node-name /user:domain\username | username@domain / pass:password /ipaddr:xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx,network-connection-name where xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx is the IP address followed by the subnet, and network-connection-name is the network adapter, and so on. Confusing? Well, here is an example for creating a cluster named cluster1: L 15-3 cluster.exe /cluster:cluster1 /create / ipaddr:192.168.1.1,255.255.255.0,"internal" /password:free / user:test\administrator /node:personal In this example, we are creating the cluster1 cluster with an IP address of 192.168.1.1 and a subnet of 255.255.255.0. We assigned the cluster to the network adapter named MCSE Windows Server 2003 All-in-One Exam Guide 10 “internal” on the node server named personal. Finally, we are using the cluster service account named administrator in the test domain. Once this command is correctly issued, the cluster will be created. Adding clusters to an existing cluster is done with the / add option, removing clients is performed with the /evict option, and stopping the cluster is done with the /stop option. NOTE For a full listing of the options available for the cluster.exe command, run the following command at the command line: cluster.exe /?. Basic Server Cluster Management While the Microsoft objectives do not specifically list cluster management in this objective, it is a good idea to at least have an overview of management procedures. Table 15-1 describes basic cluster procedures from both the Cluster Administrator and the cluster.exe utility. Procedure Using cluster.exe Starting the cluster service Stopping the cluster service Pausing a node (while paused, prevents resources on other nodes failing over to the node) Resuming a node Verifying node status Right-click the node on which you want to start the service and select the Start Cluster Service option from the menu. Right-click the node on which you want to stop the service and select the Stop Cluster Service option from the menu. Right-click the node on which you want to stop the service and select the Pause Node option from the menu. Right-click the node on which you want to stop the service and select the Resume Node option from the menu. Icons, such as a blue and white exclamation mark, visually display the status of the cluster node. From the command prompt, type cluster /cluster name node node name /start From the command prompt, type cluster /cluster name node node name /stop From the command prompt, type cluster /cluster name node node name /pause From the command prompt, type cluster /cluster name node node name /resume From the command prompt, type cluster /cluster name node node name /status Table 15-1 Basic Commands for Managing the Cluster Chapter 15: Maintaining Server Availability 11 Recovering from a Cluster Node Failure To ensure high availability and the ability to quickly and effectively recover from a cluster node failure, regular backups of the nodes within a cluster are essential. When performing cluster backups, there are four key pieces of information you need to have to complete a total restoration: • Cluster disk signatures and partitions Using the Automated System Recovery (ASR) in the Backup Wizard, you can make a backup of the disk signatures and partitions. The process of creating an ASR recovery disk is covered later in this chapter. • Cluster quorum data The quorum data contains the cluster information and the cluster recovery log. The Backup Wizard can be used to back up the cluster quorum when you perform a system state backup from any node. After you back up the cluster quorum disk on one node, it is not necessary to back up the quorum on the remaining cluster nodes. • Data on the cluster disks To back up all cluster disks used by a node, perform a full backup from that node. NOTE If a cluster disk owned by the node being backed up fails over to another node during the backup process, the backup set will not contain a full backup of that disk. • Data on the individual cluster nodes To make things run smoothly, it is a good idea to back up the clustering software, cluster administrative software, system state, and application data on the individual server nodes. This can be done using the Windows Server 2003 Backup Utility. Restoring an Individual Cluster Node Using ASR When a system completely fails, the ASR process can be used to restore the system to a functional state. For the ASR process you will need to have your most recently created ASR recover disk that contains the backed-up cluster disk signatures, partition layouts, and cluster quorum. You will also need a boot disk, preferably the original operating Windows Server 2003 installation CD, and you will need to be a member of the Administrators group on the local computer system. To begin the recovery process, insert and boot from the original Windows Server 2003 installation CD. When prompted, press the F2 key to initiate the ASR recovery process. Insert the ASR disk when asked and follow the onscreen directions. Once the system recovers using the ASR disk, the node should be able to rejoin the cluster. PART III MCSE Windows Server 2003 All-in-One Exam Guide 12 No ASR Disk! Even the most diligent system administrator may forget to create an ASR disk. For such times, there is another option that can be tried to recover from a corrupted quorum log or quorum disk. The procedure is as follows: 1. Stop the cluster service by selecting Start | All Programs | Administrative Tools and the Services icon. Find the cluster service, right-click it and select Stop from the menu. 2. With the cluster service stopped, right-click the cluster service icon again and choose the Properties option from the menu to open the Cluster Service Properties dialog box. 3. At the bottom of the General tab of the Cluster Service Properties dialog box, you have the option to specify start parameters for the cluster service. In the Start Parameters text box, enter the following switch: /fixquorum. 4. Restart the service to repair the quorum disk. Figure 15-6 shows the Cluster Service Properties dialog box with the /fixquorum option. NOTE If you are restoring a disk signature to a damaged cluster disk, power down all other cluster nodes except the one on which you are performing the ASR restore. This cluster node must have exclusive rights to the damaged cluster disk. Figure 15-6 The /fixquorum option is used to attempt to repair a corrupted quorum disk. Chapter 15: Maintaining Server Availability 13 The /fixquorum option can also be used from the command line using the clussv.exe command. The clussvc.exe command should not be used under normal conditions, but only as a temporary diagnostic tool if the cluster service fails to start. Listed in Table 15-2 are some of the available diagnostic options available with the clussv.exe command. Recovering System State Using the Windows Server 2003 Backup Utility, you can back up the system state, which includes such things as the COM+ Class Registration database, Certificate Services database, Active Directory service, and the cluster service information. In the event of a cluster failure or the failure of an individual node, you may need to restore the system state, for example, if you need to restore the cluster quorum for all nodes in the cluster. To use the Backup Utility to restore the system state, select Start | All Programs | Accessories | System Tools and finally the Backup icon. Alternatively, you can simply type ntbackup in the Run dialog box to start the Backup Wizard. When prompted by the wizard, select the option to Restore Files And Settings and navigate to the location of the backed-up system state data. Once selected, the system state will be restored and you should be able to rejoin the cluster. PART III Network Load Balancing Clusters Overview Although the term Network Load Balancing (NLB) clusters can seem a bit intimidating, the function and implementation of NLB are fairly straightforward. Essentially, NLB is used to disperse incoming client requests across several different servers. Instead of client requests accessing the applications and resources of a single server, the request can be spread across as many as 32 servers. As you can appreciate, this increases not only the availability of those applications but also the response time. Windows Server 2003 NLB software can detect when a server in the cluster stops working and assign new client requests to that server. The design of NLB is to provide continual and uninterrupted access to applications. This makes NLB clusters well suited for web and FTP servers, proxy servers, VPN servers, Telnet servers, and Terminal Services servers. NOTE Network Load Balancing is included with all Windows Server 2003 products. Table 15-2 Using the clussv.exe Command Description /fixquorum /resetquorumlog /forcequorum /debugresmon Allows the system to start the cluster service even if there are problems with the quorum device. If the quorum log file is not found or is corrupted, creates a new quorum log file based on information in the local node’s cluster database file. Restores quorum for a majority node set server cluster that has lost quorum. Enables the debugging mode. MCSE Windows Server 2003 All-in-One Exam Guide 14 In application, each NLB cluster node runs separate copies of applications or services such as that for a web, FTP, and Telnet server. This is in contrast to the previously mentioned server clusters where only a single instance of a particular application is allowed to run at a time. Windows Server 2003 NLB software has the ability to detect a failed cluster node—typically within ten seconds—and the failed server is removed from the cluster. Client requests are directed away from the failed server and to the remaining functional servers within the cluster. NLB allows all of the computers in the cluster to be addressed by the same set of cluster IP addresses, but also maintains their existing unique, dedicated IP addresses. Table 15-3 summarizes some of the key characteristics of NLB clusters. EXAM TIP NLB does not use clustered storage devices. Each server runs a copy of the IP-based application or service that is being load balanced, and the data necessary for the application or service to run is stored on local drives. Description Increased scalability High availability Versatile management Compatibility Requests for individual TCP/IP services can be spread across the entire cluster. Windows Server 2003 supports up to 32 computers in a single cluster. NLB nodes can detect system failures and automatically recover failed node. The workloads among nodes are monitored and redistributed when nodes fail or are removed. Recovers and redistributes the workload within ten seconds. Using the Network Load Balancing Manager, it is possible to manage and configure multiple Network Load Balancing clusters from a single computer. Configuration options allow the administrator to direct client requests to a single host. This allows Network Load Balancing to send client requests to a specific node running a particular application. NLB provides the ability to block undesired network access to certain IP ports. NLB does not require specialized hardware or systemwide hardware changes in order to run. NLB requires only standard Windows networking driver components. Clients access the NLB cluster using a single logical Internet name and virtual IP address. Each individual node cluster retains an individual name. Network Load Balancing can be bound to multiple network adapters, allowing you to configure multiple independent clusters on each host. Table 15-3 Windows Server 2003 NLB Clusters Features and Enhancements Chapter 15: Maintaining Server Availability 15 Pre-Implementation Considerations NLB was designed to be as compatible as possible. As such, it doesn’t take much to get the cluster up and running. With that in mind, in this section we highlight some of the things to consider before implementing your NLB. Network Adapters Microsoft recommends that when designing the NLB cluster, plan to use two network cards in each cluster node. This isn’t for redundancy, but rather, to effectively create two distinct networks. For example: • Adapter 1 (cluster adapter) Provides for network traffic for the cluster. • Adapter 2 (dedicated adapter) Provides client-to-cluster network traffic and other traffic originating outside the cluster network. PART III While it is recommended to use two adapters wherever possible, two network cards are not required. However, if only a single network adapter is used, there are some limitations to be aware of. When using a single adapter in unicast mode, node-to-node communication is not possible and nodes within a cluster cannot communicate with each other. In multicast mode with a single adapter, node-to-node and intercluster communication is possible. However, the single adapter configuration is not recommended for handling moderate to heavy traffic from outside the cluster. Microsoft recommends that for node-to-node communication and to accommodate moderate to heavy traffic, two network cards should be installed. EXAM TIP Remember that when a cluster is set to run in unicast mode, NLB cannot distinguish between single adapters on each node. This means that node-to-node communication is not possible unless each cluster host has at least two network adapters. IP Addressing Configuring the NLB cluster requires a little forethought as far as IP addresses are concerned. It is recommended that TCP/IP be the only protocol bound to the cluster’s network adapters. Wherever possible, the IP addresses for the cluster should be statically assigned during the NLB configuration. All dedicated cluster IP addresses must belong to the same subnet and have the same subnet mask. To provide high availability to clients, NLB uses a virtual IP address for the cluster, and all client requests are directed to this virtual IP address instead of individual node IP addresses. If one of the servers in the NLB cluster should fail, the rest of the servers in the cluster can transparently take over. When the failed server is brought back online, it can rejoin the cluster group without disruption to clients. To configure the NLB cluster, you will need to have a number of available IP addresses. If you are using a single network adapter approach, you will require an IP address for each adapter in each node and one for the virtual cluster address. These too should all be on the same subnet with the same subnet mask. When using multiple network cards in each node, you will again need an IP address for the virtual cluster and one for each adapter in every node. Cluster and dedicated IP addresses must belong to the same subnet. MCSE Windows Server 2003 All-in-One Exam Guide 16 Installing Network Load Balancing With all of the configuration and hardware prerequisites met, you can begin to install the NLB cluster. There are two primary methods of installing the NLB cluster: using the Network Load Balancing Manager, and using the properties of a network connections dialog box. We’ll begin with the Network Load Balancing Manager. Installing NLB Clusters Using the Network Load Balancing Manager The NLB manager is part of, and can be executed from, the Windows Server 2003 Administrative Tools. It can also be executed in the Run dialog box using the nlbmgr.exe command. As shown in Figure 15-7, the NLB Manager is divided into three window sections. The top left window displays a list of clusters and nodes, the top-right window displays the known cluster configurations, and the bottom window is used to display status messages. To create an NLB cluster, select Cluster | New to open the Cluster Parameters dialog box (shown in Figure 15-8). In this dialog box, you need to enter your cluster TCP/IP configuration, cluster operation mode (unicast/multicast), and whether to allow remote control (and if so, set the remote control password). Figure 15-7 The Network Load Balancing Manager is used to create NLB clusters. Chapter 15: Maintaining Server Availability 17 Figure 15-8 The Clusters Parameters dialog box PART III NOTE The terms unicast and multicast are used to describe how a message is communicated in a network. Unicast transmissions send a message to one receiver, typically from a server to a workstation. Multicast transmissions transmit a message to multiple recipients at the same time. Multicast is a one-to-many transmission similar to broadcast network communications, except that multicasting means sending to specific groups, whereas broadcast communication sends to everybody. EXAM TIP Network Load Balancing does not support a mixed environment of unicast/multicast. As far as the TCP/IP configuration is concerned in the Cluster Parameters dialog box, there are a few things to keep in mind. The IP address you enter on this screen is the virtual IP address and must be set identically for all hosts in the cluster. As mentioned earlier, this virtual IP address is used to address the entire cluster. This should be the primary IP address and subnet mask for the cluster. One final consideration, the dedicated IP address and the cluster IP address, entered during setup in the Network Load Balancing Properties dialog box, must also be entered in the Internet Protocol (TCP/IP) Properties dialog box. Make sure that the addresses are the same in both places. EXAM TIP Both the dedicated IP address and the cluster’s primary IP address must be static IP addresses. They cannot be DHCP-assigned IP addresses. MCSE Windows Server 2003 All-in-One Exam Guide 18 Once the information is entered correctly in the Clusters Parameters dialog box, the next screen allows you to enter any additional cluster IP addresses. If there are no additional cluster IP addresses, click Next to open the Port Rules dialog box. Port rules are used to control of various types of TCP/IP traffic. To add or edit a port rule, click Add or Edit in the Port Rules dialog box. This will open the Add/Edit Port Rule dialog box. The configurable options in this window include • Cluster IP Address The cluster IP address that the port rule should cover. • Port Range The TCP/UDP port range that a port rule should cover. Ports numbers ranging from 0 to 65,535 are currently supported. • Protocols or both. The TCP/IP protocol that a port rule should cover: TCP, UDP, • Filtering Mode There are three possible filter modes: multiple hosts, single host, and disabled. The multiple hosts filter specifies that multiple hosts in the cluster handle network traffic for the associated port rule. The single host filter option allows network traffic for the associated port rule to be handled by a single host in the cluster according to the specified handling priority. Finally, the disable port range forces all network traffic for the associated port rule to be blocked. Once you have established and configured the port rules, click Next to display the Connect dialog box where you can specify the host that will be created as the first member of the new cluster. Once the host name is entered, click Next to open the Host Parameters dialog box (see Figure 15-9), which contains the following options: • Priority Used to set a unique ID for each host. It is important to note that the host set with the lowest number value is chosen to control the network traffic of the entire cluster. This priority setting can be overridden using port rules. • Dedicated IP Configuration Used to identify a unique IP address for the host to be used for network traffic not associated with the cluster. • Default State Used to specify whether Network Load Balancing will start, and if it does, to determine if the host automatically connects to the cluster when the operating system is started. Once the host parameters are entered, click Next to finish creating the new NLB cluster. The cluster will now appear in the NLB Manager. If there are problems with the newly created cluster, it will appear as a red and white X in the bottom information window of the NLB Manager. The preferred way to create an NLB cluster is using the NLB Manager, but it is not the only way. The following is a quick overview of creating NLB clusters using the Network Properties. Chapter 15: Maintaining Server Availability 19 Figure 15-9 The Host Parameters dialog box PART III To begin creating the NLB cluster, select Start | Control Panel | Network Connections and finally the Local Area Connections icon to open the Local Area Connection Status Dialog box. Click Properties to open the Local Area Connection Properties dialog box as shown in Figure 15-10. Figure 15-10 Creating NLB clusters through the Local Area Connection Properties dialog box MCSE Windows Server 2003 All-in-One Exam Guide 20 Notice in Figure 15-10 that the check box beside the Network Load Balancing option is unchecked. Check this option and click Properties to open the Network Load Balancing Properties dialog box. The dialog box has three familiar tabs, Cluster Parameters, Host Parameters, and Port Rules. Completing the information on these three tabs will create the cluster just as you did using the NLB Manager. Managing Network Load Balancing Now that you know how to create an NLB cluster, you are also going to need a basic understanding of how to manage those clusters once they are created. There are a few utilities you can use to manage the NLB cluster, including the NLB Manager, command-line utilities (wlbs.exe/nlb.exe), and the Network Load Balancing Properties dialog box in the Network Connection properties. nlb.exe is the Windows Server 2003 replacement for the older wlbs.exe (Windows Load Balancing Suite). While it might seem unusual to manage an NLB cluster from the command line when you have flashy graphical tools, command-line management can be more efficient and allow for faster changes than their graphical counterparts. nlb.exe allows administrators to manage both local and remote NLB clusters. As far as the graphical utilities are concerned, there is not much to report with them. The procedures involve menus and a lot of right-clicks. Table 15-4 shows some basic commands that can be issued using the nlb.exe utility and the graphical equivalent using the NLB Manager. For a full list of available options, type nlb /? at the command prompt. EXAM TIP Before taking the exam, familiarize yourself with command-line cluster management and available options. Procedure Using NLB Manager Procedure Using nlb.exe Provide summary information on the NLB cluster, including IP configuration, event messages, and cluster state Suspend all cluster operations Right-click the cluster and then point to Control Hosts and select Display from the menu. Right-click the cluster and then point to Control Hosts and select Suspend from the menu. Right-click a host or a cluster, point to Control Host or Control Hosts and select the Drainstop option. nlb.exe display nlb.exe suspend Prevent new traffic handling for specific ports and stop Network Load Balancing Table 15-4 nlb.exe drainstop Basic NLB Commands Chapter 15: Maintaining Server Availability 21 Procedure Using NLB Manager Procedure Using nlb.exe Stop handling Network Load Balancing cluster traffic Start handling Network Load Balancing cluster traffic Disable and block all Network Load Balancing traffic handling for specific ports Right-click the cluster or host, point to Control Hosts and select the Stop option. Right-click the cluster or host, point to Control Hosts and select the Start option. Right-click a host or a cluster, and then click Control Ports. Select the port you want to disable or block and then click Disable. nlb.exe stop nlb.exe start nlb.exe disable Table 15-4 Basic NLB Commands (continued) PART III Identifying System Bottlenecks When a server isn’t performing as well as it should, whether applications are slow and unresponsive or error messages start to appear, it is time for administrators to begin the process of performance troubleshooting. Tracking down the cause of a server performance issue is not always an easy endeavor, and as a result, the first response to performance troubleshooting is often to upgrade the server, starting with the memory. While this hit and miss approach to correcting performance issues with a server is often the way business is done, Windows Server 2003 provides some tools that allow you to take a more scientific approach. In this section, we’ll take a look at the Windows Server 2003 System Monitor and how it is used to help identify potential performance bottlenecks. Bottleneck Basics When it comes to tracking and correcting server bottlenecks, the first assumption is often that the hardware resources are insufficient to handle the load. Such assumptions have led to situations where components are unnecessarily upgraded to address a performance issue. There is no doubt that insufficient hardware resources can create bottleneck issues, but they cannot always take the blame. The only accurate way to determine where a bottleneck is and what is causing it is to monitor the performance of the system, component by component and program by program. What makes isolating system bottlenecks particularly tricky is that there are many different factors, or a combination of factors, that can be creating the problem. Here are a few factors that might cause a system bottleneck: • Insufficient hardware resources upgraded to handle the load. Components may need to be enhanced or • Load balancing System hardware may be adequate, but the workload is not evenly distributed among hardware. MCSE Windows Server 2003 All-in-One Exam Guide 22 • Hardware failure Hardware that is not working correctly can cause a bottleneck. Performance counters should be able to isolate this as a cause. • Software demands Programs that are written poorly or not functioning correctly can monopolize resources and create system bottlenecks. At the end of the day, deciding whether the performance of a system is acceptable is often a judgment call, as performance concerns vary greatly depending on the environment in which the system is used. For example, a server may function fine as an authentication server, but if the same system is now responsible for file and print services, it may not be able to handle the load. The only way to really know what a system can do is by gauging how hard the components are working and determining at what point a component may need to be replaced. To determine this in Server 2003, you can use System Monitor. Using System Monitor Those who have experience working with the Management Console in Windows 2000 will feel right at home working with the Windows Server 2003 equivalent. When the Performance Monitor is opened, it has the same two components as with Windows 2000, the Performance Logs and Alerts and the System Monitor. The Performance Logs and Alerts maintain the system’s logging functions and System Monitor is responsible to display real-time performance statistics. Figure 15-11 shows the Windows Server 2003 System Monitor. Figure 15-11 System Monitor is used to display real-time performance statistics. Chapter 15: Maintaining Server Availability 23 EXAM TIP System Monitor can be opened by typing perfmon into Run or it can be started by selecting Start | All Programs | Administrative Tools and finally the Performance icon. As you can see from Figure 15-11, the graphic interface of System Monitor is straightforward. However, before you get into using System Monitor, you need to know the difference between objects, instances, and counters. Objects, Instances, and Counters In the System Monitor world, an object refers to a physical component of the server, such as memory or a hard disk. An object may also refer to a logical component such as a disk volume and even a software component such as a system process. When working with System Monitor and looking for a bottleneck, you track the performance of these individual objects using counters. A counter is a measurable aspect of an object. For example, memory has many measurable characteristics, such as pages/sec or available bytes. Each of these memory characteristics is considered a counter and provides you with very specific information on that object. When hunting for those performance bottlenecks, you need to choose the correct counter for the job. Choosing the correct counter for troubleshooting the performance of a specific object is discussed later in this chapter. Instances refer to the number of occurrences of an object in the server. For example, if you have two hard disks in a server, two instances of that object are present in System Monitor. When measuring the performance of a particular object, you have the option to monitor all instances, both hard disks, or a single instance. With a better idea of these concepts, we can now look a bit closer at System Monitor and the process of adding counters to monitor the objects in a server. PART III Adding Object Counters to Monitor As shown in Figure 15-11, System Monitor is first opened, there are three default counters running, one to monitor memory (Pages/sec), one to track hard disk performance (Average Disk Queue Length), and one for the processor (% Processor Time). These three default counters give a good overview of the performance of these objects; however, they are often not enough to track down all performance bottlenecks. In such cases, you need to add a few counters to the mix. There are two easy ways to add a counter to an object in System Monitor. The first is to click the + button in the menu bar, and the second is to simply right-click in the System Monitor window and choose the Add Counters option from the menu. Whichever method you choose, the result will be to open the Add Counters dialog box, which is where the real fun begins. Figure 15-12 shows the Add Counters dialog box. EXAM TIP Monitoring system performance is a major consideration for system administrators. As such, you can expect to see questions on the exam highlighting System Monitor. We suggest taking the time to gain some handson experience with System Monitor before taking the exam. MCSE Windows Server 2003 All-in-One Exam Guide 24 Figure 15-12 Adding counters to System Monitor is done from the Add Counters dialog box. Once the Add Counters dialog box is open, things can get confusing. There are a number of different objects you can choose to monitor, and each object has various counters available to track performance. To add a counter, first select the Performance Object you want to monitor from the drop-down menu, such as the processor or physical disk. Once selected, choose the counter you need and click Add to begin monitoring the object. The monitoring of the object will be viewable in System Monitor’s main screen and will be displayed in a different color from the other objects. Add as many counters as you want, but be selective and add only those counters you really need. Too many counters make it hard to get an accurate picture of what is going on in the system. NOTE If you are wondering what a certain counter is designed to monitor, Windows Server 2003 includes an Explain button you can click to describe the function of the counter. While some of these explanations are useful, others seem to confuse more than they clarify. Still, they are worth checking out. Now that you know how to add counters to measure characteristics of system objects, you can see how adding counters translates to actually troubleshooting a server and identifying bottlenecks. Identifying Processor Bottlenecks There is an array of counters available to monitor processor activity. The names of these counters are somewhat cryptic, and the explanations provided with Windows Server 2003 often serve to muddy the waters. Fortunately, when it comes to monitoring processors and looking for bottlenecks, you only need to use a few of these counters. These include the % Processor Time, Interrupts/sec, and % Interrupt Time. Chapter 15: Maintaining Server Availability 25 The % Processor Time counter is the primary indicator of processor activity and displays the average percentage of busy time observed during a sample interval. If the % Processor Time counter consistently displays an average usage above 85%, the processor may need to be upgraded or it may be necessary to track down applications that are too demanding on the processor. Either way, 85% on the processor usage indicates that the processor may be a bottleneck. The Interrupt counters are used to monitor how often the processor needs to handle requests from hardware such as video cards, networks cards, disk drives, and peripheral devices. If the processor is spending too much time handling requests from hardware—for instance, if the Interrupts/sec counter exceeds an average of 3500/4000—the processor may be having trouble handling the load. A high number of interrupts can also be caused by software problems such as faulty device drivers that can send out a stream of constant interrupt requests per second. Updating old or beta device drivers may help bring the interrupt counters within normal range. Table 15-5 summarizes the important counters for identifying processor bottlenecks. EXAM TIP A dramatic increase in the Interrupts/sec counter value often indicates a hardware problem. Identify the hardware causing the interrupts. PART III Correcting a Processor Bottleneck Though processors are not often at the root of your bottleneck troubles, it does happen. When it does, you typically have two choices of what you can do to alleviate the bottleneck: • Add a processor (if using a dual-processor motherboard) • Upgrade to a faster processor Before running out and replacing that processor, it is a good idea to track other objects in the system to see if they may be adding to the problem. You could upgrade the processor only to find that the problem lay elsewhere. Identifying Hard Disk Bottlenecks Like the processor, the hard disk has a number of different counters that can be used to monitor disk activity and overall performance. Of all of the counters available for monitoring the physical disk, the average system administrator will only need two primary Table 15-5 Counters Used to Identify Processor Bottlenecks Function Warning Signs % Processor Time Primary indicator of processor activity. Displays how much time the processor is interrupted to handle hardware requests. Interrupt/sec Average usage consistently exceeds 85%. A counter consistently exceeding 3500/4000 is too high. MCSE Windows Server 2003 All-in-One Exam Guide 26 counters in the search for bottlenecks. The first is the % Disk Time counter, which represents the percentage of elapsed time that the selected disk drive was busy servicing read or write requests. The second, Current Disk Queue Length, displays the number of requests outstanding on the disk at the time the performance data is collected. When reviewing the % Disk Time counter you will want to see a low number. If you see that the hard disk is busy servicing requests 90% of the time or higher, there is a bottleneck. It could be that the hard disk needs to be replaced for a faster one, but the hard disk may in fact not be the culprit. You may find that adding memory to the system will bring the % Disk Time counter to normal parameters. The Current Disk Queue Length counter should be low, typically below 2. A high value indicates there is a wait period that is likely impacting users. Unlike many of the other counters, the Current Disk Queue Length counter provides a snapshot picture of performance, not an average over a time interval. Table 15-6 summarizes the key characteristics of the counters used to track potential hard disk bottlenecks. Correcting Hard Disk Bottlenecks When the hard disk is causing a systemwide bottleneck, the most obvious solution would be to purchase a new and faster hard disk. There are other things that can be tried to eliminate that hard disk bottleneck, however, including • Upgrade to a higher speed disk, although this may not be enough to completely remove the bottleneck. • Adding multiple hard disks to the system can reduce the workload on a single disk. • Create striped volumes across multiple physical disks to increase throughput. • If multiple servers are used, distribute programs among servers to spread the workload out. • Isolate tasks that heavily utilize disk I/O; if possible, place these tasks on separate physical disks. • Basic disk maintenance, such as using Disk Defragmenter to consolidate files, can optimize hard disk performance. • Update motherboard/host bus adapter drivers. Table 15-6 Counters Used to Monitor Disk Activity Function Warning Signs % Disk Time Current Disk Queue Length Elapsed time that a disk drive was busy servicing read or write requests. Shows the number of requests outstanding on the disk at the time the performance data is collected. A hard disk busy servicing requests an average of 90%. Outstanding requests should be low, on average below 2. Chapter 15: Maintaining Server Availability 27 Identifying Memory Bottlenecks When it comes to tracking down bottlenecks, memory counters perhaps get more work than any other counter. It may be a bit of a cliché, but memory is most often at the root of server performance problems. Both the operating system and those programs you put on it are memory hungry. Still, it is a best practice to use System Monitor to confirm your suspicions before running out and buying more memory. The thing to remember when monitoring memory is that you are using System Monitor to track the performance of the physical memory and hard disk access. This is because of the way Windows operating systems use virtual memory to augment a system’s physical memory. In a nutshell, virtual memory is a method of simulating more memory than actually exists in the system by allowing information in physical memory to be swapped out to the hard disk. This allows the computer to run larger programs or more programs concurrently. The hard disk may show high usage, but this is because it is so busy compensating for memory shortages in the system. NOTE One of the performance issues you are looking for in System Monitor is a memory leak. In application, a program should use the memory it needs and then free up that memory when the program is terminated. Some programs keep taking memory resources even though they are not being used or they do not return memory resources when not terminated. These programs are said to have a memory leak. When it comes to tracking memory bottlenecks, there are many counters you need to be aware of. Complicating the issue is the fact that some of the counters are not listed under the memory object, as there are counters under the PhysicalDisk object that will assist in tracing potential virtual memory problems. For the exam, you will need to have knowledge of many of the memory counters. Table 15-7 summarizes the counters used with memory to track memory performance bottlenecks. EXAM TIP Pay close attention to all of the tables provided in this section and familiarize yourself with the values of those counters and what values constitute a bottleneck. Correcting Memory Bottlenecks The most obvious solution to correct memory-related performance bottlenecks is to crack open the case and install more memory. There are a few more things to try, including: • If using multiple hard disks, use multiple paging files. • Ensure that the page file is the correct size. Typically, Windows manages the size of the file, but it may need to be manually changed. As a rough calculation, Microsoft recommends the paging file be between 1 and 1.5 times the amount of physical memory available. PART III MCSE Windows Server 2003 All-in-One Exam Guide 28 • Double-check that the memory settings are all correct. • If possible, place the network’s memory-hungry programs on your highest performing computers. Identifying Network Bottlenecks One of the more frustrating performance bottlenecks to try and isolate are the network bottlenecks. When you are trying to track down network bottlenecks, you are determining how much traffic there is on the network and how efficiently your server is managing that traffic. There are a number of counters you can use to monitor the network and hunt for those network bottlenecks. Two of the more often accessed network-related counters are described in Table 15-8. Function Warning Signs Memory: Available Bytes Displays the amount of physical memory immediately available for allocation to a process or for system use. Memory: Commit Limit Memory: Pages/sec Shows the amount of virtual memory that can be committed without having to extend the paging file(s). Identifies paging activity. If the counter runs too low it is an indication that the system is low on memory. A low amount of available physical memory can also indicate a memory leak in a program. Should be on average over 4MB available. Paging file should be 2.5 times the size of RAM installed in the system. If the counter consistently exceeds a threshold of 20, this could indicate that too much paging is occurring and more memory is needed. A counter that consistently exceeds 70% indicates that there is too much pressure on the paging file. Add more memory or increase the size of the paging file. Monitor the physical disk on which the paging file is located. A counter exceeding 90% averages may be a memory bottleneck. Paging File: % Usage Lists the percentage of the paging file currently being used. Physical Disk: % Disk Time Elapsed time that a disk drive was busy servicing read or write requests. Table 15-7 Using Counters to Isolate Memory Bottlenecks Chapter 15: Maintaining Server Availability 29 Function Warning Signs Network Interface: Bytes Total/sec Displays the rate at which bytes are sent and received over each network adapter. Server: Bytes Total/sec Measures the rate at which the server is sending and receiving network data. Isolating Network-Related Bottlenecks If the counter is either too high or too low from what you would expect from the card, it may be faulty. If the speed is too slow given the adapter and network speed, it may be faulty. If the rate displayed is consistently high, it may not be effectively handling the load. The traffic going in and out of the server indicates how busy the network is. A load too high indicates that the server is struggling to keep up with the load. Table 15-8 PART III Correcting Network Bottlenecks There are many things you can do to alleviate network related bottlenecks. These strategies include • If a group of systems are shared by common network users, place the users on the same subnet. • Unbind infrequently used network adapters. • If possible, switch to a multiple adapter configuration to reduce the load on a single network adapter. • If you are using more than one protocol, you can set the order in which the workstation and NetBIOS software bind to each protocol. • Update network adapter drivers. Planning a Backup and Recovery Solution Part of maintaining a high availability solution is preparing for the worst. In the case of servers, the worst is a complete crash of the system and the need to reinstall data from backups. Good server administrators will always have a solid backup strategy, including knowledge of the different types of backup strategies and the best one to choose for a given environment. In this section, we’ll look at some of the tools and procedures used to back up server data and how that data is restored. EXAM TIP Since the dawn of Microsoft certification exams there have been questions on the various backup types and the best one to use in a given situation. Be sure to have a solid understanding of them before taking the exam. Working with the Backup Utility The first and most obvious place to start a discussion of backups is with the Windows Server 2003 Backup utility. As with many of the other Windows utilities, Backup is a MCSE Windows Server 2003 All-in-One Exam Guide 30 wizard that allows you to easily select what to back up and the type of backup to make. There are two methods to access the Backup utility. You can select Start | All Programs | Accessories | System Tools. Alternatively, you can also type ntbackup in the Run dialog box to start the Backup utility. Once the utility begins, you can work your way through the wizard’s screens. Figure 15-13 shows the Windows Server 2003 Backup Utility. The second screen in the wizard allows you to select to back up all files and data and create a system recovery disk or choose the data that is to be backed up. Figure 15-14 shows the screen to choose to quickly back up the entire system or select individual files. If you select to manually choose the files and folders to backup, the Items To Back Up dialog box will be displayed. From here you can select files on the local computer or from the network or trusted domains to be backed up. You can also select to back up the system state. NOTE More information on the system state is covered in Chapter 5. Once you have selected the data that is to be backed up, you will have to choose the type of backup to perform and specify the destination of the backup file. By default, the backup file is named Backup.bkf and is destined for the My Documents folder for whomever is logged in at the time of the backup. Figure 15-15 shows the screen to select the backup destination, type, and name of the file. The final screen in the Backup or Restore Wizard provides a brief summary of the backup created and an Advanced button to further customize the backup. As they are likely to appear on the exam, let’s review the advanced backup options. Figure 15-13 The first screen in the Backup Utility allows you to restore or back up data files. Chapter 15: Maintaining Server Availability 31 Figure 15-14 Choosing to back up selected files or the entire contents of the hard disk PART III Advanced Backup Options A basic backup using the default options is sufficient for many environments. However, they may be times when it is necessary to customize the backup to tailor it to an organization’s specific needs. This is where the advanced options come in. By clicking the Advanced button on the final screen of the Backup or Restore Wizard, you open an Options dialog box (see Figure 15-16). Figure 15-15 The Backup or Restore Wizard allows you to specify the location and type of backup to perform. MCSE Windows Server 2003 All-in-One Exam Guide 32 Figure 15-16 Working with the advanced backup options Backup Type When you back up files on a Windows Server 2003 system, you have five different backup types to choose from. Each of these has a very specific use and offer specific advantages and disadvantages. You can pretty much count on getting a question regarding backup types on the exam and in what situations they are best suited. • Normal This is the default backup option and is most often referred to as a full backup. With a normal backup, each of the selected files are backed up and the backup system then marks each file as being backed up. Marking files that have been backed up is referred to as clearing the archive bit. The archive bit, which is a flag that can be set in a file, is simply a means by which the system can keep track of the files that have been created or changed since the last backup. To restore the files from a normal backup, you need only the most recent copy of the backed-up data. • Copy A copy backup is similar to the normal backup with one notable exception: the copy backup does not clear the archive bit. • Daily The daily backup is used to copy only those files that have been created or changed on the day that the daily backup is performed. Like a copy backup, the files are not marked as being backed up—in other words, the archive bit is not cleared. • Differential When a differential backup is chosen, only those files that have been created or changed since the last normal or incremental backup are copied. The archive bit is not cleared with differential backups. To restore from a differential backup, you will need the latest full backup as well as the most recent differential backup. Chapter 15: Maintaining Server Availability 33 • Incremental The incremental backup copies only those files that have been created or changed since the last normal or incremental backup. Because the incremental backups are only copying the files that have changed, they are quicker, as less needs to be backed up. The archive bit is cleared with incremental backups. To restore when using incremental backups, you will need the latest normal backup and each incremental you have done since that normal backup. Backup Log Keeping track and reviewing system-generated backup logs is important to ensure that the backups are working correctly. Finding out that backups have failed when you are trying to restore the system is not a good thing. On the Backup Log tab, you need to decide exactly how much information you need to log. By default, the Backup utility logs only errors and significant system events. From the Backup Log dialog box, you have three options to change what is being logged. The first radio button allows you to select detailed logging. This option logs all information, which may sound good, but it can make the log files too big and any errors listed in the file are harder to find. The second choice is summary logging. This feature records only key system operations. Because less is logged, errors in the file are easier to find. The final logging option is to not log any system events. This is certainly not recommended and used only in special circumstances. Exclude Files One common strategy when backing up a server is to exclude data that does not need to be backed up. Often, even if you are doing a normal or full backup, there are certain files you don’t want to back up. The Exclude Files tab is used to isolate files that are to be excluded from the backup. PART III Developing a Backup Strategy To create a successful backup strategy, you will often have to combine different backup methods. For example, in most organizations losing even one days’ worth of data is crippling. As such, a backup would need to be performed daily. Running a full backup once per day is often not practical considering the time it takes and the space required. Therefore, normal backups are often reserved for regular intervals—perhaps once per week. That leaves the rest of the week. To fill in these days you can use either the differential or incremental backup but not a combination of the two. If you use an differential backup, you may take a normal backup on Sunday, for example, and then daily differentials that provide a daily backup of all the files that have changed since the last normal backup. An incremental backup backs up only those files since the last normal backup or since the last incremental. This makes incremental backups the fastest and the one you should use when there is a very small backup window. When you restore from these backups, a normal backup is easiest as only a single set of tapes is needed to restore. When restoring from a strategy using differentials and normal backups, you need the latest differential backup and the latest normal backup. Finally, when you restore from a strategy using incrementals, you need all of the incremental backups and the latest normal backup. Because of this, incremental backups are the most difficult and time consuming to restore. MCSE Windows Server 2003 All-in-One Exam Guide 34 Using Volume Shadow Copy It used to be that administrators would run a backup and upon completion of the backup be greeted by a list of files that could not be backed up because they were in use by an application or locked. To get around this, many backups were conducted after hours to ensure that most of the files needing to be backed up were not in use and therefore could be backed up. This created what is known as the backup window, the time in which a backup may be performed when applications and data are not in use. Part a system administrator’s role was to develop a solution that allowed a backup to take place within this window. Windows 2003 helps get around this problem by using Volume Shadow Copy Technology (VSCT). The basic function of VSCT is threefold: • Applications can continue to write data to the volume during a backup. • Files that are open are no longer omitted during a backup. • Backups can be performed at any time, without locking out users. To enable shadow copies, you use the advanced options in the Backup utility. To access the advanced options, work your way through the steps in creating a backup as described earlier. On the final screen of the Backup or Restore Wizard is an Advanced button used to access the advanced backup options. Clicking this button will guide you through the advanced backup options, including the option to use volume shadow copies. One of the more well-known and popular backup strategies is known as the Grandfather, Father, Son (GFS) backup rotation. In this configuration, separate backup tapes are used for monthly, weekly, and daily backups. For example, you could employ the GFS strategy using 12 tapes: 4 for the daily tapes Monday through Thursday (Son), 5 for the weekly tapes (Father), and 3 for the monthly tapes (Grandfather). When restoring from backup from this strategy, it is possible to recover from a single day to several months back. However, the data from several months back may not be that useful given how fast data changes in modern organizations. Still, the option is there. Chapter 15: Maintaining Server Availability 35 Automated System Recovery In days gone by (namely, with Windows NT 4 and 2000), you had something called an Emergency Repair Disk (ERD), which could be used to attempt to repair a damaged system. With Windows Server 2003, the ERD has been replaced with the Automated System Recovery (ASR). Not only is the name different, but the contents as well. For security reasons, the ASR disks no longer contain registry data. ASR is an advanced tool designed to repair a damaged system and is often the last resort when other methods such as Safe Mode, Last Known Good Configuration, and Recovery Console have been unable to restore a system. There are two components needed to create an ASR backup. The first is the actual backup of the data and files, and the second is the creation of a floppy disk required to restore the system to its original state. The following is the procedure to create an ASR disk: PART III 1. Start the Backup or Restore Wizard by typing ntbackup in the Run dialog box or by selecting All Programs | Accessories | System Tools and then the Backup icon. 2. The first screen of the Backup or Restore Wizard displays three buttons to access the Backup, Restore, and Automated System Restore (ASR) Wizards. Click the button to start the ASR Wizard. 3. The ASR Wizard will prompt you for a location to save the backup. Choose the location and click Next. When the disk is created, there are three files created, asr.sif, asrpnp.sif, and setup.log. The asr.sif file contains the server name, master boot record and partition information, and the location of the recovery information. The asrpnp.sif file holds a list of the plug-and-play devices in the system, and the setup.log file contains information on the files that were backed up during the ASR process. System Recovery and Restore Using ASR Once the Windows Server 2003 Backup Utility has been used to create the ASR, if the system were to fail in the future it can be recovered from the time when the ASR backup was created. To restore the system state using the ASR, perform the following steps: 1. Boot from the Windows Server 2003 CD-ROM. 2. When prompted, press F2 to begin the ASR recovery process. 3. Insert your most recent ASR floppy disk in the drive when prompted. 4. Insert the backup data when prompted. 5. Follow the onscreen instructions to complete the installation. MCSE Windows Server 2003 All-in-One Exam Guide 36 EXAM TIP ASR is not a utility designed to be used for backing up or restoring data. NOTE More information on VSCT and ASR can be found in Chapter 5. Chapter Review This chapter has presented a whirlwind tour through some of the mechanisms and procedures designed to provide high availability. Server clusters use multiple server nodes to provide failover capabilities in case of system failure. Up to eight nodes can be used in a server cluster. NLB can use up to 32 nodes in a cluster and provides load balancing by dispersing client requests among several nodes. System Monitor is used to systematically find components or programs that may be causing performance bottlenecks. System Monitor uses counters to measure the physical and logical components in a system. Several of the object counters are specifically designed to track down performance bottlenecks. There are many considerations when backing up a system. ASR disks are used to back up key system information but not data. The Backup utility is used to back up all data as well as the system state. Volume shadow copy allows backups to record open files that traditionally would have been skipped over with previous backup strategies. Questions 1. If a full backup is done Friday night and a differential is done in the evening of every other weekday, what tapes would be required to complete a restore on Tuesday? A. The normal backup from Friday only B. The normal backup from Friday and three differential tape sets C. The normal backup from Friday and every differential backup since Friday D. The normal backup from Friday and the latest differential backup 2. As system administrator, you have been reviewing backup logs and discover that many of the files are open and are not being backed up during regular backups. Which of the following strategies can you use to ensure that the open files are being saved? A. Using the Advanced options in the Backup Utility, ensure that the system state is being backed up. Chapter 15: Maintaining Server Availability 37 B. Using the Advanced options in the Backup Utility, ensure that the option to use volume shadow copy is selected. C. Using the Advanced options in the Backup Utility, ensure that the option to use volume shadow copy is not selected. D. Using the Advanced options in the Backup Utility, create an ASR disk and select the Backup Open Files option. 3. You have been tasked with trying to isolate a performance bottleneck in a server system and note the following results: Average Result % Disk Time Pages/sec % Processor Time Bytes Total/sec 94 83 8 10 PART III Which system component might you replace to increase performance? A. Memory B. Processor C. Network card D. Hard disk 4. You are troubleshooting system performance on a server and suspect that there is a processor bottleneck. Which of the following counters would you choose to monitor processor activity? (Choose two.) A. % Disk Time B. % Processor Time C. Current Processor Queue Length D. Interrupt/sec 5. As system administrator, you decide to implement NLB clusters using a single network adapter in the host nodes. In this configuration, which of the following statements is true? A. When using a single adapter in unicast mode, node-to-node communication is not possible and nodes within a cluster cannot communicate with each other. B. When using a single adapter in multicast mode, node-to-node communication is not possible and nodes within a cluster cannot communicate with each other. C. When using a single adapter, node-to-node communication is not possible. D. When using a single adapter, NLB cluster protocol must be bound to the network adapter. MCSE Windows Server 2003 All-in-One Exam Guide 38 6. You are managing an NLB cluster and want to suspend the cluster for maintenance. Which of the following commands will suspend the cluster? A. nlb subnet mask halt B. nlb ip address halt C. nlb suspend D. nlb halt 7. Which of the following commands creates a new quorum log file based on information in the local node’s cluster database file? A. clussvc /resetquorumlog B. clussvc /rebuildlog C. nlb /resetquorumlog D. clussvc /rebuildlog 8. Which of the following best describes a single shared quorum? A. The local disk is configured as the cluster quorum device. B. The quorum is placed on a shared storage device in the cluster which all cluster nodes can access. C. The quorum requires that cluster configuration information be stored on the local disks of each node. D. The quorum requires that cluster configuration information be stored on external storage devices. 9. Which of the following commands is used to verify the status of a server cluster? A. clussvc /verify B. cluster /cluster name node node name /status C. clussvc /cluster name node node name /status D. cluster /cluster name node node name /verify 10. Which of the following methods are used to back up the quorum data? A. The Backup or Restore Wizard is used to back up the cluster quorum when you perform a system state backup from any node. B. The Backup or Restore Wizard is used to back up the cluster quorum when you perform a system state backup from all nodes. Chapter 15: Maintaining Server Availability 39 C. The ASR process is used to back up the cluster quorum when you perform a system state backup from any node. D. The ASR process is used to back up the cluster quorum when you perform a system state backup from all nodes. Answers 1. D. To restore from a differential backup, you will need the latest full backup as well as the most recent differential backup. 2. B. If the volume shadow copy feature is enabled, files that are open are no longer omitted during a backup. 3. A. The results of the System Monitor show high average for both the % Disk Time and Pages/sec. This is an indication that there is a lot of paging going on and the hard disk is having trouble keeping up. Adding more memory will reduce the amount of paging necessary. The % Processor time and Bytes Total/ sec are within acceptable parameters. 4. B and D. The % Processor Time is the primary indicator of processor activity, and the Interrupt/sec counter monitors how often the processor is interrupted to handle hardware requests. Answer A is incorrect as % Disk Time is a PhysicalDisk counter, and answer D is not a valid counter. 5. A. When using a single adapter in unicast mode, node-to-node communication is not possible and nodes within a cluster cannot communicate with each other. All of the other answers are invalid. 6. C. The command nlb suspend will suspend the NLB cluster until it is started again. 7. A. The clussvc /resetquorumlog command is used to create a new quorum log file based on information in the local node’s cluster database file. All of the other answers are invalid. 8. B. The single shared quorum model places quorum resources on a shared storage device in the cluster which all cluster nodes can access. 9. B. The cluster.exe command is used to manage server clusters from the command line. The /status option is used to verify the status of the cluster. All other answers are invalid. 10. A. When backing up the quorum data, the Backup or Restore Wizard is used to back up the cluster quorum when you perform a system state backup from any node. After you back up the cluster quorum disk on one node, it is not necessary to back up the quorum on the remaining cluster nodes. PART III
"70-270 Chapter 15"