September 03, 2010

Joerg Moellenkamp$7.4 billion was really a steal ...

September 03, 2010 04:38 GMT
$2.07 billion for 3PAR - a company just working in the storage area - ... now i'm sure that $7.4 billion for Sun was a steal.

Ben RockwoodDevops Days Silicon Valley: What You Missed

September 03, 2010 04:06 GMT

All the panels from the Silicon Valley DevOps Days are now online. A huge round of applause for InfoQ for putting this entire event online and making it available to the world.

If you want a glimpse into the next 10 years of system administration as a career path, you need to get up to speed now so it doesn't take you by surprise in the coming years.

September 02, 2010

Joerg MoellenkampA really long rant ...

September 02, 2010 19:18 GMT
I sat a on my fingers for all the weekend but now i can't take all this comments in the blogs and the mailing lists any longer. Ten years ago, i would have gone ballistic long ago... but the fuse got longer of the past few years. However i'm still able to detonate, however despite the undirected explosion 10 years ago, it's more directed today.

And this article is such a directed explosion. I worked a while on this article and this was one of the reasons why it was relatively silent on this blog the last few days. At first i didn't wanted to publish it, but some events of today led me to think otherwise. I don't know if this is a wise move, because the torch of this rant will burn down some beards. On the other side, i think the article is worth the publication, but you have to judge about that.

However i try to prevent me from exploding thus i used this weekend to play with my new toy (i purchased an iPad last week and it's really fscking cool, i just thought "Like Enterprise ... i just wouldn't gave them away like they do in TNG" ) and worked a lot on the planing on the modifications on my newly purchased building.

However the mail by Garrett d'Amore asking about the removal of SVM was a drop. It was one of those drops, that led to a severe spill-over. So this blog article will be a long rant. If you don't like rants, just skip this.

And keep in mind, it's a rant ... it's not meant to be fair or objective ... think of it as a way to write down my frustration about a lot of events in the last few weeks and especially in the last few days.
Continue reading "A really long rant ..."

Joerg Moellenkamplinks for 2010-09-02

September 02, 2010 19:00 GMT

September 01, 2010

Garrett D'Amoreillumos Interest Groups

September 01, 2010 19:26 GMT
So, I've been asked by several people who are involved with OpenSolaris User Groups around the world about illumos.

Given the clear demise of OpenSolaris, it seems to me at least, to be kind of silly to continue to meet using that name.

Some groups have reverted to pure Solaris usage. Which is fine for those groups that want to focus on Oracle products and want to come under the Oracle umbrella that it has for user groups.

For groups that are more interested in open technology, perhaps it is time to start up some "illumos interest groups" (IIGs)? (Calling them "User Groups" at this point seems rather premature... I think there are only a very few of us that are actually "using" illumos at this point.. but I hope that number to grow very much very soon. :-)

Btw, are there any folks interested in illumos in either Riverside County or North San Diego County? (California) I'd be interested in participating in an interest group if there was one that didn't require me to drive over an hour to get to.

Joerg MoellenkampRelative Silence

September 01, 2010 19:19 GMT
Just in case you wonder about the relative silence in this blog ... i wrote a longer article in the last few days circling about Illumos, OpenSolaris, the Java lawsuit, some people in the Solaris community, an article about the live, the universe and all the rest ... it was a large big rant. I've decided not to put it on the blog ... a lot of work in the evenings for the bucket ... but believe me ... it's better that way ;-)

Garrett D'AmoreOpenSolaris ARC is Dead

September 01, 2010 19:05 GMT
I had tried to dial in to ARC today, but no luck. But then someone else pointed out that we have not seen any ARC cases since the tap was turned off.

In fact, I posted a query about this to the opensolaris-arc mailing list today, and I got back an interesting automated reply:

This mailing list is no longer active and accepting posts. Mailing
list archives can be found at
http://mail.opensolaris.org/pipermail/opensolaris-arc/. You can check
http://mail.opensolaris.org/mailman/listinfo to find another list to
which to send your email.


So, OpenSolaris ARC is dead. This has ramifications that go beyond just ON. Because there are other consolidations that we were promised were going to continue to be developed in the open: JDS, X11, and the pkg-gate. If the decisions for these technologies are no longer being made openly, or even the opinions being made available, then this makes Oracle's promise to continue to work with the community on them seem hollow.

So, what's left for "OpenSolaris" as so named? There are some code drops still being made. How long will that keep up? Are they continuing to take contribution from external parties? (I don't work on those gates, so I don't really know.) I'd like to know if the other consolidations have shut down too. At least the key decisions relating to those consolidations seem to have moved behind closed doors.

Joerg Moellenkamplinks for 2010-09-01

September 01, 2010 19:00 GMT

August 31, 2010

Marcelo LealPerformance II

August 31, 2010 22:39 GMT
In my last post about “Performance“, i did talk about a ZFS tuning parameter: zfs_prefetch_disable. And that was a ZFS read parameter… In this post, we will take a look in another one, with the same “water to wine” effect. This time with focus on writes… We have a set of informations available for our [...]


Constantin GonzalezTop 11 Things You Can Do Now To Prepare For Oracle Solaris 11

August 31, 2010 20:58 GMT
Solaris_11_Road.jpg

Oracle Solaris 11 is the future of enterprise IT, that is now clear.

Still, we need to wait a year until it is officially released. What can we do now? Well, quite a lot, it turns out. Even if the preview version (due later this year) hasn't been relased yet, there are a lot of things you can do to prepare for the big OS upgrade.

Here's a list of 11 things you can do now to start enjoying the benefits of Solaris 11, get ahead of your system peers and be a part of the future of Solaris now!

#1: Check out a Preview of the Preview

If you've been following the OpenSolaris project, then you no doubt have noticed, that it already is a preview of the next version of Solaris. Therefore, OpenSolaris 2009.06 is technically a preview to Oracle Solaris 11.

Want something more recent? Download Developer Build 134 of OpenSolaris, which is the most recent publicly available OpenSolaris developer build.

That should give you something nice to play with until the official Preview of Oracle Solaris 11 becomes available.

#2: Find Your Hardware On The Compatibility List

A lot of hardware has been tested with OpenSolaris already, it is documented on the Oracle Solaris Hardware Compatibility List. You'll likely find a lot of popular server equipment there.

Even if at first you don't find your exact hardware component, it's worth searching for your hardware's chipset or a close relative. Most of the time it's close enough to run OpenSolaris on.

And if you find new hardware that works well with OpenSolaris, then feel free to submit it to the HCL so others can benefit from it.

#3: Virtualize Your Hardware For Oracle Solaris 11

If you want to get familiar with new technologies that aren't ready for prime time yet, it's preferable to use a virtualized server. This also allows you to preview Oracle Solaris 11 on your laptop without having to reinstall everything.

Oracle has two great virtualization technologies that you can use for free:

Download one of these now and get started with your Solaris 11 preview installation!

#4: Join a Local OpenSolaris User Group

When trying out new Solaris features, it's good to be in touch with people like you. That's where OpenSolaris User Groups come in. And don't get hung up on the naming details between "OpenSolaris" and "Solaris 11". It's all Solaris, and its all about great OS technology!

There are several dozen Solaris groups world-wide to choose from. They meet regularly and chances are that one is near your town already. Typically, they host interesting presentations on new technologies, install parties or just informal gatherings where you can discuss any Solaris related news over a beer or two.

#5: Join One or More Solaris Related Discussion Lists

Every user group, every major Solaris technology and almost every other Solaris related topic can be found in one of the many OpenSolaris discussion lists.

The majority of discussions on OpenSolaris.org mailing lists are centered around technology topics and the mailing list members are very approachable. Many of them work at Oracle and are eager to help out with understanding Solaris, solve technology problems or take feedback and helpful suggestions.

So check out your favorite topics and join one or more mailing lists now!

#6: Get Ready for the Future of Solaris Networking with Crossbow

Project Crossbow provides the building blocks for network virtualization and resource control. It was introduced with OpenSolaris 2009.06 and it will completely change the way you think about networking.

Crossbow lets you create new virtualized NICs with a single command. You can attach it to a Solaris Container, wire it up to a virtualized switch or route in and out of it. You can create as many virtualized interfaces as you want, measure, control and limit traffic through them and take complete control of all things networking in your datacenter infrastructure.

Check out the Crossbow website for an introduction to the topic, view the documentation, join the crossbow-discuss mailing list and try out some examples.

#7: Get Ready for the Future of Storage Virtualization with COMSTAR

Another landmark project in Solaris is COMSTAR, which is a software framework that enables you to turn any OpenSolaris host into a SCSI target that can be accessed over the network by initiator hosts. Together with ZFS volumes (ZVOLs), this is your ticket to storage virtualization: Create arbitrarily sized, highly available, integrity proofed and self-healing LUNs, then share them on the network via iSCSI, fibre channel or other protocols.

On the internet, nobody knows your dog is the LUN, they say.

Seriously, check out the COMSTAR pages, read the COMSTAR documentation, check out some COMSTAR + ZFS demos and join the OpenSolaris storage discussion mailing list.

#8: Check Out Some Advanced ZFS Features

While we're at it: A lot has been integrated into ZFS since OpenSolaris 2009.06 that you should be prepared for when looking forward to Solaris 11.

The biggest is probably Deduplication but there are numerous other enhancements that are in the works. Some insight into ZFS enhancements are available in the ZFS: The Next Word talk.

And of course, it never hurts to join the ZFS community.

Because the truth is: ZFS has never been better than now, and its future has just started!

#9: Familiarize Yourself With the Image Packaging System

In OpenSolaris, there's a major effort at redesigning the packaging, install and patch system. And it is expected that this will continue throughout the development of Solaris 11, too.

Two projects are important here: The Image Packaging System (IPS) and the Caiman installer. If you want to learn how to write software for Solaris 11, install it, patch it, both manually or automatically over the network, then it's a good idea to study these two projects.

Granted, there's still a lot to do, and there are some interesting discussions around what IPS can and cannot do, but however you put it, now is the time to join these communities, participate in discussions and provide your feedback.

Oh, and while you're at it, check out the Software Porters community as well, because a lot of packages are waiting to be integrated with IPS and Solaris 11, too.

#10: Get Ready for Migrating Solaris 10

The Solaris branded zone technology has recently gotten an interesting feature: Now you can create Solaris 10 branded zones inside OpenSolaris. This provides an elegant, efficient and convenient way for easily migrating your existing Solaris 10 deployments into more recent versions of Solaris.

More information can be found in the Solaris10 Branded Zone Developer Guide and by joining the zone community.

#11: Get Ready for Oracle OpenWorld

Oracle OpenWorld 2010 on September 19-23 is definitely the place to be if you want to learn more about Oracle Solaris 11, Oracle Sun Systems and anything else about Oracle as well.

Don't miss it if you're lucky enough to be in the San Francisco area, otherwise follow the event on the web or visit Oracle's customer events throughout the world that are scheduled to happen right after OpenWorld. Who knows, we might just bump into each other!

How do YOU prepare for Solaris 11?

These are just some suggestions for preparing for Oracle Solaris 11 now. I'm sure you'll find a lot more.

What are you doing to prepare for Solaris 11? What features do you look forward to? Make yourself heard in the comments section!

Oh, and don't forget to add this blog to your favourite reader and stay tuned for more Solaris 11 related posts.

<""><>''

Blog O' MattyMy take on Android vs. iPhone

August 31, 2010 20:28 GMT
After months and months of research, I finally broke down a few weeks ago and purchased a smart phone. When I first decided to replace my aging Motorola RAZR, I wanted something that didn’t cost a fortune and provided a basic ‘net experience when i was away from my Mac. After playing around with a [...]

Blog O' MattyForcing your Linux users to wait after they input an incorrect password

August 31, 2010 20:20 GMT
When I run through my security checklist after building a host, one of the first things I change is the login fail delay. This option allows you to force a user to wait a given number of microseconds after a login failure before being able to try another password. For applications that perform brute force [...]

Joerg Moellenkamplinks for 2010-08-31

August 31, 2010 19:00 GMT

Joerg MoellenkampFundamentally flawed statistics

August 31, 2010 11:27 GMT
Last week i've reported about the point that the X-Force numbers regarding unpatched disclosures could be sorted in a different way to yield a completely different view on the data. More interesting is a recent development: After reassessing the data, many of the vulnerabilities had to be sorted into different categories. So the numbers were fundamentally incorrect as well.

The list changed a lot due to this changes: Sun went from 9% high+critical to 0%. IBM leads the pack with 29% unpatched high+critical vulnerabilities without patches. However 22% for Oracle doesn't look that good as well. You will find the updated list in the blog entry " Mid-Year 2010 X-Force Trend and Risk Report - Update to Unpatched Vulnerabilities Chart".

August 30, 2010

Blog O' MattyImplementing a home security alarm on the cheap

August 30, 2010 20:22 GMT
I currently live in an apartment, and was looking for a cheap and easy solution to sound off an alert if a door or window was opened. Most home security systems are really tailored for houses, and I wasn’t real found of paying $30 – $40 per month to monitor a relatively secure apartment. After [...]

Blog O' MattyUsing pam_time.so to control when people can log into your servers

August 30, 2010 20:12 GMT
Most admins have to support system logins in one form or another. These logins include everything from application service accounts, operations accounts, SysAdmin accounts and pretty much everything else you can think of. Some of these accounts may not need to access your servers 24/7, and you may want to limit the timeframes when users [...]

Joerg Moellenkamplinks for 2010-08-30

August 30, 2010 19:00 GMT

Garrett D'AmoreWhy SAS->SATA is not such a great idea

August 30, 2010 16:23 GMT
So, we've had some "issue" reports relating to the mpt driver. In almost all cases, the results are related to situations where people are using SATA drives, and hooking them into SAS configurations.

Although the technology is supposed to work, and sometimes it works well, its a bad idea.

Let me elaborate:


Don't get me wrong. For many uses, SATA drives are great. They're great when you need low cost storage, and when you are connecting to a system that is purely SATA (such as to an AHCI controller), there is no reason to be concerned.

But building a system that relies upon complex protocol conversion in hardware, just adds another level of complexity. And complexity is evil. (KISS).

So if you want enterprise SAS storage, then go ahead and spring for the extra cost of drives that are natively SAS. Goofing around with the hybrid SAS/SATA options is just penny wise, and pound foolish.

But hey, its your data. I just know that I won't be putting my trusted data in a configuration that is effectively undebuggable.

(Note: the above is my own personal opinion, and should not be construed as an official statement from Nexenta.)

Aug 30, 2010: Update: At a significant account, I can say that we (meaning Nexenta) have verified that SAS/SATA expanders combined with high loads of ZFS activity have proven conclusively to be highly toxic. So, if you're designing an enterprise storage solution, please consider using SAS all the way to the disk drives, and just skip those cheaper SATA options. You may think SATA looks like a bargain, but when your array goes offline during ZFS scrub or resilver operations because the expander is choking on cache sync commands, you'll really wish you had spent the extra cash up front. Really.

Bryan CantrillDTrace, node.js and the Robinson Projection

August 30, 2010 09:55 GMT

When I joined Joyent, I mentioned that I was seeking to apply DTrace to the cloud, and that I was particularly excited about the development of node.js — leaving it implict that the intersection of the two technologies would be naturally interesting, As it turns out, we have had an early opportunity to show the potential here: as you might have seen, the Node Knockout programming contest was held over the weekend; when I first joined Joyent (but four weeks ago!), Ryan was very interested in potentially using DTrace to provide a leaderboard for the competition. I got to work, adding USDT probes to node.js. To be fair, this still has some disabled overhead (namely, getting into and out of the node addon that has the true USDT probe), but it’s sufficiently modest to deploy DTrace-enabled node’s in production.

And thanks to incredibly strong work by Joyent engineers, we were able to make available a new node.js service that allocated a container per user. This service allowed us to make available a DTrace-enabled node to contestants — and then observe all of that from the global zone.

For example of the DTrace provider for node.js, here’s a simple enabling to print out HTTP requests as zones handle them (running on one of the Node Knockout machines):

# dtrace -n 'node*:::http-server-request{printf("%s: %s of %s\n", \
    zonename, args[0]->method, args[0]->url)}' -q
nodelay: GET of /poll6759.479651377309
nodelay: GET of /poll6148.392275444794
nodebodies: GET of /latest/
nodebodies: GET of /latest/
nodebodies: GET of /count/
nodebodies: GET of /count/
nodelay: GET of /poll8973.863890386003
nodelay: GET of /poll2097.9667574643568
awesometown: GET of /graphs/4c7a650eba12e9c41d000005.js
awesometown: POST of /graphs/4c7a650eba12e9c41d000005/appendValue
awesometown: GET of /graphs/4c7acd5ca121636840000002.js
awesometown: GET of /graphs/4c7a650eba12e9c41d000005.js
awesometown: GET of /graphs/4c7a650eba12e9c41d000005.js
awesometown: GET of /graphs/4c7a650eba12e9c41d000005.js
awesometown: GET of /graphs/4c7b2408546a64b81f000001.js
awesometown: POST of /faye
awesometown: POST of /faye
...

I added probes around both HTTP request and HTTP response; treating the file descriptor as a token that describes that uniquely describes that request while it is pending (an assumption that would only be invalid in the presence of HTTP pipelining), allows one to actually determine the latency for requests:

# cat http.d
#pragma D option quiet

http-server-request
{
        ts[this->fd = args[1]->fd] = timestamp;
        vts[this->fd] = vtimestamp;
}

http-server-response
/this->ts = ts[this->fd = args[0]->fd]/
{
        @t[zonename] = quantize(timestamp - this->ts);
        @v[zonename] = quantize(vtimestamp - vts[this->fd]);
        ts[this->fd] = 0;
        vts[this->fd] = 0;
}

tick-1sec
{
        printf("Wall time:\n");
        printa(@t);

        printf("CPU time:\n");
        printa(@v);
}

This script makes the distinction between wall time and CPU time; for wall-time, you can see the effect of long-polling, e.g. (the values are nanoseconds):

    nodelay
           value  ------------- Distribution ------------- count
           32768 |                                         0
           65536 |                                         4
          131072 |@@@@@                                    52
          262144 |@@@@@@@@@@@@@@@@@@                       183
          524288 |@@@@@                                    55
         1048576 |@@@                                      27
         2097152 |@                                        9
         4194304 |                                         5
         8388608 |@                                        8
        16777216 |@                                        6
        33554432 |@                                        9
        67108864 |@                                        7
       134217728 |@                                        12
       268435456 |@                                        11
       536870912 |                                         1
      1073741824 |                                         4
      2147483648 |                                         1
      4294967296 |                                         5
      8589934592 |                                         0
     17179869184 |                                         1
     34359738368 |                                         1
     68719476736 |                                         0

You can also look at the CPU time to see those that are doing more actual work. For example, one zone with interesting CPU time outliiers:

  nodebodies
           value  ------------- Distribution ------------- count
         4194304 |                                         0
         8388608 |@@@@@@@@@@@@                             57
        16777216 |@@@@                                     21
        33554432 |@@@@                                     18
        67108864 |@@@@@@@                                  34
       134217728 |@@@@@@@@@@@                              54
       268435456 |                                         0
       536870912 |                                         0
      1073741824 |                                         0
      2147483648 |                                         0
      4294967296 |@                                        3
      8589934592 |@                                        4
     17179869184 |                                         0

Note that because node has a single thread do all processing, we cannot assume that the requests themselves are inducing the work — only that CPU work was done between request and response. Still, this data would probably be interesting to the nodebodies team…

I also added probes around connection establishment; so here’s a simple way of looking at new connections by zone:

# dtrace -n 'node*:::net-server-connection{@[zonename] = count()}'
dtrace: description 'node*:::net-server-connection' matched 44 probes
^C

  explorer-sox                                                      1
  nodebodies                                                        1
  anansi                                                           69
  nodelay                                                         102
  awesometown                                                     146

Or if we wanted to see which IP addresses were connecting to, say, our good friends at awesometown (with actual addresses
in the output elided):

# dtrace -n 'node*:::net-server-connection \
    /zonename == "awesometown"/{@[args[0]->remoteAddress] = count()}'
dtrace: description 'node*:::net-server-connection' matched 44 probes
  XXX.XXX.XXX.XXX                                                   1
  XX.XXX.XX.XXX                                                     1
  XX.XXX.XXX.XXX                                                    1
  XX.XXX.XXX.XX                                                     1
  XXX.XXX.XX.XXX                                                    1
  XXX.XXX.XX.XX                                                     2
  XXX.XXX.XXX.XX                                                    8

Ryan saw the DTrace support I had added, and had a great idea: what if we took the IPs of incoming connections and geolocated them, throwing them on a world map and coloring them by team name? This was an idea that was just too exciting not to take a swing at, so we got to work. For the backend, the machinery was begging to itself be written in node, so I did a libdtrace addon for node and started building a scalable backend for processing the DTrace data from the different Node Knockout machines. Meanwhile, Joni came up with some mockups that had everyone drooling, and Mark contacted Brian from Nitobi about working on the front-end. Brian and crew were as excited about it as we were, and they put front-end engineer extraordinaire Yohei on the case — who worked with Rob on the Joyent side to pull it all together. Among Rob’s other feats, he managed to implement in JavaScript the logic for plotting longitude and latitude in the beautiful Robinson projection — which is a brutally complicated transformation. It was an incredible team, and we were pulling it off in such a short period of time and with such a firm deadline that we often felt like contestants ourselves!

The result — which it must be said works best in Safari and Chrome — is at http://leaderboard.no.de. In keeping with both the spirit of node and DTrace, the leaderboard is updated in real-time; from the time you connect to one of the Joyent-hostest (no.de) contestants, you should see yourself show up in the map in no more than 700 milliseconds (plus your network latwork latency). For crowded areas like the Bay Area, it can be hard to see yourself — but try moving to Cameroon for best results. It’s fun to watch as certain contestants go viral (try both hovering over a particular data point and clicking on the team name in the leaderboard) — and you can know which continent you’re cursing at in http://saber-tooth-moose-lion.no.de (now known to the world as Swarmation).

Enjoy both the leaderboard and the terrific Node Knockout entries (be sure to vote for your favorites!) — and know that we’ve only scratched the surface of what DTrace and node.js can do together!

August 29, 2010

Joerg Moellenkamplinks for 2010-08-29

August 29, 2010 19:00 GMT

August 28, 2010

Joerg Moellenkamplinks for 2010-08-28

August 28, 2010 19:00 GMT

Ben RockwoodTime Management Tips from Randy Pausch

August 28, 2010 09:10 GMT

Randy Pausch, you may recall, became infamous because of his dying "Last Lecture". Just tonight I happened to come across a talk he did on Time Management, "because time is all we have." As he particularly pointed out, "you may have less of it than you think." Time management tips from a dying man, who better to speak on the subject?

Whats shocking to me is that the talk is not philosophical, rather its 1 hour 16 minutes of non-stop practical pointers, ideas and applications.

Randy Pausch Lecture: Time Management

I think my chief takeaway was that time is, and should be treated as, a precious commodity. If you are spending time, it should be on something worthy of that sacrifice. What this also implies is that if someone wants my time, I should ensure they are using my time wisely. Time is not an infinite resource.

This point is particularly key to me because I am a wanna-be perfectionist. I will drag on and on and on for days, weeks, months trying to think something through before truly devoting myself to it. For code this means that I want to be able to visualize all the logic before I start writting. Now, this is an entirely flawed concept, because any reasonably complex program is going to have more lines of code in it that you can keep in your head. Therefore, when I try to visualize everything I'm actually just moving from visualizing one small part to another, and loosing something during the mental context switch. I should instead just start writing the program and then deciding ahead of time to improve it later. This is essentially my version of "a working program today is better than a perfect program in a year".

I'm reminded of a phrase I cooked up with Tamarah (my wife, the lovely women above) several years ago. When discussing something emotional and complex, you can spend a lot of time thinking over and re-thinking the right way in which to phrase it to provide clarity. But this is exceptionally hard to do and very time consuming. Therefore, when we see eachother in this "I'm not sure how to put it..." pause, we will say: "Badly... and work from there." So we work in drafts, making it clear that the first draft is probably horrifically inaccurate and wrong, but we'll work towards clarity together and in doing so get a clearer picture of the topic than we'd ever get from the perfect one line explanation.

For sysadmins I find this really hard. It seems all we sysadmins are both perfections and ADHD at the same time. I wish I were exaggerating, but most of us really actually are clinically hyperactive... its a job qualification. The problem is that while we can keep a lot of plates spinning, we're very bad (on the whole) of providing timely delivery with high quality, unless an external force demands it. This is why sysadmins have to have managers. Geeks without overlords will do amazing things and deliver very few of them. (The description of a good overlord is an excessive left for the reader.)

I digress. I personally recommend watching this video repeatedly, say every 3 months. I re-watch David Allen's GTD talk at Google every couple months already. I always find something new in it and it's a great reminder to get back on the wagon. More importantly, personal management is dry and tedious, so hearing enthusiastic guys like David Allen or even Tony Robbins (say what you will, his TED talk was fantastic) can be a real pick-me-up.

August 27, 2010

Joerg Moellenkamplinks for 2010-08-27

August 27, 2010 19:00 GMT

Joerg Moellenkamp13. HHOSUG Meeting

August 27, 2010 18:11 GMT
Nach der Sommerpause findet nun wieder ein HHOSUG Meeting statt. Am 23. September (nicht zufällig einen Tag nach der Oracle Open World) findet um 19:00 Uhr das 13. HHOSUG Meeting in der Hamburger Oracle Geschäftsstelle am Nagelsweg 55 statt.

Agenda bisher:
1. Wie gehts mit der HHOSUG weiter? Weiterführung der Diskussion vom letzten Mal.
2. Was zwischenzeitlich passierte? (Illumos, die merkwürdige Mail, Solaris 11 Announcement)
3. Was gabs auf der Oracle Open World für Solaris an relevanten Announcements?
4. ...

Weitere Vorschläge und Vorträge sind erbeten :-)

Bitte wegen der Pizzabestellung entweder via Xing anmelden oder eine Mail an hhosug13@joerg.moellenkamp.org schicken.

Adam LeventhalThe future of Solaris

August 27, 2010 09:11 GMT

In 2005, Sun released the source code to Solaris,  described then as the company’s crown jewel. Why do this? The simplest answer is that Solaris had been losing ground to an open source competitor in Linux. Losing ground was a symptom of  economics. Students who had once been raised on Solaris were being inculcated with Linux knowlege. The combination of Linux and x86 were good enough and significantly cheaper; new companies for whom the default had once been Sun/Solaris/SPARC were instead building on x86/Linux. OpenSolaris along with x86 support were specifically intended to address this trend. Indeed, the codename for OpenSolaris was “tonic” — the tonic for Solaris’ problems.

To that end, OpenSolaris was on reasonably stable footing: open source had become expected for an operating system,  source code availability was a benefit to traditional enterprise users (especially with the advent of DTrace), and the community would attract new users. But then Solaris lost the plot. Users chose Solaris because it is a — or perhaps the — enterprise operating system. OpenSolaris was intended to broaden the appeal, but that notion was taken to such extremes as to lose sight of the traditional customers of Solaris, and, indeed, the focus that makes Solaris both unique and great.

OpenSolaris  June 14, 2005 – August 13, 2010

We launched Solaris 10 in 2004 with an impressive list of features — ZFS, DTrace, Zones, SMF, FMA, Fire Engine — all highly relevant for enterprise users. You can find a company that has bet its business on the success of each of those features. In the wake of OpenSolaris, the decision was made (and here I can no longer use the active voice because by then I had left to start Fishworks elsewhere at Sun) to have an explicit focus on building an operating system for developers — which is to say, for their laptops. This was an error, but a predictable one. Once Solaris was free to download and use, revenue recognition for the Solaris organization which has always been difficult to measure became even more indirect. The metrics were changed: the targets for management bonuses became not revenue, or enterprise users, but downloads. Directly or indirectly much of the focus for the Solaris organization shifted to address that straightforward goal. The mistake was that OpenSolaris didn’t need to find users, they found Solaris. In trying to build a community, the new direction for OpenSolaris weakened the very principles upon which a thriving community would have been based.

The very name “OpenSolaris” got confused, diluted, and poluted. OpenSolaris was a source repository, a community, and a distro (although purists still insist that Indiana is the appropriate name for that part) intended to “close the familiarity gap” with Linux. Moreover, new projects that shifted efforts away from enterprise uses (read: paying customers) to focus on the laptop also rallied under the banner of “OpenSolaris”. In a way Oracle’s acquisition of Sun saved Solaris from itself; the marching orders became much clearer: address enterprise users, ship Solaris 11 (something that should not have taken 6 years). As for OpenSolaris, that decision too was likely simple for Oracle, never an overt fan of open source. Had “OpenSolaris” simply meant a code base and user community, I think there’s a good chance it would have been allowed to live. Burdened, however, with the baggage of the Indiana distro and sundry projects incomprehensible to Oracle management, OpenSolaris was in a politically untenable position. Mike‘s “Friday the 13th memo” merely made it official — Solaris was to be closed source once more.

Sun’s efforts with OpenSolaris  were, at best, a mixed success. Quietly, however, an ecosystem of companies grew out of the technologies in OpenSolaris. Notably Joyent uses Zones and DTrace as significant differentiators; Nexenta builds very heavily on ZFS; as I’ve mentioned, Delphix, my new employer, builds on OpenSolaris as well. There are many more that I know about, and still more that I don’t. These companies chose OpenSolaris so they could use the innovative technologies that simply aren’t available anywhere else. And they did so in spite of a common trend towards Linux with its familiarity, and broad compatibility — the innovation in Solaris was more valuable and, in some cases, enabling for the company’s business.

illumos  August 3, 2010 -

The danger for those companies has long been that Oracle would pull the rug out from under them; only the foolish had no contingency plan. The options were to give up on Solaris or maintain a fork. Happily illumos has stepped in to offer a third path. Garrett D’Amore and Nexenta graciously started the illumos project to carry the OpenSolaris torch. It is an ostensible fork of OpenSolaris (can you fork a dead project?), but more importantly a mechanism by which companies building on those component technologies can pool their resources, amortize their costs, and build a community by and for the downstream users who are investing in those same technologies. Rather than being operated by a single corporate interest, its steward will be a 501(c)(3) non-profit in the model of the Mozilla Foundation.

I was pleased to announce at tonight’s SVOSUG meeting that I’ll be joining the illumos developer council, I was delighted to accept when Garrett offered me the position. My bias for illumos is that the main repository will focus on reliability, performance, and compatibility while taking a conservative approach to new features and functionality. As much as possible, I’d like the downstream users — the distributions, appliances, and platforms — to make the decisions appropriate to their uses and only adopt large-scale changes into the trunk when there’s broad consensus among them. The goal must be to build a project that is readily useful to everyone and to allow our collective efforts to be shared as easily as possible.

What’s the future of Solaris? For many it will be Solaris 11 in late 2011. But for others, it will be illumos either as the firmware for an appliance (not unlike what we built at Fishworks in the 7000 series), the platform for your web applications, or as a general purpose operating system. The innovation in Solaris has always flowed from the creative individuals working on the project. Keep your eyes on illumos; Oracle ending OpenSolaris is no surprise, but in doing so they have broken their own monopoly on Solaris and Solaris talent.

Joerg MoellenkampStatistics

August 27, 2010 07:17 GMT
At the moment you read a lot about this X-Force report and Sun is said to keep more vulnerabilities unpatched. But More interesting than the number of unpatched number of patches is the number of "Percentage of Critical and High 2010 H1 Disclosures with no patch" on page 20 in this report.

1. Google: 33%
2. IBM: 29% (the owner of X-Force)
3. Oracle: 22%
4. Linux: 20%
5. Microsoft: 11%
6. Novell: 10%
7. Sun: 8%

Joerg MoellenkampInteresting perspective about the Oracle vs. Google

August 27, 2010 06:48 GMT
Chris Wong writes in "Why Java needs Oracle":
Java itself succeeded because of Sun's corporate backing. Today, Java still needs a sponsor, and that appears to be Oracle. It was either Oracle or IBM: two Old Ones who are very much invested in Java's success. Both vied to acquire Sun, and the decision was made for us. For better or for worse, Oracle is now Java's champion and protector. The legal landscape is too dangerous out there for a major platform to be without one.

Joerg MoellenkampOld code set free - again

August 27, 2010 04:20 GMT
Some code is so old that it predates the "invention" ( ;-) ) of free software by the FSF. Such an example is the RPC code provided by Sun to the world under a permissive license in 1984 and it was use in many implementations like the one used in Linux to provide NFS services. This was possible due to the licensing Sun choose at that time:
Sun RPC is a product of Sun Microsystems, Inc. and is provided for
unrestricted use provided that this legend is included on all tape
media and as a part of the software program in whole or part. Users
may copy or modify Sun RPC without charge, but are not authorized
to license or distribute it to anyone else except as part of a product or
program developed by the user.

However it isn't technically free software, as it was freeded before free software was formally defined ... and out of some strange reasons, people found the license now free enough. In some Linux distributions this situation was considered as a serious bug (I would file a bug against something different in regard of this, but that's a different story ;-) ) However due to whatever reasons, this particular issue wasn't resolved for years ...

As Tom Callaway wrote in a recent blog entry, this situation has been resolved now:
So, we restarted the effort with Oracle, and on August 18, 2010, Wim Coekaerts, on behalf of Oracle America, gave permission for the remaining files that we knew about under the Sun RPC license (netkit-rusers, krb5, and glibc) to be relicensed under the 3 clause BSD license.

August 26, 2010

Ben RockwoodSilicon Valley OpenSolaris User Group Lives: Meeting Tonight!

August 26, 2010 18:53 GMT

Sorry for the late notice, but SVOSUG is meeting tonight. Myself and several folks from the Joyent crew will be onhand.

6:45pm
274 Castro Street, Suite 204
Mountain View
above Meyer Appliance & Kitchens look for the OpenSolaris sign on the door 

Tonights guest will be Garrett D'Amore presenting Illumos and Anil Gulecha presenting Nexenta.

The discussion will really be in essence about the rebirth of OpenSolaris in a post-Oracle era.

If you can't attend in person, it will be webcast: http://www.ustream.tv/channel/svosug-feed2

Be there in person or attend the webcast, but don't miss it!

A big thanks goes out to Alta Elstad for keeping the faith and keeping SVOSUG alive! Alta rules!

Tim Fosterpkglint(1)

August 26, 2010 02:03 GMT

Some pocket lint, found in my jeans when I did this putback.

With the recent putback to the IPS gate:

changeset:   2046:2522cde7adc2
tag:         tip
user:        Tim Foster
date:        Thu Aug 26 13:11:20 2010 +1200
description:
	13536 We need a way to audit one or more packages
	15860 publication api needs auditing phase
	15862 pkglint tool needed aid in package creation and auditing
	16828 ProgressTracker should make it easier for others to interleave output
	16875 we should be able to execute tests directly from the source
	16800 pkglint should allow signature actions in obsolete and renamed manifests

we now have pkglint(1), a tool that can check package metadata for common errors before publishing. We never really had an equivalent for SVR4 packages, although many have written scripts to do so. The pkglint man page documents how the tool works.

Out of the box, the below checks are performed on manifests, either retrieved from a repository, or passed as local files on the command line. It’s also pretty easy to extend pkglint(1) with your own checks (details in the man page) If you think there might be something missing out of this default list, do please let me know.

timf@linn[2808] pkglint -L
pkglint.action.005           pkg.lint.pkglint_action.PkgActionChecker.dep_obsolete
pkglint.action.003           pkg.lint.pkglint_action.PkgActionChecker.legacy
pkglint.action.005           pkg.lint.pkglint_action.PkgActionChecker.license
pkglint.action.001           pkg.lint.pkglint_action.PkgActionChecker.underscores
pkglint.action.004           pkg.lint.pkglint_action.PkgActionChecker.unknown
pkglint.action.002           pkg.lint.pkglint_action.PkgActionChecker.unusual_perms
pkglint.action.006           pkg.lint.pkglint_action.PkgActionChecker.valid_fmri
pkglint.dupaction.002        pkg.lint.pkglint_action.PkgDupActionChecker.duplicate_drivers
pkglint.dupaction.006        pkg.lint.pkglint_action.PkgDupActionChecker.duplicate_gids
pkglint.dupaction.005        pkg.lint.pkglint_action.PkgDupActionChecker.duplicate_groupnames
pkglint.dupaction.008        pkg.lint.pkglint_action.PkgDupActionChecker.duplicate_path_types
pkglint.dupaction.001        pkg.lint.pkglint_action.PkgDupActionChecker.duplicate_paths
pkglint.dupaction.007        pkg.lint.pkglint_action.PkgDupActionChecker.duplicate_refcount_path_attrs
pkglint.dupaction.004        pkg.lint.pkglint_action.PkgDupActionChecker.duplicate_uids
pkglint.dupaction.003        pkg.lint.pkglint_action.PkgDupActionChecker.duplicate_usernames
pkglint.manifest.005         pkg.lint.pkglint_manifest.PkgManifestChecker.duplicate_deps
pkglint.manifest.006         pkg.lint.pkglint_manifest.PkgManifestChecker.duplicate_sets
pkglint.manifest.004         pkg.lint.pkglint_manifest.PkgManifestChecker.naming
pkglint.manifest.001         pkg.lint.pkglint_manifest.PkgManifestChecker.obsoletion
pkglint.manifest.002         pkg.lint.pkglint_manifest.PkgManifestChecker.renames
pkglint.manifest.003         pkg.lint.pkglint_manifest.PkgManifestChecker.variants
opensolaris.action.001       pkg.lint.opensolaris.OpenSolarisActionChecker.username_format
opensolaris.manifest.001     pkg.lint.opensolaris.OpenSolarisManifestChecker.missing_attrs

Excluded checks:
opensolaris.manifest.002     pkg.lint.opensolaris.OpenSolarisManifestChecker.print_fmri

Over the coming weeks, I’ll be addressing some additional bugs and RFEs for pkglint. Once we’re sure it’s stable, I hope to start working with the right folks to see if we can get pkglint(1) runs performed on their gates during their builds.

Many thanks to everyone who helped code review and provide feedback – it was very much appreciated!


Filed under: IPS, OpenSolaris

August 25, 2010

Joerg MoellenkampTonspur zu meinem Vortrag auf der Froscon 2010

August 25, 2010 20:09 GMT
Die Videoaufzeichnung von meinem Vortrag auf der Froscon ist nunmehr online: "Was treibt eigentlich mein Unix?". Man verzeihe die Ähs und den dicken Typen da vorne. Die Tonspur ist leider nur auf deutsch erhältlich.

Update: Der Link ist nunmehr repariert ...

Marcelo LealGanglia on OpenSolaris

August 25, 2010 15:40 GMT
As system administrators we need to have some essential info about our servers as a minimum requirement for our job, and identify patterns and obtain knowledge about trends in our workload. And, when we need to use Dtrace, MDB, or need to understand a FMA ereport… we do not have much time. Actually, i want [...]


August 24, 2010

Joerg Moellenkamplinks for 2010-08-24

August 24, 2010 19:00 GMT

Adam LeventhalJoining Delphix

August 24, 2010 05:19 GMT

As I wrote about last time, I’ve left Oracle. What I was looking for in my next gig was technology that excites me, excellent management, and a chance to build something significant and successful. I’m confident that I’ve found those things with Delphix.

In the established database market, Delphix creates a virtualization layer that simplifies the management of data and reduces duplication and waste. Why’s that interesting? The most important data is in databases, so building a layer between data and storage is incredibly powerful. The software to achieve that can then grow in a variety of directions, from data analysis and tuning, optimization at the level of the operating system and file system, to integration up the stack. The notion of storage virtualization is popular albeit vague one. Delphix brings both a concrete definition and value as well as a unique, application-centric focus.

Delphix builds on top of OpenSolaris which was, of course, another compelling reason for me to join. The Solaris group constructed a platform unique in its facilities for developers and in its comprehensive manageability. As I looked at various prospective employers I came to an even better appreciation of how tough it would be to work in an environment without DTrace, and mdb, and pstack, and libumem, and SMF, and FMA, etc. etc. Of course now Oracle has withdrawn support for OpenSolaris, but we won’t be going it alone (stay tuned for more on that).

It’s that combination of technology that’s interesting both at a high level and in the details, a management team that’s experienced and hungry,  innovation in a market where we can have a lasting impact, and an initial product that proves the potential yet with many hard problems still left to solve. But it’s the people who build a company; Delphix both has a great team and a commitment to assembling talent second to none. I’m excited to get started (… after a couple of weeks of much needed decompression).

August 23, 2010

Joerg MoellenkampOGB dissolution

August 23, 2010 19:51 GMT
The OGB has pulled the trigger today. The members resigned today as reported by the last meeting minutes ever of the OGB . After the the developments of the last few weeks this was just a formal, but inevitable step. Will it change something? Don't think so ...