Executive Summary
If you’ve begun using Internet technologies in your business, you know how important it is to have your servers available all the time. With so much work relying on Internet and intranet processes, if your system isn’t running, chances are your employees are idle and your customers and partners aren’t able to reach you.
That’s why maximum reliability and availability was one of the most important Windows 2000 development goals. The result: Windows 2000 is the most reliable operating system Microsoft has ever produced. A common IT industry term for maximum reliability is “five nines,” meaning that a server is running 99.999 percent of the time. (Which translates into just 5 minutes downtime over a year.) Although most businesses do not need such stringent uptime requirements, a system built on Windows 2000 Datacenter Server can meet this level of reliability.
This paper provides an overview to help you understand how to get the most from these features in your business. First, it highlights the reliability and availability features integrated throughout the Windows 2000 Server family of operating systems. Next, it shows how you can achieve greater availability using the clustering and load balancing features in Windows 2000 Advanced Server. Then, it explains how Windows 2000 Datacenter Server expands on these features to deliver an operating system that meets the highest levels of reliability and availability.
Beyond the technology improvements in Windows 2000, Microsoft has also invested in tools and training resources to help customers create an IT environment that supports reliable operations.
Industry studies show that as much as 80 percent of system failures can be traced to human errors or flawed processes. Everyone knows someone who lost vital information because they forgot to do a backup. This is the classic example of the kind of problem a rigorous IT operations environment can help avoid.
Simply moving to Windows 2000 will improve system reliability. But getting the most out of the operating system relies on a combination of reliable technology, well-trained people, and sound operations. To create this environment, organizations can supplement the operating system technology with:
Support and Service expertise from Microsoft and/or vendors.
Investments in properly trained or certified administrators.
Adoption of prescriptive guidelines for efficiently operating the OS.
Technology
Reliable systems start with reliable server software. The Microsoft Windows 2000 Server family of operating systems share a core set of architectural features aimed at ensuring continued reliability and availability.
Improved Internal Architecture. Windows 2000 includes new features designed to protect your system, such as preventing new software installations from replacing essential system files or stopping applications from writing into the kernel of the OS. This greatly reduces many sources of operating system corruption and failure.
Fast Recovery from System Failure. If your system does fail, Windows 2000 includes an integrated set of features that speed recovery.
Improved Code with Developer Tools. Microsoft provided third-party developers with tools and programs to improve the quality of their drivers, system level programs, and application software. These enhancements make it easier for independent software vendors to write dependable code for Windows 2000.
Reduced Reboot Scenarios. Microsoft has greatly reduced the number of operations requiring a system reboot in almost every category of OS functionality: file system maintenance, hardware installation and maintenance, networking and communications, memory management, software installation, and performance tuning.
How Windows 2000 Advanced Server Increases Availability
The Windows 2000 Advanced Server operating system contains all the functionality and reliability of Windows 2000 Server, plus additional features for applications that require higher levels of scalability and availability.
Windows 2000 Advanced Server lets you readily increase your server capacity to keep pace with business growth, and it increases the availability of your important systems.
Increasing Server Availability
Server downtime caused by hardware or software failures can result in lost revenue, wasted IT staff work, and unhappy customers. To address these concerns, there are two kinds of technology used to increase server availability in Windows 2000 Advanced Server: Clustering and Network Load Balancing (NLB).
Windows Clustering links individual servers so they can perform common tasks. If one server stops functioning, two-node failover-support transfers its workload to the other server. NLB works by spreading client requests among various servers that are linked together to support a particular application, ensuring a server is always available to handle requests on your Web site or communications network.
The clustering services in Windows 2000 Advanced Server let you sustain productivity and ensure customer satisfaction by increasing the load your server infrastructure can reliably handle.
How Datacenter Server Increases Reliability and Availability
Windows 2000 Datacenter Server is for companies with uncompromising reliability requirements. It includes all the features in Advanced Server and adds expanded server capacity and clustering to maximize reliability and availability. Only original equipment manufacturers (OEMs) that meet a stringent set of hardware and software guidelines can offer Windows 2000 Datacenter Server. This certification requirement combined with the most advanced reliability and availability features delivers an OS designed to meet the needs of large data warehouses, online transaction processing (OLTP), and server consolidation.
Maximizing Availability with 32 SMP and 4-Node Clustering
Datacenter Server scales up to 32-way symmetric multiprocessing (SMP) and up to 64 gigabytes (GB) of physical memory, compared with up to 8-way SMP and 8GB of memory in Windows 2000 Advanced Server. In addition, Datacenter Server supports four-node failover, compared with two-node failover support in Advanced Server.
High Performance with WinSock Direct
WinSock Direct enables efficient high-bandwidth, low-latency messaging that conserves processor time for application use. In system area networks (SAN), this allows more users on the system, providing faster response times and higher transaction rates.
Managing Critical Resources with the Process Control Tool
Process Control is a powerful, flexible tool that helps you manage and control the resources that processors use on your system by applying rules that you define. When adjusted to fit the design of an application, Process Control helps ensure predictable and stable operations.
Services and Support Programs
Maintaining optimum reliability and availability requires access to support professionals and programs specifically tailored for business requirements. Microsoft offers a wide range of support programs aimed at ensuring maximum reliability and availability. For a complete summary of support options, see the Microsoft Support Web site at http://support.microsoft.com/directory/overview.asp.
Microsoft Certified Support Centers
Microsoft Certified Support Centers (MCSCs) are industry leading, multi-vendor support providers that work with Microsoft to help ensure they deliver high quality technical support for Microsoft products. All MCSCs have significant industry expertise in many types of environments, such as retail or health care, and can provide your organization with a broad range of services for an economical and flexible business solution. For more information on support options, see the Microsoft Certified Support Centers home page at http://www.microsoft.com/support/mcsc/.
Windows Datacenter Program
The Windows Datacenter Program provides customers with an integrated hardware, software, and service offering—all delivered by Microsoft and authorized server vendors (OEMs). The program consists of three elements:
OEM/Microsoft Jointly Staffed Support Queue. To provide the fastest, most complete and in-depth service possible, Microsoft and the OEM jointly staff a support queue for Datacenter server customers. Rather than calling two different support providers, one for hardware and one for the OS, Datacenter Server customers dial a single number to work with an integrated support service.
Hardware Compatibility Test and List. OEM products must pass a special Hardware Compatibility Test verifying that the hardware, the operating system, and kernel-mode drivers all interact efficiently and optimally.
Software Maintenance. Customers can receive update subscriptions for version releases, supplements, and Service Packs for Datacenter Server.
People and Process Microsoft Operations Framework: Roadmap for Reliability
An important part of server reliability is taking advantage of the best practices that have been learned by enterprises over time. Representative best practices are compiled in the Microsoft Operations Framework (MOF), which provides technical guidance for achieving mission-critical production system reliability, availability, and manageability on Microsoft products and technologies.
Investing in Properly Trained or Certified Personnel
The potential for human error can be a significant roadblock in keeping your systems reliable and available. People may forget to perform backups or ignore proper procedures for performing a wide range of operational tasks. The lesson is clear: If your employees aren’t properly trained to maintain your systems, you risk compromising the reliability and availability that you should be achieving. Two programs can help you meet this goal: The Microsoft Readiness Framework and the Microsoft Certification Program.
Microsoft Readiness Framework (MRF)
MRF helps IT organizations develop individual and organizational readiness to use Microsoft’s products and technologies. This guidance includes assessment and readiness planning tools, learning roadmaps, readiness-related white papers, self-paced training, courses, certification exams, and readiness events.
For more information about how MRF fits in with the Enterprise Services Framework, see the Enterprise Services home page at http://www.microsoft.com/msf.
Microsoft Certification
Competitive organizations need professionals at all levels who understand technology and can use that knowledge to innovate, take initiative, and think strategically. Microsoft certification can help organizations identify these technical leaders. Microsoft certification is an objective way for businesses to pinpoint individuals who have the technical abilities to help them compete in their industry and move forward with the most advanced Microsoft technology. For more information about Microsoft certification and other training opportunities, see the Microsoft Certification Web site at http://www.microsoft.com/trainingandservices/default.asp.
Seeing the Results
To see how the Windows 2000 Server Family is performing on tests and in the field, you can find links to the latest case studies, test results, and reports from this page on the Windows 2000 Server site: http://www.microsoft.com/windows2000/guide/server/solutions/overview/reliable/default.asp.
Executive Summary Conclusion
The Windows 2000 Server Family is the most reliable set of server operating systems Microsoft has ever produced. The reliability improvements in Windows 2000 mean fewer network interruptions for end users, higher server uptime, and better system availability.
Advanced Server meets the needs of essential business and e-commerce applications that handle heavier workloads and high-priority processes. You can readily increase your server capacity to keep pace with business growth while enhancing the availability of your important systems.
Windows 2000 Datacenter Server uses stringent standards for hardware and software configurations to deliver an OS designed to meet the highest demands for reliability and availability. It includes all the features in Advanced Sever plus greater clustering, load balancing, memory support, process controls, and other features optimized to deliver the high availability and reliability required for enterprise and larger departmental solutions.
In addition to using reliable server systems, obtaining optimum reliability and availability depends on investments in people and process: so you can ensure that properly trained personnel follow standardized best practices and take advantage of the expertise provided by service and support programs.
Introduction
Organizations must be able to depend on their business information systems to deliver consistent results. The foundation of all information systems—the operating system platform—provides dependability through two basic characteristics: reliability and availability.
Reliability refers to how consistently a server runs applications and services. Reducing the potential causes of system failure increases reliability.
Availability refers to the percentage of time that a system is available for users. Availability is increased by improving reliability and by reducing the amount of time that a system is down for other reasons, such as planned maintenance or recovery from failure.
In short, reliable and available systems resist failure and are quick to restart after they’ve been shut down. This paper describes the technologies that make the Windows 2000 Server Family an extremely reliable platform for highly available systems.
Buying a dependable server is just the first step toward reliability. To make sure your server is available when needed, you need a well-designed IT infrastructure that takes people and processes into consideration as elements in the reliability equation. Building such an infrastructure requires coordinating services and support programs, staff training, and operational guidelines based on proven best practices. This paper covers each of these areas briefly and provides links to additional resources.
Building Reliability in Windows 2000
Reliability is not a quality that can be dramatically improved by just adding features. To fundamentally increase the reliability characteristics of Windows 2000, Microsoft improved the entire process of developing Windows 2000 internally. To assure reliability on particular hardware, Microsoft offers a program for original equipment manufacturers (OEMs) to certify their systems as dependable.
The Windows 2000 Development Process
Microsoft began the process of increasing the reliability of Windows 2000 by conducting extensive interviews with existing customers to identify some of the problems with previous versions of Windows that reduced system reliability. In addition to changing the operating system, Microsoft also changed the way the operating system was developed. For example, Microsoft implemented internal reliability improvement practices during the development process, such as a full-time source code review team, whose sole responsibility was to double check the validity of the actual operating system code itself.
Windows 2000 also underwent a rigorous testing process. Microsoft devoted more than 500 person years and more than $162 million dollars in testing and verifying Windows 2000 during its development cycle. The testing process itself was improved. Comprehensive system component tests were run, and a 'stress test' on more than 1,000 machines was run on a nightly basis. In addition, 100 servers were used for long-term testing of client-server systems.
Some of the highlights of the testing process include:
More than 1,000 testers used over 10 million lines of testing code.
More than 60 test scenarios, such as using Windows 2000 as a print server, an application server, and a database server platform.
Backup and restore testing of more than 88 terabytes of data each month.
130 domain controllers in a single domain.
More than 1,000 applications tested for compatibility.
This virtually unprecedented testing process produced a highly stable and dependable operating system platform.
For a look behind the scenes at the Windows 2000 development process, see “Windows 2000 Reliable? You Can Bet Your Business on it!” at http://www.microsoft.com/WINDOWS2000/news/fromms/kanoreliability.asp.
Technology
Reliability and Availability Features in the Windows 2000 Server Family
Based on research into the causes of difficulty with prior versions of Windows, Microsoft has enhanced the dependability of Windows 2000 in a number of ways:
Improved the internal architecture of Windows 2000.
Provided third-party developers with tools and programs to improve the quality of their drivers, system level programs, and application code.
Reduced the number of maintenance operations that require a system reboot.
Allowed Service Packs to be easily added to existing installations.
Reduced the time it takes to recover from a system failure.
Added tools for easier storage management and improved diagnosis of potential problem conditions.
With Windows 2000 Advanced and Datacenter Server, organizations can also take advantage of clustering and load balancing, which are key features for implementing highly available systems.
Architectural Improvements
The internal architecture of Windows 2000 has been modified to increase the reliability of the operating system. The enhanced reliability stems from improvements in the protection of the operating system itself and the ability to protect shared operating system files from being overwritten during the installation of new software. (For a detailed description of the Windows 2000 Architecture, see Appendix C.)
Windows File Protection
Before Windows 2000, installing new software could overwrite shared system files such as dynamic-link library (DLL) and executable files. Most applications use many different DLLs and executables and replacing existing versions of these files can cause system performance to become unpredictable: applications can perform erratically or the operating system can fail.
To prevent this problem, Windows File Protection verifies the source and version of a system file before it is initially installed. This verification prevents the replacement of protected system files with extensions such as .sys, .dll, .ocx, .ttf, .fon, and .exe files. Windows File Protection runs in the background and protects all files installed by the Windows 2000 setup program. It detects attempts by other programs to replace or move a protected system file. Windows File Protection also checks a file's digital signature to determine if the new file is the correct Microsoft version.
If the file is not the correct version, Windows File Protection replaces the file from the backup stored in the Dllcache folder, network-install location, or from the Windows 2000 CD. If Windows File Protection cannot locate the appropriate file, it prompts the user for the location. Windows File Protection also writes an event noting the file replacement attempt to the event log.
F
igure 1: Users will be warned if an application tries to write over files that are part of the Windows-based operating system.
By default, Windows File Protection is always enabled and only allows protected system files to be replaced when installing the following:
Windows 2000 Service Packs using Update.exe.
Hotfix distributions using Hotfix.exe.
Operating system upgrades using Winnt32.exe.
Windows Update.
Windows 2000 Device Manager/Class Installer.
Kernel-Mode Write Protection
Another important feature in Windows 2000 protects the core of the operating system, called the kernel, from errant code or “rogue” applications.
In kernel mode, software can access all the resources of a system, such as computer hardware and sensitive system data. Before Windows 2000, code running in kernel-mode was not protected from being overwritten by errant pieces of other kernel-mode code, while code running in user-mode programs or dynamic-link libraries was either write-protected or marked as read-only. Windows 2000 adds this protection for subsections of the kernel and device drivers, which reduces the sources of operating system corruption and failure.
To provide this new protection, hardware memory mapping marks the memory pages containing kernel-mode code, ensuring they cannot be overwritten, even by the operating system. This prevents kernel-mode software from silently corrupting other kernel-mode code. If a piece of code attempts to modify protected areas in the kernel or device drivers, the code will fail. Making code failures much more obvious makes it more likely that defects in kernel-mode code will be found during development. This feature is turned on by default, although it can be deactivated if a developer desires to do so. (For additional information regarding memory and kernel-mode, see Appendix C.)
Reducing the Number of Reboot Conditions
As described earlier in this paper, there is a difference between reliability and availability. A system can be running reliably, but if a maintenance operation requires that the system be taken down and restarted, the availability of the system is affected. For users, it makes no difference whether the system is down for a planned maintenance operation or a hardware failure: they cannot use the system in either case.
Windows 2000 has greatly reduced the number of operations that require a system reboot in major categories of OS functionality: file system maintenance, hardware installation and maintenance, networking and communications, memory management, software installation, and performance tuning. See Appendix A for a list of the tasks that can be completed without interruption.
Improved Tools for Third Parties
Windows 2000 also provides a number of tools and features that make it easier for independent software vendors to write dependable code for Windows 2000. For a detailed discussion of how these tools contribute to enhanced reliability and availability, see Appendix B.
Service Pack Slipstreaming
Microsoft periodically releases Service Packs, which offer software improvements and enhancements. With Windows 2000, these updates can be slipstreamed into the base operating system, freeing users from having to reinstall a Service Pack after installing new components. Slipstreaming automates the Service Pack deployment process, allowing users to install the latest Service Pack from a single share so that when setup runs, the right files and registry entries are always used. This feature allows customers to build their own packages for Windows 2000, with the appropriate Service Pack and/or hotfixes—customizing the OS to meet specific organizational needs.
Reducing recovery time
One distinction between reliability and availability is the time it takes for a system to recover from a failure. Although a system may begin to run reliably as soon as it is restarted, the system is usually not available to users until a number of corrective processes have run their course. The longer it takes to recover from a system failure, the lower the availability of the system.
A number of improvements in Windows 2000 help reduce the amount of time it takes to recover from a system failure and restart the operating system. These improvements include:
Recovery Console
Safe Mode Boot
Kill Process Tree
Recoverable File System
Automatic Restart
IIS Reliable Restart
Recovery Console
In the event of a system failure, administrators must be able to rapidly recover the system. The Windows 2000 Recovery Console is a command-line console utility available to administrators from the Windows 2000 Setup program. It can be run from text-mode setup using the Windows 2000 CD or system disk (boot floppy).
The Recovery Console is particularly useful for repairing a system by copying a file from a floppy disk or CD-ROM to the hard drive, or for reconfiguring a service that is preventing the computer from starting properly. With the console, users can start and stop services, format drives, read and write data on a local drive, including drives formatted to use the NTFS file system, and perform many other administrative tasks.
Because the Recovery Console allows users to read and write NTFS volumes using the Windows 2000 boot floppy, it will help organizations reduce or eliminate their dependence on FAT and DOS boot floppies used for system recovery. In addition, it provides a way for administrators to access and recover a Windows 2000 installation, regardless of which file system has been used (FAT, FAT32, NTFS), with a set of specific commands. At the same time, the Recovery Console preserves Windows 2000 security, since a user must log onto the Windows 2000 system to access the console and the requested installation feature.
While using the Recovery Console, files cannot be copied from the system to a floppy or other form of removable media, which eliminates a potential source of accidental or malicious corruption of the system or breaches in data security.
Safe Mode Boot
To help users and administrators diagnose system problems such as errant device drivers, the Windows 2000 operating system can be started using Safe Mode Boot. In Safe Mode, Windows 2000 uses default hardware settings for items such as mouse, monitor, keyboard, mass storage, base video, default system services, and no network connection. Booting in Safe Mode allows users to change the default settings or remove a newly installed driver that is causing a problem.
In addition to Safe Mode options, users can select Step-by-Step Configuration Mode, which lets them choose the basic files and drivers to start, or the Last Known Good Configuration option, which starts their computer using the registry information that Windows saved at the last shutdown.
Kill Process Tree
If an application stops responding to the system, users need a way to stop the application. A user could simply stop the main process for the application, but a process could have spawned many other processes, which could have spawned child processes of their own, and so on—resulting in a tree of processes all logically descended from one top-level program. In this situation, a reboot was often required.
For this reason, Windows 2000 provides the Kill Process Tree utility, which allows Task Manager to stop not only a single process, but also any processes created by that parent process with a single operation, without requiring a reboot. The Kill Process Tree utility is especially useful in cases where a process has created many other processes, which, in turn, have caused a reduction in overall system performance.
Recoverable File System
The Windows 2000 file system (NTFS) is highly tolerant of disk failures because it logs all disk I/O operations as unique transactions. In the event of a disk failure, the file system can quickly undo or redo transactions as appropriate when the system is brought back up. This reduces the time the system is unavailable since the file system can quickly return to a known, functioning state.
Automatic Restart
The improvements in Windows 2000 reduce the likelihood of system failures. However, if a failure does occur, the system can be set to restart itself automatically. This feature provides maximum unattended uptime.
When an automatic restart occurs, memory contents can be written to a log file before restart to assist the administrator in determining the cause of the failure. You can set options to control the size of this log file, as outlined in the crash dump feature descriptions below.
IIS Reliable Restart
In the past, to reliably restart Internet Information Services (IIS) by itself, an administrator needed to restart up to four separate services. This recovery process required the operator to have specialized knowledge to accomplish the restart, such as the syntax of the Net command. Because of this complexity, rebooting the entire operating system was the typical, although not optimal, way to restart IIS.
To avoid this interruption in the availability of the system, Windows 2000 includes IIS Reliable Restart, a faster, easier, and more flexible one-step-restart process. The user can restart IIS by right-clicking an item in the Microsoft Management Console (MMC) or by using a command-line application. For greater flexibility, the command-line application can also be executed by other Microsoft and third-party tools, such as HTTP-Mon and the Windows 2000 Task Scheduler. IIS will use the Windows 2000 Service Control Manager's functionality to automatically restart IIS Services if the INETINFO process terminates unexpectedly.
Storage Management
Server storage requirements tend to continually increase. To avoid system problems caused by users running out of disk space, Windows 2000 provides several enhancements to help administrators maintain sufficient free disk space with minimal effort. Storage management features in Windows 2000 include:
Remote Storage Services. The Remote Storage Services (RSS) monitors the amount of space available on a local hard disk. When the free space on a primary hard disk dips below the needed level, RSS automatically removes local data that has been copied to remote storage, providing the free disk space needed.
Removable Storage Manager. The Removable Storage Manager (RSM) presents a common interface to robotic media changers and media libraries. It allows multiple applications to share local libraries and tape or disk drives, and controls removable media within a single-server system.
Disk Quotas. Windows 2000 Server supports disk quotas for monitoring and limiting disk space use on NTFS volumes. The operating system calculates disk space use for users based on the files and folders that they own. Disk space allocations are made by applications based on the amount of disk space remaining within the user’s quota.
Dynamic Volume Management. Dynamic Volume Management allows online administrative tasks, such as adding or changing volumes, to be performed without shutting down the system or interrupting users.
Improved Diagnostic Tools
When a condition occurs that leads to a system failure, an administrator will generally want to find the root cause of the problem in order to take preventative steps to avoid the problem in the future. Windows 2000 includes three new features for improving the ability to troubleshoot system errors:
Kernel-only crash dumps
Mini dumps
Faster CHKDSK
MSINFO
Remote Terminal Services
Kernel-Only Crash Dumps
In the unlikely event that a server running Windows 2000 crashes, the contents of its memory are copied out to disk. Because Windows 2000 supports up to 64 GB of physical RAM, a full memory crash dump can be quite slow, significantly delaying the system restart. For example, a Pentium Pro computer with 1 GB of memory takes approximately 20 minutes to dump memory to the paging file. When the system reboots, it then takes an additional 25 minutes to copy dump data from the paging file to a dump file. This means that for 45 additional minutes, the system is unavailable.
For this reason, in addition to full-memory crash dumps, Windows 2000 also supports kernel-only crash dumps. These allow diagnosis of most kernel-related stop errors but require less time and space. The new feature is especially useful in cases where very large memory systems must be brought back into service quickly. Depending on system usage, a kernel-only crash dump can decrease both the size of the dump as well as the time required to perform the dump.
Using kernel-only crash dumps requires an administrative judgment call. Because essential data is sometimes mapped in user mode rather than kernel mode, and therefore can be lost using this method, administrators may choose to keep the full-memory crash dump mode on by default.
Mini Dumps
Just as kernel-only crash dumps contain specific information about the OS kernel, mini dump files contain the small set of specific information about application failures needed to troubleshoot and correct the failure. With mini dump files, developers can write applications that can ascertain ways to fix problems automatically and recover quickly.
Faster CHKDSK
The CHKDSK command is used to check a hard disk for errors. Although CHKDSK is a powerful feature, with Windows NT Server, it sometimes took hours to run depending on the file configuration of the disk partition being checked. Performance of CHKDSK in Windows 2000 has been enhanced significantly—up to 10 times faster, depending on the configuration.
MSINFO
Available in prior versions of Windows, the MSINFO tool aids troubleshooting by immediately showing the current system configuration.
Remote Terminal Services
Remote Terminal Services are an integrated part of Windows 2000. These services allow administrators to view and manage their complete Windows 2000 environment from a single console, and can be used to diagnose system problems from a remote location. This capability makes it much easier to maintain the complete Windows 2000 network, which, in turn, contributes to higher levels of availability and reliability.
|
