Blog Posts From IT Peer Network Tagged With #intelit

Cloning/Copying Systems to Reduce Build Times for a *NIX System

webadmin@intel.com — Tue, 19 Mar 2013 14:30:15 GMT

Over the years I have used many different methods in trying to duplicate system builds, as well as cut down on build times especially in a catastrophic failure that requires a complete rebuild. Some of the main issues that arose around duplicating systems all depends on what the end results needs to be.

Do you want to have an exact copy or just need multiply systems with the same build and setup with slight configuration differences. The other aspect is to think about is how you want your system to look for each user as they login.
Do you want them to have the same look and feel? What about the same support directory structures?
Should all of the servers have the same functionality?

The answers to these questions may lead you to use 3^rd party block based duplicating software, or to document steps to manually build the base system with scripted post build setups, or even to use bare metal restore processes.

In some aspect it really does not matter how you achieve your base build. The challenge is more around which is the easiest way to duplicate the build for the same type of functioning system. From what I have found, with builds that require large quantities of builds with 99% of the exact configurations it is best to use some sort of block copy that allows you to build large amounts of disks and just swap them out as the hardware goes bad. Of course this does not make the systems unique. This will still require a small script to configure the small amount of changes you need to make to allow the system on the network without conflicts. This method does have some shortcomings; as the base build changes the disks in overflow will be out date and will need to be redone. The biggest advantage to this method you don’t need to be technical for this type of process. This task can be done by basic technicians anywhere around the world to get the base system back on the network. Once it is on the network it can be reconfigured remotely.

One of my more interesting methods for deployment around the world was to build a *NIX system that each supporting site would own. I am a big believer in as much hands as possible during the initial build process for anyone to understand how the system work and how to support the system. Without any hands on how would one learn the system functionality? This also promotes refreshing some skills that may be lost due to infrequent use. I created a process for each site to perform their own builds with docs and scripts. This process helps promote learning and consistency across all systems created. An install would follow the doc on base build. Each builder would run into similar build issues which were documented along with how to resolve them. After the base build was completed, each builder would need to modify scripts to complete the build. Each of the scripts would range from driver installs to setting up profiles of different users. This would allow each site to configure the system the way their site operated but keep them consistent between locations. The scripts would help each builder understand what is being installed and what commands are used to build the system. They would also help support the system if any issues would arise.

With all the different products out there on the market and supplied by the OS vendor, there are many different ways to accomplish the same result. As there are many methods out there, and not one is the answer to all needs, there are some main things to think about: who is doing the builds, will they be supporting the systems, how many systems do you need to create and how often. Most importantly, document your process well to assist your supporting groups.

Scripting for a non-coder (How to start)

webadmin@intel.com — Wed, 19 Dec 2012 21:17:01 GMT

As non-coders it can be a difficult process to automate routine tasks. What things can we do as non-coders to allow us to automate our jobs as well as growing our skills in the automating process? There are a few things I have done over the years to help my productivity with not much more than reading articles on the internet. I have no formal coding background; most of my skills have been self-taught.

One of the most beneficial things I have done to allow me to start automating, as well as helping my skills to grow, is keeping a log of one-line scripts and documenting output, as well as what I am trying to accomplish. For example, I wanted to do a “server alive” script that notifies when there is an issue. I would use a command line utility program to run ping to display the correct output I was looking for. Sometimes you will have to read documentation on the different options to get your desired results. I would document the command, output, and what I was trying to achieve. In the output, what data am I looking for? What gives me the desired knowledge that the system is live on the network? I would also compare a successful check with what a failure looks like, in order to determine what data is needed to be collected to differentiate between the two results.

The next steps change based on your skill set. You may want to consult the internet or previous one-liner examples. You want to take your output from one command and redirect into some other command that would allow you to validate the results to be true or false, based on what was determined from your output in the previous step. For example, your ping output should generate a line with “TTL” which represents success. You would need some sort of command that would determine that your output had the desired result. At this point, you can search on the internet for the right command in the language of your choice, and you’ll get examples from other people which will help you to develop your scripts to get your desired results.

Once you have created the small script of one-liners, you will be able to work on putting them together in some sort of condition statement to validate success or failure. In most scripting languages you would be looking for “if then or else” statements. I would start with working in steps. From the ping command, I would redirect the output to another command that would try matching it to a desired result in order to give confirmation of success or failure. Then do the same for a failed result just to make sure there are no false positive. Now you have two steps that work. What next? Do you just want it to send the data to a log file or send notification based on results? I would start with sending your data to a log file so you can audit results until you are ready for the process to be fully automated. As a new scripter you will want to validate time and time again for any mistakes with your results. Don’t take your first pass as your final results. There can always be a condition you never thought of. This is one reason that I continually update my one-liner and function documentation.

The next big starting point is learning how to put each one of your small scripts into functions or sub routines. This will allow you to call small chunks of code to only do one small function. As a part of your functions repository, you are now able to add that section into any future script. This allows for you to speed up your script writing and ability to make the code better as time goes.

In summary, I find the internet a great source for looking for help with simple code/function within your code. It is also a great way to learn other ways to process the same results. With these results you will learn more about your system and application, and most importantly you will save time on many repetitive tasks to allow more time to learn better scripting.

Designing a backup environment for ever expanding data growth

webadmin@intel.com — Thu, 27 Sep 2012 14:56:49 GMT

In the past, I have worked on moving from physical (tapes) to virtual (disks) backups and have run into several different and unique things for me to deal with. I needed to understand the differences in data throughput times on different mediums and understand how this will affect storing reliably restorable data. Another thing to keep in mind is what data makes sense to keep. This could range from critical files and configuration data needed to rebuild a complete system (Bare-Metal Restore) or just enough to restore files which have been incorrectly altered or removed. I also needed to keep in mind how much space would be needed to store the physical or virtual data.

Trying to understand what medium to use depends mostly on how much data you intend to backup within what time duration. When choosing your method of transferring your data to some sort of storage backup device you need to understand your limitations. They can range from spindle speed, fiber, network, number of simultaneous backups that can be run at the same time, and tape write latency times. My biggest challenge has been dealing with very large data transfers that were unable to be completed within the time allotted. When trying to figure out where my issues were, I would use a graph similar to the one below to help determine if it was theoretically possible to transfer all the data within the time allotted. My other big challenge was figuring out a scheduling process to allow for all the backups to have enough time to finish and allowing the next queued backup job to start.

One of the methods I looked at was streaming data to multiple physical or virtual tape drives at the same time. This allowed for directories with a large amount of data to get backed up within my time window. Some of my backup policies became so complex, they required using different regular expression patterns to create small enough sets of files to allow for transferring all the data within my backup window. This allowed me to stream to more than one tape device simultaneously allowing me to use larger bandwidth to transfer data more quickly.

Trying to figure out what data is necessary to keep depends on how much storage space you have, how much data you feel is needed to restore a system from a catastrophic failure, and what is required from your legal department. In some cases you may want to look into storing just enough data to restore the application only. The system may be part of a cluster and the only data you need to restore are application files – rebuilding a server is a fairly easy task. In other cases, it may make more sense to backup a whole system for Bare-Metal Restore, for example a very complex system build which requires many hours to build. Each system will need to be addressed individually.

There are also many challenges when storing on a virtual library. One of them you need to understand is your growth and retention needs. Depending on your retention time, you may need to wait through a complete retention cycle to get the big picture of how much data you will be storing on your library and how much space is needed. This is one advantage having physical tapes - you would just buy more as you run out of space. The challenge is you just can’t always buy new storage space. This is where it becomes really important to watch and track your data growth. When trending this data you will need to understand how much space the backups take (daily, weekly, monthly, annually) and how this data will grow over time. Example, you have a 40TB database that is collected once a month and stored for 1 year. This means you will need to have enough space to store 40TB x 13. You will need to have 520TB of space to store the years’ worth of data just for the one backup. The 13^th backup is added in case the release of the oldest data is done after the 13^th data capture. This process will need to be performed for each retention plan and each server to adequately give you a good estimate on how much raw space you will need. The real fun with numbers will show up if you are looking at de-duplication and/or compression. This brings in a huge anomaly to your equation. This process would be similar but you will need to calculate the average size after the de-duplication or compression process has finished and figure out the total data space per system after that.

Graph based on max throughput on some common media

Medium	MB/s	GB/hour	24 Hours
100FD	12.5	44	~1TB
1GigE	125	440	~10TB
2GB (Fiber)	212.5	750	~17TB
4GB (Fiber)	425	1495	~35TB

Selecting the Right BYOD Strategy

webadmin@intel.com — Thu, 23 Aug 2012 19:31:23 GMT

IT organizations around the world are or should be struggling with this critical decision. And it is not an easy one. The number of strategies available to an IT organization are on par with the number of devices and OS variants that employees want to bring in.

Earlier this week, my social computing alerts shared an article titled "one way to manage BYOD" written by Kevin McCaney of Government Computing News. I was really excited by this article because Kevin based his article on what we were doing inside Intel IT - thanks Kevin

What got me writing this blog was that Kevin helped me put Intel IT's approach in a broader perspective across the spectrum of strategies available to IT by comparing our approach to those that some of our peers have taken or are considering.

The spectrum or strategies for BYOD range from

Say Yes to Everything
Say No to Any
Something in the Middle

A balanced, middle-of-the-road approach has allowed Intel IT to maximize BYOD business value through providing flexibility to employees (boosting productivity) while minimizing the IT cost/burden of support while maintaining a no compromise approach to security and enterprise risk.

At Intel IT, our approach is working and evolving as fast as the number of device requests coming in from our employees

What approach do you and your IT org take to supporting the consumerization of IT?

Real Drivers for Data Anonymization

webadmin@intel.com — Wed, 15 Aug 2012 18:10:22 GMT

As an enterprise architect and researcher in the cloud computing and security space, It seems like every month I hear of a new data breach at one company or another, exposing social security numbers, credit card numbers, or other sensitive information. According to the Ponemon Cost of a Data Breach Report for 2011, the organizational costs of a data breach was $5.5 million in 2011 and $194 per record; another study indicated that 95% of records lost included personal information, compared to 1% in 2010—highlighting a significant shift to targeted attacks specifically looking for personally identifiable information (PII).

There is increasing attention on protecting this type of information, such as the Payment Card Industry Data Security Standard (PCI DSS). Globally, especially in the European Union, stringent data protection laws exist that can have serious legal and financial consequences for companies in the event of a data breach. The combination of the PCI DSS and EU companies’ concerns with using of U.S-based clouds is catapulting data anonymization from the realm of academics to a critically important aspect of doing business using today’s global, cloud-based computing environments.

Data anonymization is the process of obscuring published data to prevent the identification of key information. This can be accomplished in a number of ways. For example, “shifting” adds a fixed offset to the numerical values, while “truncation” shortens data. Another technique is to add fictitious data records, to obscure patterns and relationships. Data anonymization can help protect sensitive data stored in the cloud. It can also help alleviate some of the potential legal problems encountered by U.S. companies that store data associated with customers living in the EU.

Tokenization (also called “permutation”) is one technique that can aid in data anonymization. For example, the Intel® Expressway Tokenization Broker (Tokenization Broker) can help protect credit card data. The Tokenization Broker generates secure, fixed-length tokens in place of primary account number data, and can serve as a secure proxy involved in authorization requests to credit card processors using standards-based interfaces, such as HTTP, SOAP, and WSDL. Of course, the Tokenization Broker also provides a method of de-tokenization—that is, mapping the token back to the original value.

Intel is developing a hybrid cloud usage model, where we use a combination of our enterprise private cloud as well as secure external clouds. As part of that effort, Intel IT is actively exploring data anonymization to see how it may enhance the security of Intel’s data in the public cloud while still allowing the data be to analyzed and used. For detailed discussion of our investigation and results, read the recently published IT@Intel white paper, “Enhancing Cloud Security Using Data Anonymization.”

Divide and Conquer

webadmin@intel.com — Fri, 27 Jul 2012 00:13:47 GMT

Here at Intel, we are actively integrating employee-owned devices—including smartphones, tablets, and PCs—into our enterprise environment. In addition, we now deliver 80 percent of our newly developed business services through our own enterprise private cloud. We plan to increasingly use a mix of private and public cloud-based services, called hybrid cloud, in implementing solutions over the next few years.

In my role as IT Chief Technology Officer, I have observed parallels and interdependencies between our adoption of IT consumerization, which provides employees with a wider range of choices for compute capability, and the advent of cloud computing, which offers businesses additional options for IT services. Intel IT is coordinating our cloud computing efforts with our bring-your-own-device (BYOD) initiatives, to enable us to reap maximum business value from both.

We feel that both cloud computing and BYOD are important enablers for our agility and enterprise velocity. But historically, application development has been a rigid process that can slow agility, especially in the areas of larger enterprise systems such as ERP. To increase our ability to develop applications and deliver services quickly—and to a wide range of devices—we are implementing a pace-layered approach utilizing a Service-Oriented Architecture (SOA) to help us abstract away our slower-to-evolve applications, such as our ERP system, from our quicker-moving capabilities, such as new supply chains to support new business. By being able to connect existing services faster, it also allows us to implement better capabilities such as transforming our shopping carts into purchase orders.

This pace-layered approach matches the pace the platform needs to evolve with the pace the business needs to move by abstracting the front-end functionality away from the back-end systems. For example, a service may rely on data stored in our ERP system, but to deliver the service to a tablet, we need to develop a new user interface (UI). By abstracting the front end from the back end, we can quickly develop the UI without having to disturb the underlying data structures and associated business rules.

We have also implemented a Mobile Enterprise Application Platform (MEAP), to help us use SOA more efficiently with mobile devices. A MEAP is a comprehensive suite of products and services that can help reduce complexity and connectivity problems associated with deploying an application across multiple devices. In general, a MEAP-based solution consists of two components.

The mobile middleware server handles system integration, security, communications, scalability, and cross-platform support.
The mobile client application connects to the middleware server and drives both the user interface and the business logic on the device and supports many operating systems and devices.

We believe as more HTML5 and library-enabled code modules are developed in our environment, the need for the MEAP might diminish, although we see it as being absorbed, not eliminated.

For more information about our efforts, read IT@Intel’s recent white paper, “Delivering Cloud-based Services in a Bring-Your-Own Environment.”

Time to short-cut getting Intel IT employees on Social Media

webadmin@intel.com — Sat, 14 Jul 2012 00:08:16 GMT

This week our CIO Kim Stevenson (@kimsstevenson) posted her first public blog in the Intel Open Port IT Community stating her intent to build a social IT organization at Intel. This totally flipped my job on its head and I couldn’t be happier.

My job as the social media manager for Intel IT has to share IT best practices www.intel.com/IT from Intel IT experts with the industry and to help our top IT experts blog in our community - in that priority order. Sharing the best practices, it’s really straightforward, programmatic social distribution – it’s not rocket science. I tweet from our handle @IntelITS, share via LinkeIn and post content on www.intel.com/IT, Slideshare and Scribd.

The second part, the helping our top IT experts blog is actually the trickier part. That is, until Kim’s blog, which clearly provides the leadership direction (and hopefully the motivation) to our org. The part where she says, “Being a new CIO, I made a commitment to myself that I would be a part of the 10% [of social CIOs] and bring many IT professionals along with me.” So when your CIO’s goal is bigger than just getting the top 10-20 experts blogging, you’ve got to short cut your process and re-examine your approach.

I realize I’m going to need help more of our IT employees build their public professional and IT-relevant brands through social, so to pick up some tips I attended a webinar, "How to Build a Personal Brand and Advance Your Career," hosted Online Marketing Institute. It was a really comprehensive overview – great material to share with our team. On Twitter, Michael Brenner shared a link to a blog with some tips. More good stuff.

Is that enough? Probably not. I’ve worked with technical experts for years; they are busy, dedicated people. They are not the ones to naturally go on about what they do at work or think that they have much to share. Most people in our IT org are probably pretty skeptical about the whole thing. I was very intrigued when I read a blog this week by John Stepper on how to get through that “I don’t see how it’s relevant to my job and don’t know what to say” phase. John states in his blog, “Simply by using a collaboration platform to store your material, you make you and your work visible in real-time. And, better still, your work (projects, documents, discussions) is now searchable and discoverable. People will find you any time they’re looking for content related to what you’re doing.” He recommends narrating your work. This approach might help those who are not super enthusiastic about making this plunge. And the fact that I'm finding all of these great resources through social media to do my job is definitely a proof point.

So this week I am re-grouping. I know a lot members of our Intel Open Port IT community are active in social media. If you have additional tips and advice that might help me ramp our IT org (and keep up with Kim!), please let me know.

Kelli Gizzi (@kelligizzi)

#IntelIT

Becoming a Social IT Organization

webadmin@intel.com — Tue, 10 Jul 2012 19:49:40 GMT

Earlier this year harmon.ie produced a list of the most socially active group of CIOs in the Fortune 250 and Global 250. It was shocking to me that only 10% of the Fortune 250 CIOs are themselves social. Shocking because we have entered a new era of computing where social connectivity is crucial to a company’s brand awareness, cultivating influencers and ultimately reaching the consumer. Not only are our customers moving in this direction, social networking is completely changing the way knowledge is shared and empowering the masses with knowledge that was once held by a select few. Our key assets as an IT organization are knowledge, innovation and influence. It is not easy to find the right information or the knowledgeable person in a big company like Intel.

In just a few short weeks on Twitter, I’ve seen how easy it is to quickly gain key insights and apply only what is most relevant to me. Innovation is also changing with more and more innovation coming from crowdsourcing. Quirky, founded in 2009, has created hundreds of successful products all crowd sourced. Two new products a week is the velocity enabled by empowering the masses. Who is influencing is changing, no longer is the person with the big title the key influencer in a community. The crowd has usurped this role. Thus, I conclude we all need to become social.

Being a new CIO, I made a commitment to myself that I would be a part of the 10% and bring many IT professionals along with me. Join me in this journey. We may have a lot to learn but it will be worth the effort if we’re successful in achieving and maintaining our company’s competitive edge.

Follow me on twitter @KimSStevenson #IntelCIO #IntelIT

Engage me in dialogue and discussion around IT Leadership in the Intel Open Port IT community.

http://communities.intel.com/community/openportit

LDAP versus NIS implementation with Unix/Linux flavor systems

webadmin@intel.com — Thu, 24 May 2012 22:47:15 GMT

What are the benefits and complications between using NIS and/or integrating *NIX accounts with LDAP for your *NIX flavored systems? In many cases, *NIX administrators lean towards keeping to *NIX systems in order to manage their environment. There tends to be a division line between none *NIX based and *NIX in most environments. However, most application/DB users are required to make changes on both types of OS. Depending on your sites security policies around passwords, this could cause some issues for application users, as well as causing overhead in maintaining the policies your site implements. It really depends on users’ activity levels on each type of system. Example: an LDAP compliant none *NIX based system runs the front end of an application while the DB is located on a *NIX system. The DBA user will only need to access the *NIX system once every 6 months. As a result, the DBA may find their account inactive or removed due to policies that require users to actively login to an account every some odd days to keep the account active.

When looking at designing your account model, you will need to keep in mind how you would like to enforce security around your accounts, and how important is the data accessible from this system. NIS inherently does not have a method to lock accounts or to notify as security policies may dictate. NIS will manage accounts and groups without security policies. However, wrapper scripts and other programs can allow NIS to support your site’s polices. Maintaining home-grown scripts can cause extra overhead as well as introducing potential human error to enforcement policies. While NIS is simple to setup and maintain, over the years I have seen typos and character limitation sizes that cause NIS to break with little notification. Overall NIS is simple to use and configure, but there are some inherent short comings in its inability to control security policies.

There are advantages in integrating *NIX accounts within LDAP, which you may think brings new complications, but it is more like putting your NIS structure within LDAP. There is a learning curve and thought process in achieving this. There is an initial design time required, as well as a one-time installation of Unix extensions within LDAP. The real question is, what is the ROI to make the change? There is added security in that the password hash and user accounts for the *NIX system will now be kept within the LDAP compatible structure, rather than on the *NIX system where it may be used to compromise the system.

What about using Access Control Lists (ACL)? ACL’s only allow certain commands depending on each user’s group role within your company. Sudo is typically the standard for most *NIX shops as it is inherently built within all *NIX type OS’s. How would you set up ACL’s to deny all access and only grant what is needed? It all depends on your site’s security model. As far as controlling group IDs for ACL, it is always a good idea to give all users a base GID that is not used on any system, and only add the users to other groups as needed. This will help block users from gaining access to stale accounts as they change job roles, also as a user is removed from other groups.

From my years of dealing with *NIX accounts and enforcing policies, on average, there seems to be around a 60% time reduction when using LDAP compatible authentication processes over using NIS. This is primarily due to all the manual checking and validating created wrapper processes, as well as all the overhead locking and reestablishing accounts due to inactive users or, my favorite, “I forgot my password”. The time savings seems to not change based on whether you have 200 users or 2000 users. The biggest time spent is setting up your model.

How does IT drive Process Innovation?

webadmin@intel.com — Mon, 26 Mar 2012 19:48:28 GMT

Recently, I read an article on Harvard Business Review, entitled: Look to IT for Process Innovation? - Brad Power -HBR

http://blogs.hbr.org/cs/2012/03/look_to_it_for_process_innovat.html

The blog article poses: Are companies missing out on the product and process ingenuity of IT people? The author thinks many companies are missing out by not including IT in business strategy and process innovation discussions. He provides examples in the blog about what key tools IT organizations can bring to the table. The examples in the blog include: process improvement ("lean") development framework, rapid ("agile") development techniques, as project teaming.

What other IT competencies can help drive process innovation?

And what else are you doing to make sure your IT organization has a seat at the business strategy table so that you can help drive real process innovation?