Miglogd eating CPU cycles in FortiGate

I recently ran into a problem where I noticed that one of the 2 CPU cores in Fortgate 51E (Fortigate with SSD disk) is constantly running at 99%.

diag sys top

showed that the culprit was miglogd process. As far as I can gather, this process handles system logging functions.

diag sys kill 11 <process id>

and then

diag debug crashlog read

showed a lot of lines like this one

EXT3-fs error (device sda1): ext3_lookup: deleted inode referenced:

It seemed that there were possibly some issues with log disk filesystem. Since I also send logs to FortiCloud (free for 7 days worth of logs!), the next step in troubleshooting process was to

execute formatlogdisk

note that the above command deletes everything on the log disk (logs, quarantined items if any, etc), and reboots the device.

After reboot

diag sys top

showed that system behaved normally. No exessive CPU usage by miglogd process any more.

Hope this helps someone down the road 🙂

P.S. there seems to be some issue in FortiOS 5.6 (and possibly in 5.4) where GUI is unresponsive when you try to change settings under Log&Report > Log Settings. Nothing happens when you change a setting and press Apply.  At the same time, when you change log settings via CLI, they get saved, and GUI reflects the changes made in CLI. That continues even after miglogd process cpu cylces are under control. Go figure…

V.J.

Posted in FortiGate, Technical

10 million „e-Estonians“ by 2025!

Why not become an e-Estonian? Taavi Kotka, Deputy Secretary General for Communication and State Information Systems of Estonian Ministry of Economic Affairs and Communications introduces the new policy of Estonia on becoming an e-resident of Estonia.

taavikotka

In brief                                                                                               cropped-tupsud1.jpg

The Estonian government has approved the concept of issuing digital IDs to non-residents. From the end of 2014, foreigners will be able to receive a secure Estonian e-identity. This creates a unique opportunity to create a new set of remotely usable global services.

The development of the appropriate infrastructure and the range of services require the coordination and stimulation of the public and private sectors. The aim is to make Estonia great: make sure that at least 10 million people around the world choose to associate with Estonia via e-identities.

More details

Estonian citizens are able to perform nearly every public…

View original post 811 more words

Posted in Uncategorized

Comparing Amazon EC2 and Azure performance

A while ago (August 15, 2013), Windows Azure MVP Wely Lau posted in Cloud Zone a comparison of different IaaS platforms from the performance perspective. The comparison was very limited, only comparing single instance Ubuntu Linux performance on 5 different cloud providers. That being said, it was still interesting to see how different cloud providers measure up against each other in simple one dimensional performance test. The original post can be found here.  In it he reaches a conclusion that Windows Azure performance is about 3x better than Amazon AWS performance.

I stumbled upon this comparison just couple of days ago, and one thing that I immediately saw is that the Amazon EC2 instance used was m1.medium – this instance type has been on offer rom Amazon for many years already (starting somewhere in 2009 if I remember correctly). Today (April, 2014) Amazon lists this as previous-generation instance. There are current generation instances available that roughly match the configuration options (CPU, RAM) of the previous generation instance.

Given that, I decided to do the same test myself. Since I have ready access only to AWS and Azure immediately at hand, I did the tests only on these 2 cloud environments. For virtual machines, I chose the same Ubuntu 12.04 LTS image as original tester, and booted 2 virtual Machines:

  • c3.large on Amazon EC2. It has 2 vCPU-s and 3,75GB of RAM
  • A2 on Azure. It has 2 vCPU-s and 3,5GB OF RAM

These two instance types are not exact match, as c3.large has 0,25GB more memory, but most importantly, they have equal number of vCPU-s. What that means in practice, we shall see next.

I ran the latest version UnixBench (5.1.3) on both machines twice, and here are the results:

Figure1
Number on the Y-axis shows UnixBench score.

Quite frankly, the results are stunning. UnixBench test suite shows that Azure instance is approximately 50% faster than comparable Amazon EC2 unit with Linux guest OS. Looking at the detailed test scores, it seems that the biggest difference (about 4x) is in file copy operations and in pipe-based context switching operations. That being said, all other tests show significantly better performance on Azure as well.

Here are the detailed test results:

Azure A2 – Run1
Azure A2 – Run2
EC2 c3.large – Run1
EC2 c3.large – Run2

Looking at the processor specifications inside the instances of Azure A2 and EC2 c3.large do not explain this performance difference either. Azure uses (at least for the host where my test machine was running) AMD Opteron 4171 HE processor, whereas EC2 uses Intel Xeon CPU E5-2680 v2. I could not find any performance test results for Opteron 4171 HE processor, but the Intel E5-2680 v2 sits at the top of the CPU Benchmark list of high-end processors. So, at least VM running on this Intel processor should not be considerably slower than the one running on AMD processor.

It seems that although Amazon has come out with newer instance types after Wely Lau posted his test results in August 2013, not much has changed. It is not 3x the performance difference anymore, but almost 2x difference is still huge.

The hourly cost of Amazon EC2 c3.large (in EU region) is $0.120. Hourly cost for Azure A2 is $0.094. Given that A2 cost per hour is 78,3% of the comparable EC2 c3.large, and that A2 performance is on average 45,5% better than EC2 c3.large, then my conclusion form this limited test is that if single instance performance is important, then Azure is much more cost effective choice. In other words, you can run 45,5% more CPU intensive workload on Azure A2 for 78,3% of the cost compared  to Amazon EC2. And this conclusion is coming from someone who has been Amazon AWS customer and fan of their service since the beginning of 2009.

Granted, I did not look at the other aspects, such as data egress, storage, etc., and these factors will affect the cost at the end. Also, this was testing only Linux OS instances – it would be interesting to do similar tests with Windows virtual machines and with other flavors of Linux – Red Hat for example.

Tagged with: ,
Posted in Cloud

Redirecting Server 2012 (legacy) RDP sessions to Session hosts using RD Connection Broker

Here’s the scenario:
  • You have Windows server 2012 RDP Session based environment set up with more than one Session Host server and RD Connection Broker
  • You want to use RDP client on any computer, type in the RD Connection Broker name, and get connected to any of the session hosts.
  • You know that starting Windows 2012 you do not need to do any load balancing magic with session host servers, but can instead connect directly to the server with Remote Desktop Connection Broker (RDCB) role installed, and RDCB server will redirect your RDP connection to one of the session hosts
Here’s how Microsoft wants you to do it (minimalistic approach)
  • Create a session collection. No need to publish any apps, if all you want is plain old terminal session. Suppose you name your collection RemoteWorkspace
  • Now you have 2 options:
    • Given that you also added RD Web Access on same server where you installed Connection Broker, go to https://rd-connection-broker-server/rdweb and log in with your domain credentials. You should see a remote desktop icon with a same name as your session collection, for example “RemoteWorkspace”. Click on it and it will launch RDP client and connects you to one of the session hosts.
    • Another way (on Windows 8) is to open Control Panel > RemoteApp and Desktop Connections > Click on Access RemoteApp and Desktops > type in following URL with your connection broker / web access server name as the servername https://rd-connection-broker/rdweb/Feed/webfeeds.aspx > type in your username when prompted, and now you have remote desktop connection available under Work Resources. File will be named “RemoteWorkspace (Work Resources)”. Launching the file will connect you to the session host server without issues.
Now, launching remote desktop connection under Work Resources works, but when you just type mstsc in Run box, and try to connect to RD Connection Broker server, you get an error message:
This happens because you are connecting to connection broker server and for some reason there is no redirection happening. So, how come the file on RDWeb website or control panel works? To answer that, do the following:
  • click View resources (see screenshot above)
  • right-click the RDP file and
  • look at the Target field. Note that mstsc.exe is being called with a parameter which is an .rdp file located under user profile.
  • go to the folder where RDP file resides and open the file with Notepad.
  • in there you see 2 lines about redirection and load balancing, such as (second line below probably breaks – it shoudl be all in one line) :
    • use redirection server name:i:1
    • loadbalanceinfo:s:tsv://MS Terminal Services Plugin.1.YourSessionCollectionName
  • this info is passed to RD connection broker server to redirect you to proper collection.

The reason starting mstsc and typing RDCB server name in the Computer filed and trying to connect fails is that there is no redirection and load balancing info passed to the RDCB server.
Here’s how to fix the problem
On the RDCB server open registry editor and go to 
HKLM\System\CurrentControlSet\Control\TerminalServer\ClusterSettings 
Add new String Value with a name  DefaultTsvUrl. For the value, use the part of the line above after

loadbalanceinfo:s:

In our example the value of  DefaultTsvUrl would be:
 tsv://MS Terminal Services Plugin.1.RemoteWorkspace
The best part – no reboot is needed.
That is all you need to fix it! Enjoy!
If anyone knows a more elegant way to do it (without involving registry editor), then please let me know.

Vahur
Posted in Remote Desktop 2012, Technical
Follow me on Twitter

Enter your email address to follow this blog and receive notifications of new posts by email.

Join 143 other subscribers