What things do you look for when picking a server hosting company?

It's a good thing that you're thinking about what questions to ask your hosting company, but I think you're approaching it backwards. First figure out your requirements, and then ask each company how their infrastructure will meet them.

When they're explaining how their infrastructure meets your needs don't be afraid to ask questions, and if you aren't satisfied with the answers you're getting don't be afraid to insist on having someone relatively upper-level give you a good explanation -- You are giving the hosting company good money, and if their sales guy can't explain things to your satisfaction insist on a network engineer or someone from their Datacenter Operations team to explain things.

In addition to what everyone else has mentioned, some other things to consider (geared toward colocation - hosting your hardware at someone else's facility):

General

• Is the facility clean?
• Is the house cabling neat and orderly?
  • If they use cable trays, look up -- Things should be neat, and strapped down with velcro ties.
    (NO plastic zip ties, NO tape)
  • If they route all cabling through the floor ask to look in the underfloor.
    (They may say no. If they say yes stick your head down there and look around. Again, all cabling should be neat and bundled with velcro ties. Suspended cable trays are important here to allow airflow. See cooling.)

Network

• What providers do they have for their uplinks?
• Where (physically) are their network uplinks?
• Is their network core redundant?
• Do they provide redundant access drops to your rack?

Power

• What kind of UPS systems does the facility have?
  • How long can they hold the load?
• What kind of generators does the facility have?
  • How often are the generators tested?
  • How much fuel is on site?
  • What are the fueling provisions in the event of an emergency?
• How much power can you draw in your rack? (Circuit capacity, cooling cappacity).
• Do they provide diverse redundant power to your rack (circuits from separate UPS banks)?

Cooling

• Is the cooling truly N+1 Redundant?
  (If they lose an air conditioner will the room stay at temperature?)
• Are they using a Hot-Aisle/Cold-Aisle layout? (They should be. If not, worry.)
  • Bonus points if they have containment to keep the hot (or cold) air where it belongs.
• Is there adequate pressure in the floor?
  (Assuming they use a traditional down-flow cooling system that bows cold air into the floor, stand at a perforated tile near an air conditioner, then at one as far from the AC unit as you can get -- The breeze should be relatively even)
• Does the room feel hot? (Obviously standing in hot aisles it will, but how is it near the door? In cold aisles?)
• Does the room feel wet?
• Do they take advantage of "free" cooling?
  (air-side economizers, heat wheels, etc?)

Security and Access

• Do you have 24x7x365 access to the facility? (You should!)
• How is that access controlled (Thumbprint? Keycard? See the man at the desk?)

Monitoring

• Do they offer monitoring? (and do you want it?)
• Ask to see their facility monitoring system
  (they might say no, but if it's a really slick system they might want to show off)

Managed Services (If you want them)

• What services are included? Typical selections include:
  • Basic monitoring (ping)
  • Advanced monitoring (SNMP, services, etc.)
  • Remote Hands (you call and we type what you tell us to)
• How many hours of consulting/troubleshooting service are included in your base price?
• Is patching service included?
  • If yes, how do they handle patching (software used, scheduling, etc.)?

Disaster recovery

I put this last because it's really a minimal concern -- Datacenters spend money making themselves very reliable and robust in the face of subsystem/component failures. Disaster Recovery in the sense of "what happens if my datacenter goes away" is best addressed by having another datacenter, so the questions I ask are along those lines:

• Do they have an off-site facility where customers can host cold- or warm-standby racks?
• Do they have enough bandwidth for you to host a cold/warm standby rack with another provider and replicate everything you need?
• Does the facility itself have solid plans to recover from system/component failures?
  • Sometimes it's fun to play what-if: "What if the entire northeast lost power for a week?"

There are a number of things you can look for which will be more or less important to your specific situation. Thinks I always like to know:

• is this the original hoster, or a reseller at the location.
• Space between racks, do you have enough space to move properly and insert servers without problems.
• Cooling, what type of cooling, how did they manage airflow to the racks. You might need to adjust the rack layout to work with this kind of cooling.
• Power, do they deliver enough amps, what about UPS and Generators in case of a power failure.
• Fire extinguish system, what type.. some types might cost you your servers.
• Do they deliver multiple power and uplink (network) connections?
• As for security, check how this is handled. how easy is it to get to your equipment, are there 24/7 people on site, or is it keycard only?

edit & what symcbean said. and I forgot :-)

Besides cost...

Type: colocation or hosted

Access

• physical access to datacenter - time, location
• remote access to devices - normal route, backup route, access to BIOS and boot screens, remote power up/down

Power and connectivity SLA

Data security - safe harbour provisions, access to your hardware by other users of datacentre

Network latency between data centre and your users

Upstream network management - with particular regard to DDOS

Network availability support - multi-pathing?

Continuity planning - including loss of site

By co-incidence this morning I was putting together an RFP on this very subject! Obviously you need to ask what their security arrangements are, and are they accredited - but probe a little deeper and find out how they have assessed the risks internally: how do they vet new staff and monitor privileged access, what is their procedure when an accident takes place, how do they learn from their mistakes?

Find out if they have a good understanding of electricity distribution as this is one area where in my experience some hosters screw up, e.g. they have highly reliable supplies into the building then overload the distribution unit in your pod, or they put twin power supplies in all your servers then run both sides of the rack from the same circuit breaker.

And ask them their views on updates; traditional wisdom says you should test every Microsoft patch before you apply it to your servers of course. Is patch management a service they provide or do you have to do it yourself?

Look carefully at what monitoring they do for you. It will save you time and please your boss if you get a nice daily or weekly report which tells you when your mail server is running out of storage etc. There are many levels of sophistication in this area and you may want to tailor your performance monitoring to your applications so that the measures are as close as possible a proxy for user experience.

Hope this helps!

The quality of their customer support in practice, even with dedicated servers, is one of the most important things. Some SLAs look great on paper but not in practice, and incompetent staff pulling eg the WRONG disk from a RAID in response to a ticket can really ruin your day.

If something appears to be cheap to be true (hosting company working on low margins), the support might sometimes even quickly lose quality once you give them more problems to fix - does not matter if you or they caused the issue! - than they expected since they are in effect LOSING money on you anyway.

Also, check what backup facilities they can offer, if they can offer an affordable onsite backup that does not count to your traffic quota but is still in a different fire protection zone that can save you a lot of trouble and money.

If you plan on setting up a backend LAN, or hardware firewalls/load balancers later: Not every hoster is able or willing to do that.

Interesting question but I think it's going to be very subjective. Eg Some folks are going to worry about how they deal with fire extinguishing - IMHO this is irrelevant since the contract should be covering you even if the place burns to the ground and leaves a crater.

You can look at things like SAS70 certification (now SSAE 16 I believe) and if the datacenter is uptime institute certified (and at what tier), but those thing should be differentiators looked at after you have defined your requirements and presented them to the potential providers.

Defining your requirements is the key as that will greatly diminish the options available and bring the decision to a more manageable level.

I would also not to forget to consider a complete cloud solution as an option.

Redundancy and Speed

See if there are any options to have the shared site mirrored... I know personally that HostMySite.com used to set these up for a bit more than shared hosting... not so much now...

The other thing I would look for is connectivity... you would like a provider which is also a ISP or a Backbone.