David Spillett's questions

We use VMs with snapshots as part of our support and release testing processes, which makes testing patches to client systems convenient (take snapshot, apply changes, test, revert, lather, rinse, repeat (and re-apply the updates & commit the snapshot's changes when the updates go live)), a setup that I am trying to improve.

One of the issues we have is database performance, which I am aware is always going to be bad on a snapshotted VM because of how much extra work is done for every write compared to the same write on a physical machine but I would like to improve this as much as is possible.

On physical machine we tend to split things over three separate drives (or three separate arrays as RAID1 or 10 is standard on our production boxes) when running SQL Server, as a rule-of-thumb keeping data files on one, main database log files on another, and tempdb (& the OS) on a third.

This doesn't seem to be possible with VirtualBox with snapshots as I can not find any way to split the snapshots for each drive over different locations. I can keep three vdisks on separate drives on the physical host which would make the same sort of difference were snapshots not being used, but with a snapshot all write activity (and subsequent read activity for the affected areas) is going to be concentrated on one drive as all the differencing files go to the same place. I can keep the differencing files an a separate drive to the drives holding the base vdisks containing committed activity which will no doubt help, but not as much as being able to completely separate the IO for each vdisk to different physical drives.

tl;dr: Is there a way to ask VirtualBox (or another virtualisation solution, as I may be able to consider alternatives at this point) to keep the differencing files for snapshots with the base vdisk files to which they relate, rather than them all going into one common directory? The snapshot location option is only available at the VM level, not vdisk level, doesn't seem to accept relative paths. Or are we going to be better off just keeping the VM on a 4-drive RAID0 physical volume (with backups on a much safer array, of course!)?

Is it possible to selectively clear content from a particular filesystem, or file/directory within a filesystem, under Linux.

This can be done globally with sync; echo 3 > /proc/sys/vm/drop_caches and for a whole filesystem by temporarily umounting and remounting it, but I've not come across a more fine grained option.

Why would I want this? If there had been a bunch of block cached due to I/O from a process that is going to repeat later, and then a one-off (or regular but not frequent) task is run that results in a chunk of data getting cached (but not enough to push the first lot out), I might like to tell the kernel that I no longer care about the second lot of blocks so that if a third chunk of I/O occurs it gets nixed not the first lot that was loaded from disc - so the soon-to-repeat task isn't slowed down on next run due to the one-off task.

Alternately, is there a way to start a process in such a way as to tell the kernel "this is a one off, don't go out of your way to cache what it touches after it finishes".

This could of course be me wanting to waste time micromanaging something that I should leave well along and let the kernel get on with without interference...

We have has a little trouble with a small box that acts as a VPN end-point and mail relay for our network, caused by the available entropy for /dev/random being too low (which causes TLS connection attempts by exim to fail).

The machine doesn't do anything else, so the normal feed into the entropy pool (interrupt timings from things like disk access) is not enough. As a quick hack I've set a looping script that reads from /dev/hda at a few Mbyte/sec which keeps it topped up. Other than buying a hardware RNG, is there a cleaner way of piping data for entropy from elsewhere, such as a copy of the data our file server uses for its entropy pool? I've spotted several tips for using rng-tools to feed it from /dev/urandom on the same or another machine but that "feels dirty".

Also, is it possible to increase the maximum pool size? It currently seems to max out at 3585.

I am soon installing a new pair of drives in one of our machines that exists as a VMWare host box (running VMWare Server at the moment). They are going to be used as a RAID0 array for a couple of specific VMs that will impose a high I/O load when they are actively in use. The machine hosts a number of reasonably large VMs that are used for testing purposes.

As there is little point (cost wise) getting drives smaller than 500G the resulting array would be 1000G in size which it far more than is needed for this purpose, so I am considering using a chunk of the disks as a RAID1 array for storing VM backups and reference copies (freeing some space on the existing RAID1 array).

Would there be any harm in:

1. splitting the drives into, say, 5 partitions
2. setting one pair of partitions as the initial RAID0 array
3. creating an LVM group using this new physical volume
4. setting one pair of partitions as the initial RAID1 array
5. creating an LVM group using this new physical volume
6. when either volume group needs to expand
   1. creating a new R0/R1 array in a free partition pair
   2. expanding the relevant LVM group to include this new physical volume

I suspect that all of the above will work perfectly fine, but I was wondering if there are any issues that I'm not aware of. For instance, would splitting the drive into multiple arrays affect the kernel's ability to cache I/O effectively at all?

I have considered instead rebuilding the machine with single RAID10 array over all the drives it will end up with, but taking the machine offline for as long as that will take is not an option and it would not allow the same separation of I/O load that having separate arrays does.

Straight to the question: Does anything have a good resource for details of what changed between IE6 and IE7, specifically that might make IE6 unable to connect to HTTPS resources on a IIS7 (Windows 2008) based web servers? Our assumption is that the servers are only accepting newer protocol versions/variants than IE6 can not cope with, but we can not find where this might be configured.

To cut a short story long:

We've hit a problem with a couple of web servers running a client application. Since a pile of local policy changes and other registry settings were changed as a result of the client having penetration testers review the configuration, Internet Explorer 6 has refused to connect to the site via HTTPS (the error reported is the default "cannot find server or DNS error" message). IE7 and IE8 are fine, as are other browsers we have tried (FireFox on Windows, FF on Ubuntu, links, ...) though this is a moot point as many of the users more-or-less exclusively use IE6. IE6 is happy to access the same resources on the same IIS installations via HTTP.

Going through the changes that are documented we have found nothing obvious that has made this the case, and even applying all the changes to one of our test servers does not create the problem, those one of the changes was with regard to pulling in non-local policies so I suspect that this is where the problem comes from.

I've not been able to find any useful information by searching (many many sites documenting how to perform the most basic SSL configuration on the web server and get certificates trusted by client applications and such, but no word apparently relating to this issue), nor has anything obvious jumped out at me while scanning through the local policies documentation for the web server from Microsoft.

Telling the client to upgrade from IE6 is, unfortunately, not an option. I'm loath to tell them to simply rebuild the web server(s) and being more careful which check-boxes they click next time, but it is getting to be point where that might have to be our recommendation...