Speaker: Daniel Neumann, TSP – Azure Infrastructure, Microsoft (ex-MVP).
Selecting the Best VM Size
Performance of each Azure VM vCPU/core is rated using ACU, based on 100 for the Standard A-Series. E.g. D_v2 offers 210-250 per vCPU. H offers 290-300. Note that the D_v3 has lower speeds than D_v2 because it uses hyprethreading on the host – MS matched this by reducing costs accordingly. Probably not a big deal – DB workloads which are common on the D-family care more about thread count than GHz.
Documentation has been improved to show actual Gbps instead of low/medium/high. Higher-end machines can be created with Accelerated Networking (SR-IOV) which can offer very high speeds. Announced this week: the M128s the VM can hit 30 Gbps.
Is not always enabled by default for Windows VMs. It is on larger VMs, and it is for all Linux machines. Can greatly improve inbound data transfer performance for multi-core VMs.
Listed in the VM sizes. This varies between series, and increases as you go up through the sizes. Watch out when using Premium Storage – lower end machines might not be able to offer the potential of larger disks or storage pools of disks, so you might need a larger VM size to achieve the performance potential of the disks/pool.
Daniel uses a tool called PerfInsights from MS Downloads to demo storage throughput.
Why Use Managed Disks
Storage accounts are limited to 50,0000 IOPS since 20/9/2017. That limits the number of disks that you can have in a single storage account. If you put too many disks in a single storage account, you cannot get the performance potential of each disk.
Lots of reasons to use managed disks. In short:
- No more storage accounts
- Lots more management features
- FYI: no support yet for Azure-to-Azure Site Recovery (replication to other regions)
If you use un-managed disks with availability sets, it can happen that all 3 copies of storage accounts are in the same fault domain. With managed disks, availability set alignment is mirrored by disk placement.
Do not use disk mirroring. Use simple virtual disks/LUNs.
Ensure that the column count = the number of disks for performance.
Daniel says to format the volume with 64KB allocation unit size. True, for almost everything except SQL Server. For normal transactional databases, stick with 64KB allocation unit size. For SQL Server data warehouess, go with 256KB allocation unit size – from the SQL Tiger team this week.
Daniel doesn’t appear to be a fan of micro-segmentation of a subnet using an NVA. Maybe the preview DPDK feature for NVA performance might change that.
He shows the NSG Security Group View in Network Watcher. It allows you to understand how L4 firewall rules are being applied by NSGs. In a VM you also have: effective routes and effective security rules.
Encryption Best Practices
Azure Disk Encryption requires that your key vault and VMs reside in the same Azure region and subscription.
Use the latest version of Azure PowerShell to configure Azure Disk Encryption.
You need an Azure AD Service Principal – the VM cannot talk directly to the key vault, so it goes via the service principal. Best practice is to have 1 service principal for each key vault.
Storage Service Encryption (managed disks) is easier. There is no BYOK at the moment so there’s no key vault function. The keys are managed by Azure and not visible to the customer.
The Test Tools Used In This Session
Comparing Performance with Encryption
There’s lots of charts in this section so best to watch the video on Channel 9/Ignite?YouTube.
In short, ADE encryption causes some throughput performance hits, depending on disk tier, size, and block size of data – CPU 3% utilization, no IOPS performance hit. SSE has no performance impact.
Azure Backup Best Practices
You need a recovery services vault in the same region/subscription as the VM you want to backup.
VMs using ADE encryption must have a Key Encryption Key (KEK).
Best case performance of Azure Backup backups:
- Initial backup: 20 Mbps.
- Incremental backup: 80 Mbps.
- Do not schedule more than 40 VMs to backup at the same time.
- Make sure you have Python 2.7 in Linux VMs that you are backing up.