Best Practice for handling ISO/CD or Floppy images

[DonalB]

Hi,

I've just noticed that a user has attached an iso to a protected VM with the iso located on a datastore backing a different protection group and both protection groups threw up errors with one becoming 'Invalid', with all VMs for the invalid PG now showing under the PG where the VM I connected the ISO to lives.

While the ISO is connected to the VM removing the protection group and then trying to recreate it isn't allowed as the datastore shows in the wizard as being linked to the other PG??

I understand that this is somewhat expected however have been having a look around and can't find anything to suggest a way of handling how to deal with ISO or Floppy images that do not reside on the datastore in a protection group. Does anyone have any views on this?

I've been considering the options:

1. Centralise all ISO/floppy images to a single shared datastore - this may have implications for protection groups becoming invalid in the same way when a user attaches an image unless we replicate this datastore. However not sure how this is handled by SRM if VMs from different datastores/PGs have ISO's assigned to them from this same shared ISO store, and in any case I think the VM will show as not protected while the ISO is attached which is point of understanding as in that's OK as long as the ISO/image is not attached for too long'

2. Ban the use of images from datastores, use the VI client passthrough options only - possible but maybe not so flexible, guess I could create a windows share and load all images up there, then maybe revoke permissions on configuring the VMs CD for any but the Datacenter Admins

3. Put all ISO/images on all datastores - not really an option, bit daft really!;)

I'm thinking 2 is the obivious one, but if anyone has any other solutions I'd be interested in hearing them.

Cheers

DB

[TimOudin]

I'm not entirely sure that number 1 would work, think the VM would still report as needing repair or not protected.

That said, I've tested (exactly once) a recovery test of virtual machines CD/DVD attached at the client side and with datastore ISO images and have been able to successfully recover them. I don't believe that this is an issue other than the protection groups showing the error. I still agree that something should happen, I don't like ISO left attached at all. I'm currently working on an automated PowerCLI script that will brute force detach CD/DVD nightly.

Tim Oudin

[DonalB]

I agree, that's an option also. I seem to recall someone posting a bash or perl script way back when in the early esx 3.0 days, for disconnecting CDs. There is this excellent looking script from SCampbell I guess, http://communities.vmware.com/message/1079489, might be worth reviewing and using. I'm still not sure this is ideal though as the errors and potential alerts that are generated when the devices are connected would be annoying, the risk for that kind of 'chatter' to result in valid alerts being missed starts to increase.

Cheers

DB

[mal_michael]

I've just noticed that a user has attached an iso to a protected VM with the iso located on a datastore backing a different protection group and

both protection groups threw up errors with one becoming 'Invalid', with all VMs for the invalid PG now showing under the PG where the VM I

connected the ISO to lives.

This is an expected behaviour. Read the following KB article: SRM: How Changes to Virtual Machine Storage Affect Protection

While the ISO is connected to the VM removing the protection group and then trying to recreate it isn't allowed as the datastore shows in the

wizard as being linked to the other PG??

Unmounting the ISO will fix the protection groups.

Regarding the options you suggested:

1. If the datastore is replicated, this will not work, see the KB.

If it is not replicated, connecting the ISO to VM will only affect its protection.

2. I am not sure how SRM handles ISO images connected via vSphere client. Configure permissions or run scheduled script to unmount (PowerCLI script to do that is really simple one) may be an option. It is also possible to run "Configure Protection" wizard for a VM in the protection group and set its CDROM drive to not attached.

3.