VMware Cloud Community
andrea1975
Enthusiast
Enthusiast
Jump to solution

PowerCLI very slow to load on a Windows 2012R2 Server

Hi all,

PowerCLI 5.5 is very slow to load on my Windows 2012R2 Server, I have done some tests

test 1 - load PS Snapin on my worstation (Windows 8.1 64bit - SATA Hard Disk)

PS C:\Users\MyUser>  Measure-Command {Add-PSSnapin vmware.vimautomation.core}

Days              : 0

Hours            : 0

Minutes          : 0

Seconds          : 1

Milliseconds      : 871

Ticks            : 18717065

TotalDays        : 2.16632696759259E-05

TotalHours        : 0.000519918472222222

TotalMinutes      : 0.0311951083333333

TotalSeconds      : 1.8717065

TotalMilliseconds : 1871.7065

test 2 - Load PS Snapin on a Windows 2012R2 Server not connected to the internet, CRL check enabled

PS C:\Users\MyUser>  Measure-Command {Add-PSSnapin vmware.vimautomation.core}

Days              : 0

Hours            : 0

Minutes          : 0

Seconds          : 51

Milliseconds      : 603

Ticks            : 516030768

TotalDays        : 0.000597257833333333

TotalHours        : 0.014334188

TotalMinutes      : 0.86005128

TotalSeconds      : 51.6030768

TotalMilliseconds : 51603.0768



Test 3 - Load PS Snapin on a Windows 2012R2 Server not connected to the internet, CRL check disabled

PS C:\Windows\system32>  Measure-Command {Add-PSSnapin vmware.vimautomation.core}

Days              : 0

Hours             : 0

Minutes           : 0

Seconds           : 16

Milliseconds      : 323

Ticks             : 163238507

TotalDays         : 0.000188933457175926

TotalHours        : 0.00453440297222222

TotalMinutes      : 0.272064178333333

TotalSeconds      : 16.3238507

TotalMilliseconds : 16323.8507

As you can see there is an improvement when I disable the CRL check according to this article: http://blogs.vmware.com/PowerCLI/2010/01/troubleshooting-slow-startup-with-powercli-40-u1.html

But I still have 16 seconds to load the Snapin against 1 second only on my workstation (that has far less computational resources!)

Any help is appreciated.

Reply
0 Kudos
1 Solution

Accepted Solutions
andrea1975
Enthusiast
Enthusiast
Jump to solution

Hi LucD,

I've found a workaround:

when I run the Import-PSSnapin I noticed (with wireshark) a lot of failed traffic to WAN addresses, so, I've set, into Internet Options a fake proxy (127.0.0.1) excluding from the proxy my active directory domain's DNS name (so I can connect to the virtual center bypassing the fake proxy)

This is now the execution time:

Windows PowerShell

Copyright (C) 2013 Microsoft Corporation. All rights reserved.

PS C:\Users\MyUser> Measure-Command {Add-PSSnapin vmware.vimautomation.core}

Days              : 0

Hours             : 0

Minutes           : 0

Seconds           : 2

Milliseconds      : 774

Ticks             : 27745259

TotalDays         : 3.2112568287037E-05

TotalHours        : 0.000770701638888889

TotalMinutes      : 0.0462420983333333

TotalSeconds      : 2.7745259

TotalMilliseconds : 2774.5259

Not bad! Execution time lowered from 16 sec to 2.8 sec

View solution in original post

Reply
0 Kudos
16 Replies
LucD
Leadership
Leadership
Jump to solution

Did you precompile the .Net assemblies as described in How to speed-up the execution of the first PowerCLI cmdlet ?

The performance of PowerCLI has also been improved in more recent releases.

Is there a specific reason you have to stick with 5.5 ?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
andrea1975
Enthusiast
Enthusiast
Jump to solution

Hi Luc, yes I've precompiled the assembly, I have better execution time on the first cmdlet I run, but the time necessary to load the PS Snapin is the same.

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Is upgrading to a more recent version an option ?

There the load should be faster


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
andrea1975
Enthusiast
Enthusiast
Jump to solution

Is it possible to upgrade only the PowerCLI version? I'm connecting to a virtual center 5.5 and to upgrade to virtual center 6 is not an option.

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Yes, you can.

Just check if the PowerCLI version supports the vSphere you are running in the VMware Product Interoperability Matrixes

Just checked, vSphere 5.5 is

v55.png


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
andrea1975
Enthusiast
Enthusiast
Jump to solution

Hi LucD,

I've installed PowerCLI 6 R3, I've disabled CRL check, this is the result:

PS C:\Users\MyUser> Measure-Command {Add-PSSnapin vmware.vimautomation.core}

Days              : 0

Hours             : 0

Minutes           : 0

Seconds           : 16

Milliseconds      : 330

Ticks             : 163306886

TotalDays         : 0.000189012599537037

TotalHours        : 0.00453630238888889

TotalMinutes      : 0.272178143333333

TotalSeconds      : 16.3306886

TotalMilliseconds : 16330.6886

as you can see, the load time has not changed

Reply
0 Kudos
peetz
Leadership
Leadership
Jump to solution

Hi Andrea,

have you tried disabling the Certificate Revocation Check? Follow these steps:

- Open "Internet Options" in the Control Panel or Internet Explorer
- Click the "Advanced" tab
- Scroll down to "Security"
- UNcheck "Check for publisher's certificate revocation"
- UNcheck "Check for server certificate revocation"
- Click OK

- Andreas

Twitter: @VFrontDe, @ESXiPatches | https://esxi-patches.v-front.de | https://vibsdepot.v-front.de
Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Since you alreayd tried the certificate revocation check, it must be something else that is causing the slow load time.

Do you have this on all the W2K12R2 servers, or just this one ?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
andrea1975
Enthusiast
Enthusiast
Jump to solution

Hi LucD,

I have these behaviour on all Windows 2012R2 Server that don't connect to the internet.

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

That sounds again like the certificate revocation timeouts.

You are sure that you disabled that check.

There is no GPO that resets this by any chance ?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
andrea1975
Enthusiast
Enthusiast
Jump to solution

Hi LucD,

I've double checked the registry key that holds the value for CRL's checking:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing

and it's correctly set to 146944 (decimal)

and using the GUI:

crl.png

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

Just a thought, does adding the Verbose switch show anything ?

Ultimately you could run a network trace while loading the PSSnapin, perhaps there are some timeouts occurring.

Otherwise I'm out of ideas for now :smileycry:

Perhaps you should open a SR. PowerCLI is supported after all.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
andrea1975
Enthusiast
Enthusiast
Jump to solution

Hi Luc,

thank you for your response.

Adding the -verbose option to the Add-PSSnapin produces no output.

I've installed WireShark to sniff what's going on, since I'm not an expert of sniffing packets, have you some advices on what to monitor?

Thank you again

Reply
0 Kudos
LucD
Leadership
Leadership
Jump to solution

I would start looking for outgoing packets where no response comes back.

Since the symptoms look like the ones for expired certificates, I would make there are certificate validations going out.

Or names queries (DNS), where a "not found" reply comes back.

There is no solid "follow this procedure" to look for potential issues I'm afraid.

It's a bit of detective work I'm afraid :smileygrin:


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

Reply
0 Kudos
andrea1975
Enthusiast
Enthusiast
Jump to solution

Hi LucD,

I've found a workaround:

when I run the Import-PSSnapin I noticed (with wireshark) a lot of failed traffic to WAN addresses, so, I've set, into Internet Options a fake proxy (127.0.0.1) excluding from the proxy my active directory domain's DNS name (so I can connect to the virtual center bypassing the fake proxy)

This is now the execution time:

Windows PowerShell

Copyright (C) 2013 Microsoft Corporation. All rights reserved.

PS C:\Users\MyUser> Measure-Command {Add-PSSnapin vmware.vimautomation.core}

Days              : 0

Hours             : 0

Minutes           : 0

Seconds           : 2

Milliseconds      : 774

Ticks             : 27745259

TotalDays         : 3.2112568287037E-05

TotalHours        : 0.000770701638888889

TotalMinutes      : 0.0462420983333333

TotalSeconds      : 2.7745259

TotalMilliseconds : 2774.5259

Not bad! Execution time lowered from 16 sec to 2.8 sec

Reply
0 Kudos
MCioe
Enthusiast
Enthusiast
Jump to solution

I found I had a similar timing  issue with PowerCLI 11 on Windows 2012R2 in a vSphere 6.5 environment - also off-line.

The thing that worked for me was to delete all the default Root Hints in my DNS and the performance improved dramatically.

Apparently, when you stand up a DNS server, roughly 15 Root Hint entries are automatically added.  These IP addresses have no connectivity to the real world, but the Import-module cmdlet will wait for a network timeout looking for CRLs for each of these IP entries before returning to the command line. It would take about 3 minutes to complete.

I also have been told that unless you delete the root hints from 3 locations in your environment (I believe they are also in some registry keys), then these hints will come back in the DNS and you have to delete them again.

Maureen

Reply
0 Kudos