Powershell script run to long after migration from Powercli 6.5.4 to Powercli 11

[Touffi]

Hi Community

My script run to long after changing PowerCLI 6.5.4 to Powercli 11.

I applied some recommandations found in internet but I'm not really satisfied.

My system is Windows 2016, 4 CPU's , 8GB

I changed scheduled Task Priority from 7 to 4

I control the PowerCLIConfiguration:

Scope    ProxyPolicy     DefaultVIServerMode InvalidCertificateAction  DisplayDeprecationWarnings WebOperationTimeout

                                                                                                  Seconds           

-----    -----------     ------------------- ------------------------  -------------------------- -------------------

Session  NoProxy         Multiple            Ignore                    True                       300               

User     NoProxy         Multiple            Ignore                                                                 

AllUsers NoProxy

An exemple of running time:

	Priority 7	Priority 4
PowerCLI_654	7mn	7mn
Powercli_11	36mn	17mn

With PowerCLI_11 raise now in Windows an Event 10016

Can someone help to correct this issue?

Thanks for suggestions.

Regards

Denis

[LucD]

Can you share the script?

[Touffi]

Hi Luc

My Autologon script cannot be shared because servername ...

But it tokk allways 2 minutes for the multiple vCenter

Regards

Denis

[Touffi]

Please note that I'm away thie afternoon

Thanks and regards

Denis

[LucD]

I see you are using the StopWatch in that script.
Were you able to pinpoint a specific part of the script that seems to run longer?

[Touffi]

Parent info and dastores info

[Touffi]

I shall go now !

I give you an exact answer with all stopwatch tomorrow

Regards

Denis

[LucD]

Did you test 6.5.4 vs 11.0.0 on the same PC?
And agaist which vSphere version are you running your script?
Is the script running as a scheduled task?
Do you see the same execution time difference when the script is run from an IDE (ISE, VSC...)?
Did you by any chance already do a nerwork trace to see if there are any differences in network traffic between both PowerCLI versions?

[Touffi]

Hi Luc,

"Did you test 6.5.4 vs 11.0.0 on the same PC?"

Yes, same dedicated Server 2016 for reporting.

"And agaist which vSphere version are you running your script?"

Against Multiple vCenter with different version 5.5 / 6.0 / 6.7 (windows Based, VC Appliance)

"Is the script running as a scheduled task?"

Yes, with a Service account who belong to a defined Read role with to more privileges.

the thirst one for Datastore lookup (Privileges/Datastore/Browse datastore)

The second for get-powercli (Privileges/Global/Setting)

"Do you see the same execution time difference when the script is run from an IDE (ISE, VSC...)?"

My today tests.

    

"Did you by any chance already do a nerwork trace to see if there are any differences in network traffic between both PowerCLI versions?"

Can you tel me witch tools I can use? It's forbidden Wireshark to use.

Regards

Denis

[LucD]

I did a couple of tests with both PowerCLI versions, but I'm afraid I don't see those big differences in execution time that you are seeing.

I would suggest you open a SR for this behaviour that you are seeing.

And yes, GSS will accept a SR for PowerCLI.
If they refuse, or mention a Developer Support contract, point them to PowerCLI Support Breakdown

[Touffi]

Thanks Luc

I will look ehead.

Regards Denis

[Touffi]

Hi Luc

I find out a big differrence with connect-viserver with one of my multiple vCenter connection.

A vCenter in a special zone take 23 seconds to complete login with PowerCLI v11 otherwise with version 6.5.4 only 4seconds.

Regards

Denis

[LucD]

Did you already try doing a network trace to see where the delay is located?

It could be that TLS is involved, there might be some negotiation going on to agree on the TLS protocol version between your station and the vCenter.

[Touffi]

Hi Luc

We start Windows TCPviewer from Sysinternals and we saw that connect-viserver try to connect to local port 7444.

Regards

Denis

[Touffi]

we are pretty sure something change with PowerCLI 1x

[LucD]

I was more referring to a tool like WireShark, where you could detect any change in protocol between the versions.

Which vSphere version (VCSA & ESXi) are you working with?

[Touffi]

Hi Luc,

We are not allowed to run WireShark...

From my team worker (translated from German)

I have already found out that the (failing) connection attempt on TCP-7444 takes place as follows:
• vCenter 5.5  no SYN_SENT on 7444 (connection time is short)
• vCenter 6.0  SYN_SENT to 7444 (resulting in the described mini-timeout)
• vCenter 6.7  no SYN_SENT on 7444 (connection time is short)

Ergo it is probably less a problem with the network zone, but with the vCenter version used on the destination host.

PowerCLI <10.x / 11.x seems to have no problem resp. there probably was no TCP 7444 connect attempt. That would have to answer VMware.

Further interesting findings regarding the changed connect behavior of PowerCLI 11.x:

• Connecting to an "original vCenter 6.0" (non-upgraded from 5.5) using «Connect-VIServer»  no connection attempt is made on TCP-7444 ...
• Connect via «Connect-VIServer» to an «Upgraded vCenter 6.0 from 5.5» It finds a connection attempt on TCP-7444 stat ...

[LucD]

This might be related to SSLv3 being enabled for vCenter SSO when you do an upgrade to v6.0.

See KB2131310

[Touffi]

Thanks Luc,

Bad news, after testing, fallowing KB2131310 and rebooting the Server, it does not solved our problem.

Regards Denis

[LucD]

Is the SYN-SENT gone?