topic Re: VM Disk Alignment in Firewall and Security Management

VM Disk Alignment

Harald_Hansen — Tue, 20 Mar 2018 08:54:37 GMT

In sk104848 the article recommends to align the disk partition. The installer will overwrite all partitions, so this is not feasible.

How do you suggest to install GAiA and keep the correctly aligned partitions?

Re: VM Disk Alignment

Vladimir — Tue, 20 Mar 2018 13:09:18 GMT

It is my understanding that the disk and partition manual alignment is no longer an issue. These days the hypervisors are capable of handling it on their own: ESXi 6.0 - Disk Alignment - MS EXC2013 - SQL2014 |VMware Communities

I suspect that during the partition initialization by VMs, there is a low-level interaction happening between them and the hypervisor that assures proper alignment.

Re: VM Disk Alignment

Harald_Hansen — Tue, 20 Mar 2018 14:07:59 GMT

If this does apply, then why is this a recommendation for R80.x as well?

From other reading I have found that more recent kernels/distros are more virtualization aware. I would guess this is still an issue with Gaia.

For instance Linux Disk Alignment Reloaded | Dirty Cache .

Re: VM Disk Alignment

Vladimir — Tue, 20 Mar 2018 14:45:35 GMT

I suspect that this is a non-issue in virtualized environments, since there are cloud-based distributions of Checkpoint components that do not specifically require manual alignment procedures. Pretty much all of the vSEC (now CloudGuard) products fall into this category.

If not performing this would've been an issue, it must've been specifically addressed in the deployment section.

Where it is likely an issue is in the OpenServer implementations on local arrays or HDDs, where the SK you are referencing may very well be applicable.

Re: VM Disk Alignment

Harald_Hansen — Tue, 20 Mar 2018 15:19:14 GMT

I hope you are wrong in this, as I have compared the partition scheme of a more recent Linux distro. The difference between the starting point is almost one MB. You can research this yourself with the parted <dev> print command and look in the start column.

Does anyone at Check Point have any opinion on this issue?

Re: VM Disk Alignment

Vladimir — Tue, 20 Mar 2018 19:08:55 GMT

Just read the sk and it is referring specifically to management servers running on ESX with versions 4 and 5 listed at the end for references.

This is the output from SMS R77.30 running under the VMware Workstation 14 on my laptop:

and this one is the R80.10 running on ESXi 6.0:

Re: VM Disk Alignment

G_W_Albrecht — Wed, 21 Mar 2018 10:17:13 GMT

I have shown sk104848 to my Linux / VMware Guru - he thinks that this is rather old, see the references to versions long gone 😉 According to his explanation, the Linux fdisk tool at these times did a trick with alignment - but this should be long over for contemporary distributions. He also regarded "Always use Thick provisioning (thick/lazy is acceptable), never Thin-provision disk resources." as an old hat that is not true anymore. Concerning "Make sure the disk partitions within the guest are aligned." he only sees one possible issue: If you did install CP 6 years ago and since then only updated that VM, a missalignment might be possible there - but this should not take so much performance that you need to worry at all.

Re: VM Disk Alignment

G_W_Albrecht — Wed, 21 Mar 2018 11:56:01 GMT

I have put the points from the comment as feedback into sk104848 and suggested to rework it - so i should get some comment soon!

Re: VM Disk Alignment

Harald_Hansen — Wed, 21 Mar 2018 12:07:34 GMT

I just installed a new GAiA R80.10 VM following the SK recommendations for configuration of the VM.

CentOS 7 creates an offset of 1049 kB on the first partition.

GAiA R80.10 installer has an offset of 32.3 kB on the first partition.

The difference is not negligible when doing logs on a MLM server, even on SSD storage. Your milage may vary on the offset, but every VM I have checked is using about 1000 kB as the offset. We have enough RAM, CPU and SSD-storage, but still the latency is a killer. Every bit of optimization helps.

To get an official response I have decided to open a ticket with TAC.

Re: VM Disk Alignment

Harald_Hansen — Wed, 21 Mar 2018 12:11:33 GMT

You need to print the table from /dev/sda, not /dev/sda{x} to get a valid result.

CentOS 7 install:

GAiA R80.10 install:

Re: VM Disk Alignment

G_W_Albrecht — Wed, 21 Mar 2018 12:48:07 GMT

This is only one side - we should take the relevant storage backend into consideration. I remember that 5 years ago, NetApp techs were discussing the missalignment issue. At present time, i hear that they have other problems and no worry about missalignment is needed. But i am glad that we will get an official statement by CP!

Re: VM Disk Alignment

G_W_Albrecht — Thu, 22 Mar 2018 08:03:20 GMT

Thank you for your feedback on SecureKnowledge solution sk104848. Consulting with RnD, they say that these are our recommendations, and although they are a little old, we would keep them for now, as the Kernel we are currently using is also a bit old, and it has had performance impact.

Re: VM Disk Alignment

Vladimir — Fri, 23 Mar 2018 12:54:40 GMT

Günther,

This does not really answer the question as it was originally posited by Harald:

"In sk104848 the article recommends to align the disk partition. The installer will overwrite all partitions, so this is not feasible.

How do you suggest to install GAiA and keep the correctly aligned partitions?"