Network Computingwww.networkcomputing.com

The updates include an improved single sign-on facility in the Kerberos 5 server, a full SunScreen 3.2 firewall and enhancements to Live Update 2.0 that let you upgrade the OS while maintaining availability. New functionality in performance, scalability, management, networking and security abound.

Performance

Solaris 9's performance enhancements include MPSS (multiple page-size support) and an improved multithreading library. MPSS lets a program access portions of virtual memory using variable, unlimited page sizes. Previously, only 8-KB pages were available for a program's stack and heap. You can now use MPSS to run applications with specific memory page-size settings that can map more memory per application. This could help Web services using Java applications.

Freeware in Solaris 9 Click here to enlarge

I installed Solaris 8 and 9 on a Sun Ultra 10 (UltraSPARC IIi 300 MHz) with 512 MB of RAM. Each version ran from a separate IBM Ultrastar 18ES disk (Ultra SCSI, 18.3 GB, 7200 RPM) with Apache's 32-bit Web server (version 1.3). Using Mercury Interactive's LoadRunner 7.02, I created 100 virtual users to engage 10,000 transactions. The results yielded an average of 308.14 hits per second under Solaris 8 and 370.732 hits per second under 9. Without my optimizing either system or enabling the NCA (Network Cache and Accelerator), Solaris 9 showed an impressive 20 percent improvement over Solaris 8.

Resource Management

A major addition to Solaris 9 is the RM (Resource Manager), which allocates and pools system resources, monitors resource consumption, adjusts allocations and generates accounting information on usage for billing and planning. It monitors and controls system performance and resource usage from the SMC (Solaris Management Console) or the command line.

The FSS guarantees application performance by allocating shares of CPU resources to projects. CPU shares have no meaning by themselves; they are meaningful only in comparison with other project shares. The FSS schedules projects against each other, making it impossible for one project to acquire more CPU cycles simply by running more processes concurrently.

Networking

Although ONE begins with Solaris 9, Sun does not give up its previous theme: The computer is still the network. IPlanet Directory Server 5.1, now Sun ONE Directory Server, is an integral part of the Solaris 9 release. It comes with a 200,000 object license for enterprise customers to manage users and resources, but it must be installed after the OS is installed.

Solaris 9 includes LDAP libraries, PerLDAP and a sample configuration file-names service switch for "files" and "LDAP." Also included are the LDAP service modules for PAM, which supports both the authentication and password management components. It is used with the pam_unix.so.1 module to support direct authentication to the LDAP directory server.

Solaris 9 provides an easy script to get a directory server up. I executed /usr/sbin/directoryserver setup as root. After the system accepted a typical configuration and the default directory suite components, I input a FQDN (Fully Qualified Domain Name). Then I chose "nobody" as the user and group to run the service and the default directory server port, 389. Finally, I chose an administrative port from a range of 1024-65535 and set a user name and password for the admin. The Sun ONE Directory Server was up and running.

Last but not least are the security updates in Solaris 9. Sun's SSH (Secure Shell) version 1.0 (protocol support for SSH versions 1.5/2.0) replaces administrative tools that pass authentication and data in clear text (telnet, FTP, RSH and RCP). SSH encrypts authentication information and the data stream. It became my default mode of remote access. TCP wrappers 7.6 is also installed with Solaris 9 but needs additional configuration.

Solaris 9 is not revolutionary, but it continues many of the advancements started in Solaris 8. Add the fact that you can download it free, and upgrading is an easy decision.

To test the Resource Manager under Solaris 9, I first changed the process schedule parameters and enabled the Fair Share Scheduler (FSS) using the dspadmin command. After rebooting the system, I was ready to allocate shares of resources by user, group or process.

Using the Sun Management Console, I drilled down to the system configuration of the SunFire to find the Projects icon. I added a project called user.NWC1 and a dialog box appeared to configure and control users, groups and resources. I added the user to the project and looked at the resource controls. The resource controls let me administer the resources available to NWC1. For example, I could enter a threshold value for the maximum address space, maximum core size, maximum CPU time, or maximum stack size allowed. I chose a threshold of 10 to apply to the maximum CPU shares allowed NWC1.

For each threshold value placed on a resource control, you can associate one or more actions. For example, you can deny resource requests for amounts greater than the threshold. You can also send a signal to the violating process if the threshold is reached (e.g., SIGHUP, SIGKILL, SIGSTOP, SIGTERM). I chose to deny resources and enforced it with the SIGTERM signal. After I saved the user.NWC1 project, I cloned it to create the same projects for users NWC2, 3, 4 and 5. Once all the projects were created, I executed two instances of the nspin program for each user.

The nspin program is an ELF (executable and linking format) 32-bit executable that creates execution threads to load and tax processors. Executing it from the command line used 936 KB of memory while utilizing 20 percent of the CPU resources. When one process was allowed to run unfettered, it would open threads and saturate processor utilization. But this was not the case when the RM was on the job with the FSS. None of our user's programs dominated CPU resources. I took this same approach to successfully limit CPU resources by group and then by process.