HCLT Whitepaper: Effective Web Hosting on Z/Linux

July 2012

Effective Web-hosting
on Z/Linux
Understand the Virtualization Better

2
Effective Web-hosting on Z/Linux | July 2012

CONTENTS
EXECUTIVE SUMMARY 2

PURPOSE 3

BACKGROUND 3

INFRASTRUCTURE PLANNING FOR VIRTUALIZATION ON SYSTEM Z 4

PREPARING Z/VM & Z/LINUX ON SYSTEM Z 6

WEB-HOSTING ON Z/LINUX – SERVER CONSOLIDATION APPROACH 7

WEB-HOSTING ON Z/LINUX – FEW SNAPSHOTS OF THE WEBSITE 8

WEB-HOSTING ON Z/LINUX – APPROACH AND STEPS [1] 9

WEB-HOSTING APPLICATIONS ON THE INTERNET – GUIDELINES 12

WEB-HOSTING APPLICATIONS ON THE INTERNET – BENEFITS [2] 12

END NOTE 15

REFERENCES 16

ABOUT THE AUTHOR 16

EXECUTIVE SUMMARY
Web-hosting on IBM managed platform (System Z/Linux)
through virtualization is an e-business on-demand solution that
offers cost effective managed server capacity on an on-demand
basis. This whitepaper gives a closer look at how virtualization is
done on System Z and thereafter how web-hosting is done on the
Z/Linux platform. It also helps in understanding how virtualization
and work load management enable server consolidation on the
mainframe by running distributed servers.
Web-hosting in an IBM managed solution on Z/Linux allows the
end customer to replace their physical web, database and application
servers with virtual servers running on Linux called as ‘Images’
under System Z which helps in achieving high utilization levels
of 85% or more. This is done through the mainframe “speciality
engines” for improving the server consolidation by connecting
different distributed servers in one box and we call it as “Data
Centre in a box”.
The main benefits and the reason for web-hosting on IBM managed
platform on System Z/Linux is that it helped us:
• Enable the infrastructure on server consolidation on the
mainframe system by consolidating UNIX-based applications
on Linux on a mainframe that will help in eliminating
numerous UNIX servers (and corresponding human-related
management costs)

© 2012, HCL Technologies. Reproduction Prohibited. This document is protected under Copyright by the Author, all rights reserved.

3

• Greatly improve the system availability, reliability and security
for the applications running on this platform
The following activities on Z/Linux were implemented as a part
of POC in our Mainframe CoE lab. We have developed a kind of
competency which is not found in other companies and is very rare.
• Each of the virtual images running on System Z/Linux will
utilize all the resources such as servers, routers, processors and
network in the most efficient way
• All the virtual Linux Images are completely isolated from within
one another on the System Z platform even though they are
networked together virtually by Z/VM

PURPOSE
The purpose of this document is to describe effective web-
hosting on Z/Linux platform and explain how it helped us in the
server consolidation we did as part of POC in our CoE and have
implemented the same. The guidelines cover the following areas
that can be referred during the implementation phase:
• Infrastructure planning for virtualization on System Z explained
• Preparing Z/VM and SUSE Linux on System Z
• Infrastructure planning for web-hosting applications on
Z/Linux platform
• Guidelines for web-hosting applications on System Z which
includes enabling the SSL

BACKGROUND
Web-hosting on Z/Linux platform includes having the team
understand the “what”, “how” and “why” in the Z/Linux
environment; why the users need to work in a certain way, why
processing must occur in a certain way, how this helps in Z/Linux
server consolidation etc. It is important to recognize that users
(The Z/OS and Z/VM System Administrator) should have basic
administration knowledge on System Z and Linux platform and
typical hardware and software information on System Z is needed.
Most of the knowledge to be acquired is possessed by the mainframe
system administration team who had actually implemented the
solutions on the above said platform, thereby gaining more practical
knowledge by building this competency through POC in our own
HCL mainframe CoE lab. Therefore, it is essential that companies
develop an in-depth plan to acquire the information and include
the detailed identification and documentation of this knowledge
throughout the process.


4

INFRASTRUCTURE PLANNING FOR
VIRTUALIZATION ON SYSTEM Z

Why the mainframe is a good strategic platform for
virtualization?
Most of the world’s leading financial institutions run on mainframes
due to their best-in-the-industry reliability, availability and security
characteristics.
The following are the pre-requisites and the infrastructure setup
done prior to the installation of Z/VM and Linux Images which
eventually led to the virtualization on System Z/Linux:
• IFL (Integrated Facility for Linux workloads) is an IBM processor
dedicated to running the Linux operating system with z/VM.
It is installed and activated for Linux workloads in one of the
new LPAR. The reason for having a dedicated LPAR is to ensure
that Z/LINUX should not have access to other LPARs on the
existing mainframe system
• Z/LINUX LPAR is created and activated through a new name,
PAR partition number, PAR channels and devices are allocated
to that LPAR
• Allocate the memory (RAM) in the new LPAR for Z/Linux
and do the allocation of hardware resources through the
capacity planning
• Capacity planning was done in such a way that the Z/Linux
Image is a Linux-only mode and has been allocated 6MB for the
Linux Image
• The channel path and TCP /IP are activated through IOCDS
(I/O Control Data Set) activation and the profile on System Z
• Dedicated OSA device with the existing channel port were applied
to Z/VM to avoid performance issues and Z/Linux Images were
created on top of these OSA channel ports. Each Linux Image
will have a dedicated IP on the same network segment where
Z/VM resides upon
• We used dedicated formatted DASD of type MOD3 for storage
allocation to Z/VM and Z/Linux
• Gateway IP, DNS needs to be configured during the infrastructure
set up of Z/VM and Z/Linux


5

Network

Gateway
Server
z/VM
Linux1 Linux2
TCP/IP

z/VM
Fig 1.1: Network Architecture of Z/VM and Z/LINUX

L L L L
LINUX

I I I I
z/VM

z/OS

z/OS

N N N N OSA
U U U U ETHERNET
Z/VM X X X X CHANNELS
z/OS
version 5.4
z/VMz SUSE
z/VM
LINUX
LPAR LPAR LPAR 64 BIT

zAAP CP CP CP CP IFL IFL

Z9BC IBM Machine
zIIP
IIP SMC HMC

HCLZ9BC
MAINFRAME SYSTEM

Fig 1.2: HCL Mainframe Architecture involving Z/VM,
Z/LINUX and Z/OS
The above mentioned diagram is part of the HCL mainframe
Infrastructure diagram and was done by the HCL mainframe
solutions COE team.
• We have used OSA express card which is of device type OSD and
the link type is QDIOETHERNET
From the infrastructure to the operating system, System Z
virtualization is done on multiple layers of security that offers
protection to the virtual environment. Dedicated firewalls and
routers are part of every customer’s environment providing
isolation from other customers, allowing only necessary
internet traffic.
As shown in the diagram below, each customer has a dedicated
firewall/ router to support their individual security needs:


6

Fig 1.3: Linux Instances under Virtual Network Firewall

PREPARING Z/VM & Z/LINUX ON SYSTEM Z
Z/VM is implemented on System Z to run multiple Linux Images
on the existing infrastructure to support various applications to
users in a virtualized environment.
• After IFL (Integrated Facility for Linux) processor is activated
on the new LPAR, Z/VM will be installed
• Z/VM will reside on a separate dedicated IP segment on a
dedicated OSA device and OSA channel
• The new LPAR, named as ZNLA, can have multiple Linux
Images residing on the dedicated IPs
• Open the 3270 console on HMC (Hardware Management
Console) and load the Z/VM CD from the CD-ROM by giving
/CPDVD command which will take around 6 minutes to Z/VM
to boot up from memory and the installation is started
• All the necessary components of Z/VM are installed during this
process as mentioned below in the installation components type
Installation Component Type
LPAR Name
OSA Device Name
OSA Device Channel Address
Subnet Mask
Network Device Type
Port Name
Gateway IP Address
DNS server IP
IP Address for FTP server
User Name for FTP method
Password for the FTP method
Z/Linux DASD Volumes

Table 1: Installation Components for Z/Linux


7

WEB-HOSTING ON Z/LINUX – SERVER
CONSOLIDATION APPROACH
64% of the Top100 System Z clients are running Linux on
mainframes and more than 3000 applications are available for Linux
on System Z.

Fig 1.4: Z/Linux server consolidations on System Z

In one of our practical experiences, web-hosting Java-based
applications on System Z/Linux was done through the virtualization
on Z/VM and it eventually lead to server consolidation on
System Z.
The Linux web server offers the power and bandwidth for
hosting the web-based applications on the internet without any
cost involved. We have added additional security features such as
anti-virus scanner for Linux which detects all vulnerabilities for
the application hosted on internet and SSL-based encryption by
protecting customer data and their transactions. The Linux web
server is based on the Apache Plat web server.

What were the tools used for porting the web-based
applications on System Z/Linux?
• Apache Tomcat – An open source software implementation of
the Java Servlet and Java Server pages technologies. Download
the Apache Tomcat from the open source and install the
version applicable to System Z on the type of Linux-based OS
(For Example: SUSE / Red Hat) and install the software
• We installed the SSH Client, Putty telnet software to connect to
the Linux Image


8

• Installation of Java (SDK – Software Development Kit) is
needed to have Java Run-time Environment (JRE) to run
Java-based applications and applets through Apache Tomcat
web server. Moving Java applications to Linux platform is quite
straightforward as mentioned below
• The latest version of JAVA SDK is available on Sun’s Java website
• CLAM AV product – An anti-virus open source tool kit for
Linux-based applications designed especially for e-mail scanning
on mail gateways. It provides a number of utilities including a
flexible and scalable multi-threaded daemon, a command line
scanner and advanced tool for automatic database updates
The following procedures need to be done for running Java-based
applications on Apache Tomcat web server in the Linux OS:
Step 1: JAVA_HOME=”/path/to/your/java/installation/
directory”
Step 2: export JAVA_HOME
Step 3: Start Tomcat, go to /home/tomcat/tomcat/conf/catlina.sh
Step 4: If setup is fine then your telnet to port 8080 should connect
by browsing through http://localhost:8080 and the default
welcome page will appear. Tomcat by default runs on port 8080
Step 5: As a final test, see if you can login to the Tomcat manager
application, which lets you manage your application by going
through http://localhost:8080/manager/html and login using the
credentials of the admin user that was added in the tomcat-users.
xml file
• Installation of VS FTP – VSFTP is a licensed FTP server for Linux
and its secure and extremely fast. It uses normal, unencrypted
usernames and passwords for authentication

WEB-HOSTING ON Z/LINUX – FEW SNAPSHOTS OF
THE WEBSITE

Snapshot of the website hosted on the internet


9

WEB-HOSTING ON Z/LINUX – APPROACH AND
STEPS [1]
The https certificate needs to be deployed on the URL which is
being hosted on the internet. The SSL certificate needs to be an
authorized for the certified vendor such as VeriSign. The SSL
protocol aims to provide solutions to two simple security problems:
• How can we securely transmit data between two parties in such
a way that only the two parties can read it?
• How can one (or more) of the parties involved prove that they
are actually the entity we want to grant the ability to decrypt our
encrypted transmission?
Setting up SSL for Tomcat can be divided into two main tasks:
• Creating a functional key store
• Configuring the Tomcat connectors and applications

Step 1: Creating a key store
A key store is a place where the cryptographic keys and certificates
can be stored. It is created as a file and can be used to store the SSL
keys and certificates for Tomcat for SSL communications. You can
create a new key store using the program called key tool which
comes along with the JDK.
Issue the following command (highlighted in yellow) to create a
new key store:
$JAVA_HOME/bin/keytool -genkey -alias [youralias] -keyalg
RSA -keystore [/preferred/keystore/path]
Note:
• Before issuing the command set appropriate paths needed
(highlighted in blue)
• Remove the [] brackets while issuing the above command
• Ensure whether the path of program key tool is correct
• In the preferred key store path you should enter the filename
with the extension .jks as shown below
• Use an alias and path of your choice
Ex: /opt/ibm/java-s390x # jre/bin/keytool –genkey –alias tomcat
–keyalg RSA –keystore /opt/ibm/java-s390x/keystore.jks


10

Step 2: Once you issue the above command it will ask for the key
store password
• Enter a password of your choice (Do not forget it)
• After this it will ask for the information like NAME, COMPANY
NAME, CITY, STATE etc.
• Fill in whatever details is needed. Please give the accurate details
as you have to submit this to CA to obtain the certificate. NAME
should be the name of the URL which you like to host under
https protocol. In our case, we gave modernmainframe.hcl.com
• Finally it will ask for key password. Press Enter without
entering anything
• Check for the key tool program and if it resides in JRE/bin
folder specify the same and it will be created in the path specified
as shown below:

Creating a Certificate Signing Request (CSR):
As discussed earlier, you can use the same key tool program to
generate a CSR file too.
Issue the following commands:
$JAVA_HOME/bin/keytool -certreq -keyalg RSA -alias [youralias]
-file [yourcertificatname].csr -keystore [path/to/your/keystore]
Note:
• Enter an alias and certificate name of your choice
• Remove [] brackets
• Specify key store path along with filename and extension


11

On successful execution, you will get a file called modernmf.csr in
the path specified above. This file is submitted to CA (Certification
Authority) for obtaining the certificate.
CA will provide the certificate files with extension .cer which has
the root certificate as well.

Importing the certificate to local key store and installing the
new certificate:
• As we now have both the new certificate and CA certificate, FTP
both the certificates into Linux
• From the new certificate export the root certificate and issue the
following command: keytool -import -alias root –keystore [path/
to/your/keystore]-trustcacerts-file [path/to/the/root certificate]
Note:
• Remove [] brackets
• Specify the keystore path with filename and extension
• Specify the root certificate path with extension

Example:
/opt/ibm/java-s390x # jre/bin/keytool -import -alias rootca
-keystore /opt/ibm/java-s390x-60/keystore.jks -trustcacerts -file /
opt/ibm/java-s390x-60/rootcert.cer
• It will prompt for SSL password. Give the password which you
gave earlier
• It will ask a message to trust the certificates. Type Yes
• The certificate will be updated once it is done


12

WEB-HOSTING APPLICATIONS ON THE INTERNET –
GUIDELINES
Following are the guidelines used for the web-hosting applications
on the internet and the applications that reside on the Z/Linux
platform:
• A valid SSL certificate needs to be deployed on the URL
• The latest web server, application server and DB server is
suggested to be used
• Log Information on User accounting, IP accounting and
application access to be tracked per session and must be available
• Log forwarding to log correlation unit is mandatory for Security
Incident Management
• Session time-out to be kept for the web page as default when it is
idle for some time
• Authentication mechanism to be made available in the application
for the web page which is being hosted on the internet for
security reasons
• Implementation of password policy for all user accounts that
exists in the application must be implemented
• Application needs to be secured before it is being hosted on the
internet and hence testing the application (Vulnerability Testing)
plays a major role here. The contents of the application need to be
thoroughly verified and to make sure that not much companies
confidential data are being shared
• The necessary bandwidth needs to be allocated for the application
which is hosted on the internet

WEB-HOSTING APPLICATIONS ON THE INTERNET –
BENEFITS [2]
The following are the benefits for web-hosting applications on the
internet as well as on the server consolidation approach. According
to the study done by IBM, It has helped them in server consolidation
on the mainframe system by consolidating Linux based workloads
for the applications running on a mainframe platform. This study
done by IBM was taken from IBM case studies and success stories.
• IBM had done some marketing and research on server
consolidation with 62 Linux servers and consolidated to one IFL
which resulted in reduction in licensing costs, labour costs. The
below details were taken by IBM’s findings on “Mainframe Total
Cost of ownership issues”


13

Example:
62*@ $5,000 = $310,000  this is for 62 Linux Servers
For one IFL processor with high Utilization, 1@ $125,000
= $125,000
• It also helps in eliminating numerous LINUX/ UNIX servers
(and corresponding human-related management costs) which
involves system administration tasks on the Linux servers
• It will greatly improve the system availability, reliability and
security for the applications running on this platform
• Optimized for Linux environment to have open source tools on
System Z environment with good management interface
• Maintenance is easy for handling various issues in a single box
(System Z/Linux) since it is developed under the virtualization
concept
• Support for z/Linux administration to support all the open
source products for web-hosting is easy
• High Availability since it is under System Z hardware without
down-time and no threats to security
• Lower TCO in terms of infrastructure setup and other software
licensing costs as well

How other speciality engines make server consolidation more
attractive and their advantages are:
Speciality Engines – zIIP, zAAP and IFL reduce the operating
costs to a great extent as IBM does not charge any license fees for
MIPS consumption on these processors. As z/LINUX runs on IFL,
there is no recurring MIPS cost for the applications running on
z/LINUX.
Special assist processors for System Z are:
• For Java workloads (zAAP) – The Web Sphere application server
using zAAP processor on the mainframe is cheap when used in
the distributed environment along with the software licensing
costs and server maintenance costs
• For example, consolidating at least up to 85% new Web Sphere
applications and Java workloads on the mainframe lowers the
cost of acquisition such as operating costs, hardware, MIPS and
TCO costs.For selected DB2 workloads, (zIIP) processor is used
in parallel queries (Data Warehouse scenario) where we can have
up to 40% workloads to be zIIP-able. Also, in Database server
scenarios where workloads are high it can be zIIP–able for
queries received via DRDA remote access protocol
• Offloads to speciality processors reduce software load and charges
on general purpose processors


14

Economics of Offloading
The following considerations contribute to server proliferation
when they are offloaded:
• De-multiplexing of applications to dedicated servers:
–– One application workload per server group
–– Peak-to-average provisioning yields low utilization
–– Additional provision for expected growth in out years
(no capacity on demand)
–– Batch workload may stress I/O capabilities
–– Separate servers for production, failover, development/test,
disaster recovery
–– Infrastructure servers for systems management
• Processing comparisons:
–– Language expansion (CICS/COBOL path lengths are
highly optimized)
–– Conversion factor (MIPS to TPM-C or RPE) worsens as
I/O rates increase
–– Oracle RAC inefficiencies compared to DB2
• Other TCO considerations
• 3–5 year lifetime for distributed servers requires repurchase
• Dual environments during migration
• Partial offloads eliminate the lowest cost MIPS first

As mentioned below, the table shows how the customers have been
benefited while consolidating to z/Linux and this is taken from
IBM’s success stories and case studies. All information from table 2
has been obtained from IBM website.


15

Benefits achieved on
Customer
consolidating to z/Linux
US-based bank Moving to SUSE Linux Enterprise Server on
System Z, helped achieve US$1.8 million in
the first year and an estimated US$9.6 million
through 2011.
US-based insurance and finan- Achieved US$15 million cost savings over
cial services company with three years by consolidating workloads onto
revenue of US$21 billion its virtualized infrastructure.
Bank in Russia By consolidating to IBM System Z 9 EC run-
ning z/OS and z/Linux, the bank saves
$400 million per year.
An IT Corporation with rev- Running multiple Linux environments on a
enue of EUR 6 billion single ELS can potentially reduce the TCO by
up to 80%, compared to a traditional distrib-
uted x86 environment.
Europe’s leading independent The ELS can host thousands of virtual
provider of IT infrastructure Linux environments within a single physical
services with revenue of GBP footprint – improving energy efficiency by up
2 billion to 90% and supporting Green IT objectives.
Powerful IBM Integrated Facility for Linux
(IFL) processors reduce the cost of per-proces-
sor licensed software (such as Oracle) by up to
97%. IBM z/VM enables new Linux environ-
ments to be provisioned in minutes with no
need to procure new hardware, increasing
enterprise agility.

Table 2: IBM customer success stories on
Z/Linux server consolidation

END NOTE
Defining a long-term vision and the roadmap for its execution are
the utmost priorities for any CIO. This can be achieved only if the
CIOs and IT managers outsource the IT work of legacy applications
to a service provider. This gives them more bandwidth to work
on strategic things. To make the outsourcing model successful for
legacy applications, knowledge acquisition by the service provider
becomes an important activity in outsourcing. It should be planned
and executed to ensure that coverage is complete and the model is
risk free and cost effective.


16

REFERENCES
Figure 1.1 – http://www.vm.ibm.com/library –
The online z/VM Library
Figure 1.2 – The source is taken from HCL Mainframe Solutions
COE team
Figure 1.3 – http://www.vm.ibm.com/education
Figure 1.4 – http://www.vm.ibm.com/library –
The online z/VM Library
Table 1 – http://www.redbooks.ibm.com – This source is taken
from the red book of IBM: Linux for IBM zSeries and S/390:
Distributions
Table 2 – http://www-03.ibm.com/systems/z/os/linux/success
[1] – Web-hosting on Z/Linux – Approach and Steps –
http://www.ibm.com/developerworks/java/jdk/linux140
[2] – Web hosting Applications on the internet – Benefits –
http://www-03.ibm.com/systems/z/os/linux/success

ABOUT THE AUTHOR
Praveen Edward Jaikumar is part of
the Mainframe Solution CoE team,
leading the team in Modern Mainframe
and Administration. He has 12 years of
experience in various areas of System
Administration on Z/OS, Z/VM and
Z/Linux. In the past, he has worked in
several large engagements on Mainframe
Infrastructure planning, administration
of the project in Systems operations and
administration sort projects across various
technologies.


17

About HCL
About HCL Technologies
HCL Technologies is a leading global IT services company,
working with clients in the areas that impact and redefine
the core of their businesses. Since its inception into the
global landscape after its IPO in 1999, HCL focuses on
‘transformational outsourcing’, underlined by innovation
and value creation, and offers integrated portfolio of
services including software-led IT solutions, infrastructure
management, engineering and R&D services and BPO. HCL
leverages its extensive global offshore infrastructure and
network of offices in 26 countries to provide holistic, multi-
service delivery in key industry verticals including Financial
Services, Manufacturing, Consumer Services, Public Services
and Healthcare. HCL takes pride in its philosophy of
‘Employees First, Customers Second’ which empowers our
82,464 transformers to create a real value for the customers.
HCL Technologies, along with its subsidiaries, has reported
consolidated revenues of US$ 4.0 billion (Rs. 19,412 crores),
as on 31 March 2012 (on LTMbasis). For more information,
please visit www.hcltech.com

About HCL Enterprise
HCL is a $6.2 billion leading global technology and
IT enterprise comprising two companies listed in India -
HCL Technologies and HCL Infosystems. Founded in 1976,
HCL is one of India’s original IT garage start-ups. A pioneer
of modern computing, HCL is a global transformational
enterprise today. Its range of offerings includes product
engineering, custom & package applications, BPO,
IT infrastructure services, IT hardware, systems integration,
and distribution of information and communications
technology (ICT) products across a wide range of focused
industry verticals. The HCL team consists of over 90,000
professionals of diverse nationalities, who operate from
31 countries including over 500 points of presence in
India. HCL has partnerships with several leading global
1000 firms, including leading IT and technology firms. For
more on HCL, please visit www.hcl.com


HCLT Whitepaper: Effective Web Hosting on Z/Linux

Recomendados

Recomendados

Más contenido relacionado

Destacado

Destacado (16)

Similar a HCLT Whitepaper: Effective Web Hosting on Z/Linux

Similar a HCLT Whitepaper: Effective Web Hosting on Z/Linux (20)

Más de HCL Technologies

Más de HCL Technologies (20)

Último

Último (20)

HCLT Whitepaper: Effective Web Hosting on Z/Linux