This page addresses some of the common issues encountered when using the Windows Azure Virtual Machines feature (IaaS).
Below is another great resource related to cloud security and covers various security aspects. Though it is not directly targeted to virtual machines, it has tons of great information that will help windows azure virtual machines users to understand various security issues.
http://blogs.msdn.com/b/jmeier/archive/2010/08/03/now-available-azure-security-notes-pdf.aspx
Difference between capturing a VM and creating a snapshot Capturing a VM creates an image (not meant for backup) that can be used to create multiple VMs based on that same image. You can capture a VM using the Capture option in the portal, the Save-AzureVMImage Azure PowerShell cmdlet, using azure vm capture in the Azure CLI tool, or the Capture Role API. For VM backups, there is no equivalent to the Hyper-V snapshot feature for Azure VMs. However Azure storage has a blob snapshot feature that allows you to create a backup of the VHD blob in Azure storage. Microsoft does not currently provide a tool for creating blob snapshots, though third-party storage tools such as CloudXplorer include this feature. And you can write custom code to call the Snapshot Blob API to create a blob snapshot. You can also create a copy of a VHD using Azure storage tools. If the tool uses the 2012-02-12 version or later of the Copy Blob API, it will allow for fast cross-account blob copies, for example to move a VHD between different storage accounts. Most of the commonly used Azure storage tools also allow you to download files to on-premises. This forum post has steps to download the VHD using CloudXplorer. You can use any similar storage tools to perform the same task.
How to break the lease on VHD files The Windows Azure platform holds an infinite lease on all the page blobs that it considers disks in your storage account so that you do not accidently delete the underlying page blob, container, or storage account while the VHD is in use by the VM. If you want to delete the underlying page blob, the container where it resides, or the storage account, you will need to detach the disk from the VM first or delete the VM and associated disk object. In a few scenarios, you may end up getting errors while deleting VHDs even though there are no disks/VMs referring to the VHD. In such cases you can manually break the lease using the powershell script. Craig Landis has a detailed forum post describing these errors, workarounds along with the script.
RDP connectivity issues RDP connectivity issues can be caused by many different factors ranging from simple client firewall issue to a platform issue. You should start eliminating all client side issues first. Investigate client-side firewall issues by pinging the TCP port for the RDP endpoint using tools such as PsPing, PortQry, Telnet, or Nmap. See if your machine allows outbound communication to the RDP endpoint (TCP port 3389 for the first VM deployed to a cloud service, a random ephemeral port between 49152-65535 for additional VMs in the same cloud service). Verify the port on the Endpoints section for the VM in the portal. Since corporate firewalls often block 3389 and/or the ephemeral range (49152-65535), try connecting to the VM from a different network – from home, a wifi hotspot, or a mobile broadband connection. Drew McDaniel has a forum sticky post with common issue like cache credentials, endpoint related issues. If you none of the above resolved connectivity issue, you can quickly try restarting/resizing the VMs to see if the problem goes away. If the problem persists you can reach out to the support forum.
Platform updates to VM, restarts, shutdowns. Windows Azure updates the host OS approximately once every 1-3 months to keep the environment secure for all applications, virtual machines running on the platform. This update process may result in your VM to restart. You can use availability sets to ensure high availability for your applications running on virtual machines. Managing the high availability is detailed here. Mark Russinovich has posted a great blog post which explains Windows Azure Host updates in detail. In addition to platform updates, Windows Azure service healing occurs automatically when the Windows Azure detects problematic nodes and moves these VMs to new nodes. When this occurs, you loose connectivity to VM during the service healing process and after the service healing process is completed, when you connect to VM, you will likely to find a event log entry indicating VM restart/shutdown (either gracefully or unexpected).
VM activations While activating the OS on Windows Azure Virtual Machines, you may run into an error message stating the “A problem occurred when Windows tried to activate” Error Code 0xC004F074 with below details Code: 0xC004F074 Description: "The software licensing service reported that the computer could not be activated. No key management service could be contacted" Usually this is a transient issue the resolves itself over a short period of time. Please note that the inability to activate does not impact the services running on the server. While you will see notifications reminding you to activate the server if it is not yet activated, services and remote administration are not affected. Refer to forum post for more details.
Availability Sets, Affinity groups, Connecting VMs – Three different, distinct purposes An availability set is a way to achieve high availability for your virtual machines. An availability set is a group of virtual machines that are deployed across fault domains and update domains. An availability set makes sure that your application is not affected by single points of failure, like the network switch or the power unit of a rack of servers. Guidance for managing availability using availability sets can be found here. Affinity groups are the way to group the services in your Windows Azure subscription that need to work together in order to achieve optimal performance. When you create an affinity group, it lets Windows Azure know to keep all of the services that belong to your affinity group running at the same data center cluster. For example, if you want to keep the services running your data and your code together, you would specify the same affinity group for those services. That way, when you deploy those services, Windows Azure will locate them in a data center as close to each other as possible. This reduces latency and increases performance, while potentially lowering costs. Importance of affinity groups is described here. Connecting VMs – Load balancing You group multiple VMs together under a single cloud service to distribute the load to multiple VMs. The way you group is during the second VM creation, you choose “Connect to Existing Virtual Machine” and then select the cloud service under which you wanted to group the VMs. This article details how to load balance virtual machines.
Craig Landis edited Revision 1. Comment: Edits
Nice article
Thanks Waqas M.