How to improve Sage network performance

If you accept that Sage Line 50 is fundamentally flawed when working over a network you’re not left with many options other than waiting for Sage to fix it. All you can do is throw hardware at it. But what hardware actually works?

First the bad news – the difference in speed between a standard server and a turbo-nutter-bastard model isn’t actually that great. If you’re lucky, on a straight run you might get a four-times improvement from a user’s perspective. The reason for spending lots of money on a server has little to do with the speed a user’s sees; it’s much more to do with the number of concurrent users.

So, if you happen to have a really duff server and you throw lots of money at a new one you might see something that took a totally unacceptable 90 minutes now taking a totally unacceptable 20 minutes. If you spend a lot of money, and you’re lucky.

The fact is that on analysing the server side of this equation I’ve yet to see the server itself struggling with CPU time, or running out of memory or any anything else to suggest that it’s the problem. With the most problematic client they started with a Dual Core processor and 512Mb of RAM – a reasonable specification for a few years back. At no time did I see issues to do with the memory size and the processor utilisation was only a few percent on one of the cores.

I’d go as far as to say that the only reason for upgrading the server is to allow multiple users to access it on terminal server sessions, bypassing the network access to the Sage files completely. However, whilst this gives the fastest possible access to the data on the disk, it doesn’t overcome the architectural problems involved with sharing a disk file, so multiple users are going to have problems regardless. They’ll still clash, but when they’re not clashing it will be faster.

But, assuming want to run Line 50 multi-user the way it was intended, installing the software on the client PCs, you’re going to have to look away from the server itself to find a solution.

The next thing Sage will tell you is to upgrade to 1Gb Ethernet – it’s ten times faster than 100Mb, so you’ll get a 1000% performance boost. Yeah, right!

It’s true that the network file access is the bottleneck, but it’s not the raw speed that matters.

I’ll let you into a secret: not all network cards are the same.

They might communicate at a line speed of 100Mb, but this does not mean that the computer can process data at that speed, and it does not mean it will pass through the switch at that speed. This is even more true at 1Gb.

This week at Infosec I’ve been looking at some 10Gb network cards that really can do the job – communicate at full speed without dropping packets and pre-sort the data so a multi-CPU box could make sense of it. They cost $10,000 each. They’re probably worth it.

Have you any idea what kind of network card came built in to the motherboard of your cheap-and-cheerful Dell? I thought not! But I bet it wasn’t the high-end type though.

Please generate and paste your ad code here. If left empty, the ad location will be highlighted on your blog pages with a reminder to enter your code. Mid-Post

The next thing you’ve got to worry about is the cable. There’s no point looking at the wires themselves or what the LAN card says it’s doing. You’ll never know. Testing a cable has the right wires on the right pins is not going to tell you what it’s going to do when you put data down it at high speeds. Unless the cable’s perfect its going to pick up interference to some extent; most likely from the wire running right next to it. But you’ll never know how much this is affecting performance. The wonder of modern networking means that errors on the line are corrected automatically without worrying the user about it. If 50% of your data gets corrupted and needs re-transmission, by the time you’ve waited for the error to be detected, the replacement requested, the intervening data to be put on hold and so on your 100Mb line could easily be clogged with 90% junk – but the line speed will still be saying 100Mb with minimal utilisation.

Testing network cables properly requires some really expensive equipment, and the only way around it is to have the cabling installed by someone who really knows what they’re doing with high-frequency cable to reduce the likelihood of trouble. If you can, hire some proper test gear anyway. What you don’t want to do is let an electrician wire it up for you in a simplistic way. They all think they can, but believe me, they can’t.

Next down the line is the network switch and this could be the biggest problem you’ve got. Switches sold to small business are designed to be ignored, and people ignore them. “Plug and Play”.

You’d be forgiven for thinking that there wasn’t much to a switch, but in reality it’s got a critical job, which it may or may not do very well in all circumstances. When it receives a packet (sequence of data, a message from one PC to another) on one of its ports it has to decide which port to send it out of to reach its intended destination. If it receives multiple packets on multiple ports it has handle them all at once. Or one at a time. Or give up and ask most of the senders to try again later.

What your switch is doing is probably a mystery, as most small businesses use unmanaged “intelligent” switches. A managed switch, on the other hand, lets you connect to it using a web browser and actually see what’s going on. You can also configure it to give more priority to certain ports, protect the network from “packet storms” caused by accident or malicious software and generally debug poorly performing networks. This isn’t intended to be a tutorial on managed switches; just take it from me that in the right hands they can be used to help the situation a lot.

Unfortunately, managed switches cost a lot more than the standard variety. But they’re intended for the big boys to play with, and consequently they tend to switch more simultaneous packets and stand up to heavier loads.

Several weeks back I upgraded the site with the most problems from good quality standard switches to some nice expensive managed ones, and guess what? It’s made a big difference. My idea was partly to use the switch to snoop on the traffic and figure out what was going on, but as a bonus it appears to have improved performance, and most importantly, reliability considerably too.

If you’re going to try this, connect the server directly to the switch at 1Gb. It doesn’t appear to make a great deal of difference whether the client PCs are 100Mb or 1Gb, possibly due to the cheapo network interfaces they have, but if you have multiple clients connected to the switch at 100Mb they can all simultaneously access the server down the 1Gb pipe at full speed (to them).

This is a long way from a solution, and it’s hardly been conclusively tested, but the extra reliability and resilience of the network has, at least allow a Sage system to run without crashing and corrupting data all the time.

If you’re using reasonably okay workstations and a file server, my advice (at present) is to look at the switch first, before spending money on anything else.

Then there’s the nuclear option, which actually works. Don’t bother trying to run the reports in Sage itself. Instead dump the data to a proper database and use Crystal Reports (or the generator of your choice) to produce them. I know someone who was tearing their hair out because a Sage report took three hours to run; the same report took less than five minutes using Crustal Reports. The strategy is to dump the data overnight and knock yourself out running reports the following day. Okay, the data may be a day old but if it’s taking most of the day to run the report on the last data, what have you really lost?

I’d be really interested to hear how other people get on.

BlueWatchDog Review

This is an almost brilliant idea. The BlueWatchDog is a thick credit-card sized device that picks up the signal from your paired Bluetooth ‘phone, and if it gets separated from it, sounds an alarm. Great if you’re the type to leave your Blackberry behind or you iPhone is pinched from you handbag. At just £40 it could save you a lot of hassle.
BlueWatchDog
I said it was “almost” brilliant. The snag is that it requires an application running on the mobile device. It’d have been better if it could pair with anything Bluetooth, at least as an option. The application can be used to set the range before the alarm is set off but this is functionally you could live without. As it stands it works with Android, RIM and Apple mobiles. Apple, incidentally, didn’t like the idea of them giving the App away but the company have struck a deal to make this possible.

I managed to speak with the inventor and suggested a version that would work with any Bluetooth unit – possibly by treating it an audio device. Watch this space (and I hope he sends me a sample!)

www.mindyourit.co.uk
0800 999 2177

Encrypted USB Flash Drives Review

This year Infosec was awash with encrypted USB flash drives. This makes sense; lost USB drives are a major security problem. In fact flash drives are a major security problem, full stop.

Nearly all the flash drives I looked at had one major weakness – they’re tied to the Windows operating system (or Macintosh, and possibly Linux) in order to get data on and off. They have a special application to get the password from the user and supply it to the drive.

This may be considered a weakness, with a common criticism being that key loggers can capture the password before it can get to the drive. I’m actually not too worried about this because if the host has a key logger running then malware can just as easily access the drive itself, however the drive received its password in the first place.

However, having a Windows application required for access to the data is no good if you’re not always running Windows, and flash drives can be read from anything from a car radio to a photocopier. Even if you are reading it on a PC, the operating system of your choice will be upgraded in due course, but the application needed to access your data may not be.

After a bit of searching did find three genuinely OS-independent devices; the LOK-IT, the hiden Crypto Adapter and the Data Locker

Data Locker

This is a USB 2.0 hard disk, available in capacities ranging from 320Gb to 1TB. It’s a nice bit of kit, with a rubber bump-shell and a touch sensitive LCD panel for entering the codes to unlock it. Data is encrypted using hardware to AES CBC 128-bit or 256-bit depending on the model, and once the password has been entered the host system sees it as a standard drive. There are lots of nice features, like a randomized keypad so wear on particular keys doesn’t give the game away.

As it contains a 2.5″ drive it’s bulky compared to a flash drive, but it’s a huge capacity. If you really need to carry around such a large amount of secure data it’s a good choice. But at £400+VAT you’d be better off with something smaller if you don’t.

The Data Locker is made by Origin Storage in Basingstoke. They’ve been around since 2001 supplying OEM storage products, and aquired Amacom in 2006 – the brand used for Data Locker.

www.datalockerdrive.eu
No standard rate telephone number available.

hiddn Crypto Adapter

hiddn Crypto Adapter for USB drives

This doesn’t actually store anything – it’s a USB to USB adapter with encryption. Basically you plug one end into the host machine and plug your standard USB flash drive, or USB HDD if you prefer, into the top. Then you load your encryption key using a smart-card in the slot below, enter your PIN and away you go. It doesn’t matter what the host or USB storage device actually is; the host sees a standard USB drive.

The unit is mouse-sized and works well on a desktop, but is a bit bulky to carry around on portable equipment. It’s also pricey, at £290+VAT.

This system actually makes a lot of sense as with two units permanently attached to desktop machines in different locations as you can use cheap, standard flash drives to transport the data – even post them – without the risk of data leakage if they’re lost in transit. Using the optional key management software it’s possible to duplicate the keys on the smart cards so encryption works at both ends

The Norwegian makers, hdd, have a range of other encryption products which are worth a look, using the same smart cards to hold keys. I shall be watching them with interest

www.hiddn.no
+47 38 10 44 80

LOK-IT
Five and ten-digit LOK-IT encrypted USB drives
This USB flash drive is probably the solution for the rest of us. It’s simple. It’s a flash drive with a small keypad allowing you to enter a PIN to activate it. Powered by an internal battery, you’ve got 30 seconds after entering the password to plug it in, at which point it looks like any other USB drive to the host system. Activation status is indicated by either a red or green LED, and once the drive is pulled from the host it immediately returns to its encrypted state.

There are two versions available, one with a five-key PIN pad, and one with the full ten digits. Both have on-the-fly 256-bit AES encryption hardware. Apparently the ten-key version is more popular, but I liked the five-key because it had a draw-back USB cover you can’t lose.

If you enter the PIN incorrectly ten times the units wipe all their data and reset. This could be annoying, but it prevents access if they fall in to the wrong hands.

My only concern about these units is the robustness of the keypad, which is also a tad difficult to operate. It feels flimsy but may be okay. But with the 4Gb version costing just US$60 they’re a very cost-effective and practical solution. No UK distributor is available at the time of writing.

www.lok-it.net
++1 954-889-3535

I was wrong about the airlines

At the weekend I said it’d be two weeks before they decided that the risk from the volcano wasn’t that substantial when weighed against profits, and that political pressure would lift the flight ban before the cloud had lifted in about two weeks. It’s actually taken them less than one.

Engines stop and show signs of wear from time to time, but this time it’s going to be reported and a load of concerned hacks who know nothing about aviation will get very excited.

So queue the flying scares – engines stopping, or nearly stopping and one almighty row.

Safety is paramount

So the Icelandic volcano makes it impossible to fly in UK airspace. Hmm. The idea is that the volcanic ash, containing silica, turns to glass in jet engines and causes them to stop spinning.

Well I wonder how this one’s going to play out? Let’s see…

I’m sceptical that the ash is that much of a threat – jet engines do fly through dusty and sandy air. This dust seems to be fairly well dispersed (i.e. you can’t see it and radar, apparently, can’t see it). But even it does increase the risk, the “safety is paramount” argument just doesn’t hold water. If it really was the primary concern they’d stay on the ground instead of flying. Flying is more of a risk than staying on the ground, whatever the weather. They’re taking a risk by taking off.

So just how much risk is acceptable? Well when balanced against airline profits I’d say quite a lot. The volcano, by all accounts, shows no sign of slowing down and the weather system we have at this time of year aren’t likely to disperse the ash any time soon. Anyone who knows anything about weather isn’t going to put money on it, I assure you.

I’d give it two weeks – I doubt the cloud will disperse but by then the airlines will have put so much political pressure on NATS and the government (before an election) that they’ll decide that safety really isn’t paramount and start flying again regardless.

There’ll also probably be a big row.

There’ll also probably be a big scare as soon as someone finds a jet engine with glass in it, followed by an even bigger row.

Council surveys immigrants for BNP

Your local council is collecting the names and addresses of all non-English residents and passing them on to the British National Party. What a great idea!

That isn’t the intended plan, as far as I know, but most PC councils are doing it in the name of “diversity monitoring” or some such nonsense. Whether this is a justifiable use of taxpayers’ resources is one matter, but the fact remains that the databases they’re compiling will be making it in to the hands of every anti-immigrant group both now in the future. The government can’t keep a database like this secret for long – it requires the cooperation of every single council employee and councillor with access to the data, including the BNP councillors.

I was asked to fill in one such form today, when attending a council Easter-holiday event for kids. My usual response is to refuse to fill in this information on principle and explain, at length, why they shouldn’t be asking. I’ve never had any argument with this approach. Today, when I pointed out that this would tell the BNP where all the Muslims in the area lived, who was in the house and where their kids went to school, one of the ladies with the forms went quite pale.

Digital Economy Bill stitch-up

With any luck, this is the last piece of duff legislation in a long line of duff legislation passed by this partially inept government. It has been rushed through, with more haste than normal. To their eternal discredit the leaders of the Conservative and Liberal parties are complicit in allowing it through.

The only good news is that the tax on landlines has been dropped. This was to “pay for the next generation of Internet provision”, but with no explanation as to why taxpayers were supposed to pay for the infrastructure needed to make the larger ISPs still richer. If there’s a demand for it, the infrastructure will appear anyway because there’s money to be made.

The bad news is that the remainder of the bill is also a joke. It’s to do with protecting the rights of copyright holders (i.e. the music and media companies) by forcing ISPs to police what they’re downloading.

There’s some justice in this, on a theoretical level. ISPs are quite happy to make money from the ‘killer app’ that is media piracy, so they deserve the hassle of trying to clean it up. The problem is, as I need hardly tell you, that it’s unworkable.

The daft idea is to track pirates by their IP addresses. As anyone with an interest in cybercrime will tell you, this just doesn’t work. The criminals obscure their IP addresses, usually by hijacking the IP address belonging to an innocent third party. Under the Digital Economy Bill, it’s the innocent third party that’ll suffer.

There’s also the problem of identifying pirated content. Take it from me, this can’t be done, and the heuristics currently used to detect activity likely to be related to piracy (e.g. P2P protocols) can be rendered obsolete at any time.

Even if you could detect illicit traffic, you can’t possibly pin it down to an individual. Take one trivial example – “mobile broadband”. You can get this by walking into the mobile ‘phone shop of your choice, slapping some cash on the counter and walking out with a cellular modem with an Internet connection that’s completely untraceable. It even gets a different IP address from the service provider each time you turn it on. Are these to be banned? I don’t see it happening.

Pirates could also use one of the many free wireless hotspots found on any high street or hotel. Are these going to be closed down because pirates use them?

So, we have a bill that won’t solve the problem it sets out to tackle but will, instead, result in hassle for the law-abiding innocent computer users who have their IP addresses, and providers of publicly accessible Wifi networks.

You don’t have to be in favour of piracy to regard this latest piece of government nonsense as a very bad thing indeed.

Ted Relf – local hero

Ted Relf from Shadoxhurst (near Ashford, Kent) has got himself into a spot of bother with the local plod. His crime? Well he put up a sign warning people about potholes in the road outside his house.

Potholes are lethal. They’re bad enough in a motor vehicle, but for someone on a bike they’re murderous. If you can see them you swerve to avoid them and hope following traffic reacts accordingly. If they’re filled with water or it’s dark you’ll probably be thrown off, and you have to hope that following traffic will stop.

http://news.bbc.co.uk/1/hi/england/wiltshire/8594682.stm

Mr Relf’s sign was a public service, but according to Kent police, someone complained. Why is it that police and council officials feel the need to act when someone complains? If anything, this guy deserves a commendation protecting the public. Face with a complaint about the warning sign, the police should have told the complainant where to go in stead of wasting time and putting the public in danger by taking action against Mr Relf.

The police claim they’re under-funded; this proves the opposite – they’ve just lost their way.

I wonder if they were acting on orders from the local council, who may not have wanted attention drawn to the quality of the roads.