"Go forth and multiply" has a new interpretation in the IT world: "Go forth and virtualize." It is no surprise that enterprises today are adopting virtualization technologies in droves, not only because of the cost reduction and efficiency it delivers, but for the flexibility the technology delivers as well. In a March 28, 2008, Gartner report entitled "Virtualization Changes Virtually Everything," Philip Dawson and Thomas J. Bittman predict that virtualization will be the highest-impact trend in the infrastructure and operations market through 2012.

As virtual environments proliferate, enterprises need to realize these environments can also become a liability if not managed properly. The ease of deploying and replicating virtual environments, frequently even by unsophisticated users outside of corporate IT's control, is suddenly leading to "virtual sprawl." Virtual sprawl occurs due to unmanaged proliferation of virtual machines, caused by users cloning a virtual machine, or saving versions of applications and operating systems for later use. Gaining accurate control over virtual environments has become even more critical as the number of instances, or virtual assets, can significantly outnumber the count of physical servers. This has direct implications to total cost exposure: licensing models from major software vendors are rapidly changing to reflect virtual environments, and each virtual "guest" operating system generally requires its own licenses.

In addition, because virtual machines are so flexible and easy to deploy, virtualization actually puts them at a greater risk of being non-compliant. Tracking specific configuration parameters, tied to internal guidelines and numerous industry or regulatory compliance rules such as GLBA, HIPAA, PCI-DSS and many more, becomes a continuous challenge when virtual environments spring up on short notice and with little centralized control. Lack of ongoing visibility into these instances can lead to ballooning management costs and compliance risk.

Causes of Virtual Sprawl - Be Careful What You Ask For
One of the greatest advantages of virtualization is the isolation on virtual instances or environments. Isolation enables multiple virtual instances to exist on one platform without affecting one another. Underutilized servers can be used more efficiently by stacking multiple virtual instances of an application on a server, avoiding incompatible combinations of operating systems and applications. However, this benefit has led to an effect similar to physical server sprawl - except that virtual sprawl is not as visible. While reducing the number of physical servers, many organizations actually maintain or increase the number of unique application/operating system combinations in the virtual environment. The faster servers can be provisioned, the more it seems they are in demand. Each instance needs to be managed like a physical environment and contributes to administrative overhead costs. Management costs can quickly consume the gains derived from reducing the number of physical servers. According to a Gartner survey by Cameron Haight from August 29, 2007, virtual machine "sprawl" is a major concern that appears to lack a comprehensive solution.

Preventing Virtual Sprawl - Putting the Genie Back in Its Bottle
From a process perspective, organizations can help contain virtual sprawl by insisting on justification of virtual instances, much as they require justification for physical servers. After all, if enterprises do not have accurate visibility into their virtual machines, how can they expect to manage or control them, thus preventing virtual sprawl? However, while having such processes is ideal to allow for more structured and centralized control, it is unlikely to be sufficient to manage the sprawl drivers, once sprawl has already settled in.

There needs to be insight into the adoption rate of virtual technologies in different business units and the proliferation of virtual environments in specific projects, while having comprehensive details about each virtual machine. IT departments also should have the ability to view data by operating system and business organization. Without this analytical framework, businesses cannot easily manage the proliferation of virtual machines.

Since it is so easy to deploy and replicate instances, many organizations face diverse compliance risks - including license, security or corporate standards violations. As the number of virtual instances increase, organizations must ensure that these instances follow corporate standards before they are replicated. For example, proactively identifying and comparing all physical and virtual environments to defined standards can show if all the virtual systems have up-to-date virus scanning software and other key security configurations. If some lack virus scanning software, then not only do those images need an instant update, but the process of deploying virtual images needs to be evaluated. Once a virtual machine has been identified, it allows for the ability to control and manage. IT organizations need new processes and systems to address virtual environments, similar to those in place for provisioning and monitoring physical environments.

Virtualization is here to stay and the benefits of the approach are clear - from cost and flexibility to resource utilization perspectives. However, for virtualization to make the grade from a manageability angle, it must be subject to the same governance and oversight as other essential IT systems and processes. Enterprises need accurate insight into the current environment to identify opportunities for virtualization and optimize efficiency across both physical and virtual systems. The need for timely and comprehensive information about these instances, collected in a non-disruptive mode, is apparent so IT organizations can focus on both decreasing and managing the complexity of the IT landscape, while maintaining reasonable support costs. By doing this, IT organizations can capture a comprehensive fact base of their actual environment, including virtual environments, to support their strategic initiatives - managing costs, increasing innovation and flexibility, and above all, delivering high-value services to their customers.