Cases2 cases

1 to 2 of 2

1. IL-0339 Azure Front Door and Azure CDN users saw intermittent connection errors, timeouts and latency spikes for hours

   Microsoft Azure2024

   Symptoms

   From 11:45 UTC on 30 July 2024, a subset of customers got intermittent connection errors, timeouts and latency spikes when connecting to Microsoft services that use Azure Front Door (AFD) and Azure Content Delivery Network (CDN). The Azure Portal team saw the first service degradation at 11:47 UTC.

   Intermittent connection failuresIntermittent timeoutsHigh latencyPacket loss

   Trigger

   Around 11:45 UTC the Azure network DDoS protection service was disengaging after a routine DDoS mitigation and returning traffic to its default routing to AFD, but the routes at one site in Europe could not be updated because the network control plane could not reach that site during a local power outage.

   Root cause

   Configuration change

   Component

   CDN and edge networkDDoS protection serviceNetwork control plane (SDN)Data center power and cooling

   Contributing factor

   Overlapping failuresExcessive blast radiusMonitoring blind spot

   Detection

   The Azure Portal team detected service degradation at 11:47 UTC and began to investigate. At 12:10 UTC network monitoring correlated the Portal incident to a network issue at one site in Europe, and networking engineers joined.

   Remediation

   • Rerouted traffic under the standard congestion playbook, which removed most of the impact by 13:58 UTC
   • Ordered the network control plane to reissue its commands to the misbehaving device, which could not be reached
   • Removed the device that kept attracting traffic from the network and scanned the network for other issues

   Action items

   • Add the missing configuration on network devices so a DDoS mitigation issue in one geography cannot spread to another
   • Improve validation and monitoring in the Azure network to detect invalid configurations
   • Improve monitoring for when the DDoS protection service is unreachable from the control plane but still serving traffic

   View case
2. IL-0430 Mackerel's Redis stopped answering during a replication setup, keepalived failed over by mistake, and Mackerel degraded

   Hatena2018

   Symptoms

   On 26 September 2018 at 10:51 JST the whole Mackerel monitoring service stopped working properly and its alive monitoring stopped. The application servers could not connect to Redis, which stores Mackerel's monitoring data, and could not return correct responses.

   Monitoring outageHigh latencyIntermittent timeouts

   Trigger

   Redis memory use had been growing, so operators set up replication in order to scale Redis up. Building the replication took a long time and Redis stopped answering for a while, and keepalived treated this as a node failure and started a failover nobody intended.

   Root cause

   Configuration change

   Component

   In-memory cacheDatabase replicationDatabase failover manager

   Contributing factor

   Automation amplificationOverlapping failures

   Remediation

   • Switched back to the correct Redis and briefly saw the application return
   • Restarted the application servers one after another, which did not improve the symptoms
   • Detected the organizations posting inappropriate metrics and blocked their requests
   • Adjusted the timeout interval of the application servers
   • Temporarily added capacity to Diamond, the TSDB
   • Increased the number of Kinesis shards and Redis Cluster shards
   • Scaled out the API application servers
   • Put Mackerel in maintenance mode, checked it internally and let outside requests back gradually

   Action items

   • Raise the number of keepalived health checks for Redis so a brief load increase does not trigger a failover
   • Scale Redis up
   • Add more application servers
   • Change the application to store only the monitoring data it needs in Redis, reducing Redis memory use
   • Build a way to detect inappropriate API requests quickly and show them on a dashboard
   • Build a function to block organizations making inappropriate requests quickly
   • Keep improving the accuracy of detecting inappropriate requests and consider adding features such as an API limit
   • Strengthen monitoring of the application servers' internal processing so problems are handled before they become outages

   Lessons

   Hatena did not find why recovery took so long, but expects that keeping failover from reacting to short load spikes and giving the application more performance headroom would prevent an outage this long. It also aims to keep problems contained to a small part of the service when a failure does happen.

   View case

By root cause1