Cases2 cases

1 to 2 of 2

1. IL-0430 Mackerel's Redis stopped answering during a replication setup, keepalived failed over by mistake, and Mackerel degraded

   Hatena2018

   Symptoms

   On 26 September 2018 at 10:51 JST the whole Mackerel monitoring service stopped working properly and its alive monitoring stopped. The application servers could not connect to Redis, which stores Mackerel's monitoring data, and could not return correct responses.

   Monitoring outageHigh latencyIntermittent timeouts

   Trigger

   Redis memory use had been growing, so operators set up replication in order to scale Redis up. Building the replication took a long time and Redis stopped answering for a while, and keepalived treated this as a node failure and started a failover nobody intended.

   Root cause

   Configuration change

   Component

   In-memory cacheDatabase replicationDatabase failover manager

   Contributing factor

   Automation amplificationOverlapping failures

   Remediation

   • Switched back to the correct Redis and briefly saw the application return
   • Restarted the application servers one after another, which did not improve the symptoms
   • Detected the organizations posting inappropriate metrics and blocked their requests
   • Adjusted the timeout interval of the application servers
   • Temporarily added capacity to Diamond, the TSDB
   • Increased the number of Kinesis shards and Redis Cluster shards
   • Scaled out the API application servers
   • Put Mackerel in maintenance mode, checked it internally and let outside requests back gradually

   Action items

   • Raise the number of keepalived health checks for Redis so a brief load increase does not trigger a failover
   • Scale Redis up
   • Add more application servers
   • Change the application to store only the monitoring data it needs in Redis, reducing Redis memory use
   • Build a way to detect inappropriate API requests quickly and show them on a dashboard
   • Build a function to block organizations making inappropriate requests quickly
   • Keep improving the accuracy of detecting inappropriate requests and consider adding features such as an API limit
   • Strengthen monitoring of the application servers' internal processing so problems are handled before they become outages

   Lessons

   Hatena did not find why recovery took so long, but expects that keeping failover from reacting to short load spikes and giving the application more performance headroom would prevent an outage this long. It also aims to keep problems contained to a small part of the service when a failure does happen.

   View case
2. IL-0431 During Mackerel's move to AWS, PostgreSQL failed over to a replica that had stopped replicating, losing an hour of data

   Hatena2017

   Symptoms

   On 7 August 2017, while checking the application after the maintenance that moved Mackerel from an on-premises data center to AWS, the team found that data updated during a specific time window was missing. Everything written to the PostgreSQL database between 14:30 and 15:30 JST was gone.

   Data lossReplication lagNetwork unreachable

   Trigger

   One hour after the application was switched to the newly promoted primary db001, db001 lost network connectivity and the database failed over to the standby db002.

   Root cause

   Operator error

   Component

   DatabaseDatabase replicationDatabase failover manager

   Contributing factor

   Overlapping failuresUnreviewed defaultsUnrepresentative stagingAutomation amplification

   Detection

   The team found the missing data while checking how the application behaved after the migration work.

   Remediation

   • Tried to restore the lost updates by hand from the table data left on db001 and gave up
   • Tried point-in-time recovery from the base backup and WAL and gave up
   • Built a new replica db003 with db002 as primary to restore redundancy
   • Kept db001 in maintenance state for investigation
   • Watched db002 for some time to confirm the problem did not recur, then completed the migration

   Action items

   • Change the PostgreSQL replica creation script to set recovery_target_timeline = 'latest' in recovery.conf by default
   • Add a check to a server configuration test tool such as Serverspec that recovery.conf contains recovery_target_timeline = 'latest'

   Lessons

   A setting needed only for a rare layout, such as a grandchild replica during a migration, was applied by hand through a script option and was forgotten. Because recovery_target_timeline = 'latest' is harmless on ordinary standbys too, Hatena now sets it by default whenever a replica is created. The staging rehearsal used the same layout and steps but had the setting right, so it could not catch the mistake. Hatena notes that a similar layout may be used again for a future PostgreSQL upgrade or a move to another region.

   View case

By root cause2