Cases14 cases

11 to 14 of 14

1. IL-0434 Rolling restarts of a 30-node Elasticsearch 0.19 cluster after a host failure left 12 shards unassigned

   CyberAgent2016

   Symptoms

   After an OpenStack host server went down and took one Elasticsearch node with it, the health check that the API servers run against Elasticsearch returned false, although the Head plugin showed the cluster status as green. The check stayed false after the node was brought back and the cluster was green again.

   High latencyData loss

   Trigger

   An OpenStack host server went down, and one node of the Elasticsearch cluster went down with it.

   Root cause

   Operator error

   Component

   Elasticsearch or OpenSearch

   Contributing factor

   Unverified assumptionAutomation amplification

   Detection

   The health check that the API servers run against Elasticsearch returned false while the Head plugin showed the cluster as green.

   Remediation

   • Migrated the Elasticsearch node's virtual server to another host after the failed host recovered
   • Started the node's Elasticsearch process and let it rejoin the cluster
   • Restarted all nodes in order from node 1, pausing at about the twentieth when the API slowed
   • Restarted all nodes again from node 1, which ended the API delays but left 12 shards unassigned
   • Tried to move an unassigned shard with the allocate command of _cluster/reroute, which failed
   • For index A, copied node 22's shard files to nodes 3 and 10 and set primary to true in node 22's state file
   • For index B, deleted the broken shard files on node 27, copied node 28's files to node 27 and other nodes and marked node 28 primary
   • For index C, copied shards 2 and 4 from nodes 27 and 25 to two other nodes each and marked the copies as not primary

   Action items

   • Upgrade Elasticsearch and stop running such an old version

   Lessons

   Automatic shard reallocation should have been turned off before restarting nodes. After each node restart, the next node should have been restarted only after reallocation had completely finished, not just after the log file looked fine.

   View case
2. IL-0319 Dropping databases on the MySQL replica mysql2 also dropped them on mysql1, as the pair actually ran master-master

   Oregon State University Open Source Lab2015

   Symptoms

   On July 30th, a few minutes after the OSU Open Source Lab started reloading the MySQL server mysql2 to fix its replication errors, the team saw that databases were being dropped on mysql1 as well. The script was stopped, and the MySQL service behind mysql1-vip stayed down through a long restore.

   Data lossService outageReplication lag

   Trigger

   On July 30th at 4:00PM PDT the team stopped slave replication on mysql2 and began dropping its databases one at a time to reload it and fix replication errors.

   Root cause

   Operator error

   Component

   DatabaseDatabase replicationDatabase backups and snapshots

   Contributing factor

   Unverified assumptionUntested backup

   Detection

   The team watching the reload noticed after a few minutes that mysql1 was also dropping databases; the delays between drops in the script gave them that time.

   Remediation

   • Stopped the script that was dropping databases
   • Restored the databases from the mysql-zrm backups
   • Pulled each database that failed to restore out of the 200GB backup file and restored it separately
   • Recovered most data with the binary logs from the 17th through the 30th

   Action items

   • Evaluate better replication strategies, including row-based replication
   • Store binlogs as a backup on a separate server
   • Take backups with Percona XtraBackup for much faster full restores
   • Use mydumper instead of mysql-zrm for faster logical backups
   • Improve documentation and training for complex systems
   • Test full restores regularly on a spare server as part of the backup process
   • Gather more accurate time estimates for the restore process
   • Audit the hosted databases regularly, since test and very large databases delayed the restore
   • Migrate to a bigger, more powerful MySQL cluster
   • Set a policy and tools to keep the community informed of outages, maintenance and resource use, with dashboards
   • Define and monitor capacity limits for core services
   • Implement redundancy and restore practices for core services, including staff drills
   • Migrate more core services to Chef
   • Review documentation, policies and performance metrics periodically
   • Find better ways to draw on community expertise
   • Raise funds to replace the oldest infrastructure and reduce technical debt

   Lessons

   The lab had stretched its resources to host as many projects as possible, and that came with tradeoffs such as heavily compressed backups to save disk and less redundancy than wanted; the heavy compression made this restore CPU-bound. The lab concluded that it needs to change how it plans, monitors and manages resources, and that the length of the outage and the lack of progress reports were not acceptable.

   View case
3. IL-0538 Sakura Cloud storage maintenance deleted 53 in-use customer disks, and the disks could not be restored from backup

   Sakura Internet2012

   Symptoms

   During emergency maintenance on 5 January 2012, a bulk deletion of unneeded file systems on the Sakura Cloud storage device also deleted 53 disks that customers were using. The deleted disks could not be restored from backup.

   Data loss

   Trigger

   In the emergency maintenance on 5 January 2012, Sakura Internet ran a batch command written only for that maintenance to delete unneeded file systems on the storage device in bulk.

   Root cause

   Operator error

   Component

   Cloud block storageDatabase backups and snapshots

   Contributing factor

   Missed in reviewUntested backup

   Action items

   • Simplify the process for deleting unneeded file systems
   • Do not run scripts that have not been reviewed and tested enough

   View case
4. IL-0337 EBS volumes in one US East Availability Zone got stuck after a network change cut EBS nodes off from their replicas

   Amazon Web Services2011

   Symptoms

   From 12:47 AM PDT on 21 April 2011, a subset of Amazon EBS volumes in one Availability Zone of the US East Region could no longer serve reads or writes, and EC2 instances that tried to use them got stuck as well. AWS called these "stuck" volumes. EBS API calls across the whole US East Region also returned high error rates and latencies during two periods on the first day.

   Storage disconnected or stale mountsNetwork unreachableControl plane lagHigh error rateFailover failureData loss

   Trigger

   During a routine network change to upgrade the capacity of the primary EBS network in one Availability Zone, traffic was to be shifted off one of the redundant routers. The shift was executed incorrectly and sent the traffic onto the lower-capacity replication network instead of the other primary router, which could not carry it.

   Root cause

   Operator error

   Component

   Cloud block storageDatabase

   Contributing factor

   Automation amplificationRetry stormNo headroomExcessive blast radiusSignal buried in noise

   Remediation

   • Rolled back the incorrect traffic shift, which restored network connectivity
   • Disabled all new Create Volume requests in the affected Availability Zone at 2:40 AM PDT
   • Disabled all communication between the degraded EBS cluster and the EBS control plane from 8:20 AM PDT
   • Stopped EBS servers in the degraded cluster from futilely contacting other servers for free space
   • Changed the EBS control plane so new EBS-backed instance launches stopped failing
   • Moved spare server capacity physically from across the US East Region into the degraded cluster
   • Adjusted the negotiation throttles so the new servers could join without flooding the old ones
   • Built a separate EBS control plane partitioned to the affected zone and finer-grained throttles, then processed the backlog
   • Restored the remaining volumes from S3 snapshots taken early in the event
   • Restored volumes on failed machines that had no snapshot after forensic work
   • Intervened by hand on the RDS multi-AZ instances that did not fail over automatically

   Action items

   • Audit the change process and add automation to prevent the traffic shift mistake
   • Change capacity planning and alarming to keep the extra safety capacity needed for large recovery events
   • Change the retry logic in EBS nodes to back off harder and reconnect to previous replicas instead of searching for new nodes
   • Test and deploy the fix for the race condition that crashed EBS nodes
   • Fix the RDS bug that kept multi-AZ instances from failing over automatically
   • Improve the EBS control plane timeout logic to prevent thread exhaustion when one zone's cluster is slow
   • Make the EBS control plane aware of Availability Zones so it sheds load when over capacity
   • Move more EBS control plane functions into per-cluster services that run in the same zone as the cluster
   • Offer multiple Availability Zones to Amazon VPC customers
   • Provide better tools for building multi-AZ applications that survive the loss of a zone
   • Host free webinars and publish whitepapers on fault-tolerant architecture
   • Build the fine-grained control and throttling used in recovery into the EBS nodes and automate the recovery models
   • Look at changes that keep volumes working while a cluster is degraded, including the ability to take a snapshot of a stuck volume
   • Send more frequent and detailed customer updates and staff developer support more widely during events
   • Develop tools that show through the APIs whether instances are impaired

   Lessons

   AWS writes that with more spare capacity the cluster would have absorbed the re-mirroring requests without a storm, and that it now understands how much capacity large recovery events need. The event also showed that the EBS control plane let a failure in one Availability Zone affect the others, so more work is needed to make zones behave as if completely independent. AWS adds that some customers had critical components in a single zone, and that multi-AZ deployments need to become easier to design and run.

   View case

By root cause1