一句话:首次形式定义并系统研究分布式软件系统中的恶性循环,揭示错误处理根因,探索监控与指数退避防治。
本文研究分布式软件系统中的恶性循环:某事件导致系统退化,退化又引发更多此类事件,形成自增强循环并造成难以恢复的大规模云中断。作者形式定义该现象,首次深入分析13个开源分布式系统中的33个真实案例,总结根因、触发条件与修复策略。研究发现多数恶性循环源于错误处理程序缺乏足够信息,无法区分传入请求错误与另一处理程序意外干扰错误。论文还构建监控工具辅助错误处理以预防一类恶性循环,并评估指数退避对无约束重试所致循环的效果。
A major threat to distributed software systems' reliability is vicious cycles, which are observed when an event in the distributed software system's execution causes a system degradation, and the degradation, in turn, causes more of such events. Vicious cycles often result in large-scale cloud outages that are hard to recover from due to their self-reinforcing nature. This paper formally defines Vicious Cycle, and conducts the first in-depth study of 33 real-world vicious cycles in 13 widely-used open-source distributed software systems, shedding light on the root causes, triggering conditions, and fixing strategies of vicious cycles, with over a dozen concrete implications to combat them. Our findings show that the majority of the vicious cycles are caused by incorrect error handlers, where the handlers do not obtain enough information to distinguish between 1) an error induced by incoming requests and 2) an error induced by an unexpected interference from another error handler. This paper further performs a feasibility study by 1) building a monitoring tool that prevents one type of vicious cycle by collecting information to make a more informed decision in error handling, and 2) investigating the effectiveness of one commonly suggested practice-injecting exponential backoff-to prevent vicious cycles induced by unconstrained retry.