Live data from Hacker News

Summary of the Amazon S3 Service Disruption

aws.amazon.com

31–40 of 535 posts

Re: Summary of the Amazon S3 Service Disruption

#31
post #21
post #17

This part is also interesting: > While this is an operation that we have relied on to maintain our systems since the launch of S3, we have not completely restarted the index subsystem or the placement subsystem in our larger regions for many years. These sorts of things make me understand why the Netflix "Chaos Gorilla" style of operating is so important. As they say in this post: > We build our systems with the assu…

I think you meant "Chaos Monkey" [1]. [1] https://github.com/Netflix/chaosmonkey

[deleted]

Re: Summary of the Amazon S3 Service Disruption

#32
post #25
post #8

> At 9:37AM PST, an authorized S3 team member using an established playbook executed a command which was intended to remove a small number of servers for one of the S3 subsystems that is used by the S3 billing process. Unfortunately, one of the inputs to the command was entered incorrectly and a larger set of servers was removed than intended. It remains amazing to me that even with all the layers of automation, the…

Wonder what happened to the poor slob who did that. He/She was unauthorized AND caused a pretty serious outage... EDIT: derp, my bad, I read as "unauthorized" which was "authorized".

The article specifically said "authorized".

Re: Summary of the Amazon S3 Service Disruption

#33
post #21
post #17

This part is also interesting: > While this is an operation that we have relied on to maintain our systems since the launch of S3, we have not completely restarted the index subsystem or the placement subsystem in our larger regions for many years. These sorts of things make me understand why the Netflix "Chaos Gorilla" style of operating is so important. As they say in this post: > We build our systems with the assu…

I think you meant "Chaos Monkey" [1]. [1] https://github.com/Netflix/chaosmonkey

[deleted]

Re: Summary of the Amazon S3 Service Disruption

#34
post #25
post #8

> At 9:37AM PST, an authorized S3 team member using an established playbook executed a command which was intended to remove a small number of servers for one of the S3 subsystems that is used by the S3 billing process. Unfortunately, one of the inputs to the command was entered incorrectly and a larger set of servers was removed than intended. It remains amazing to me that even with all the layers of automation, the…

Wonder what happened to the poor slob who did that. He/She was unauthorized AND caused a pretty serious outage... EDIT: derp, my bad, I read as "unauthorized" which was "authorized".

How do you figure? From the blog post:

" At 9:37AM PST, an authorized S3 team member using an established playbook executed a command which was intended to remove a small number of servers for one of the S3 subsystems that is used by the S3 billing process. Unfortunately, one of the inputs to the command was entered incorrectly and a larger set of servers was removed than intended."

Re: Summary of the Amazon S3 Service Disruption

#35
post #21
post #17

This part is also interesting: > While this is an operation that we have relied on to maintain our systems since the launch of S3, we have not completely restarted the index subsystem or the placement subsystem in our larger regions for many years. These sorts of things make me understand why the Netflix "Chaos Gorilla" style of operating is so important. As they say in this post: > We build our systems with the assu…

I think you meant "Chaos Monkey" [1]. [1] https://github.com/Netflix/chaosmonkey

Chaos gorilla is a thing as well, simulates outage of an entire AZ. http://techblog.netflix.com/2011/07/netflix-simian-army.html

Re: Summary of the Amazon S3 Service Disruption

#36
post #25
post #8

> At 9:37AM PST, an authorized S3 team member using an established playbook executed a command which was intended to remove a small number of servers for one of the S3 subsystems that is used by the S3 billing process. Unfortunately, one of the inputs to the command was entered incorrectly and a larger set of servers was removed than intended. It remains amazing to me that even with all the layers of automation, the…

Wonder what happened to the poor slob who did that. He/She was unauthorized AND caused a pretty serious outage... EDIT: derp, my bad, I read as "unauthorized" which was "authorized".

One of the positive things about Amazon's culture is that they heavily emphasize blaming broken processes, not blaming people. I doubt the person involved will have any negative consequences beyond embarrassment.

Re: Summary of the Amazon S3 Service Disruption

#37
post #8

> At 9:37AM PST, an authorized S3 team member using an established playbook executed a command which was intended to remove a small number of servers for one of the S3 subsystems that is used by the S3 billing process. Unfortunately, one of the inputs to the command was entered incorrectly and a larger set of servers was removed than intended. It remains amazing to me that even with all the layers of automation, the…

Sounds like an opportunity for machine learning. Anyone want to write an AI BOFH?

Re: Summary of the Amazon S3 Service Disruption

#38
post #21
post #17

This part is also interesting: > While this is an operation that we have relied on to maintain our systems since the launch of S3, we have not completely restarted the index subsystem or the placement subsystem in our larger regions for many years. These sorts of things make me understand why the Netflix "Chaos Gorilla" style of operating is so important. As they say in this post: > We build our systems with the assu…

I think you meant "Chaos Monkey" [1]. [1] https://github.com/Netflix/chaosmonkey

I recently saw a talk where they referred to Chaos Monkey (kills instances), Chaos Gorilla (kills many instances for a single service in a single region) and Chaos Kong (takes an entire region offline)

Re: Summary of the Amazon S3 Service Disruption

#39
post #11

What's missing is addressing the problems with their status page system, and how we all had to use Hacker News and other sources to confirm that US East was borked.

No, this is addressed: >We understand that the SHD provides important visibility to our customers during operational events and we have changed the SHD administration console to run across multiple AWS regions.

Which is fine until those regions go down. A status page, in my mind, should have a fallback on a completely different service provider.

Re: Summary of the Amazon S3 Service Disruption

#40
" we have not completely restarted the index subsystem or the placement subsystem in our larger regions for many years. S3 has experienced massive growth over the last several years and the process of restarting these services and running the necessary safety checks to validate the integrity of the metadata took longer than expected"

This is analogous to "we needed to fsck, and nobody realized how long that would take".

Post reply on HN