Live data from Hacker News

AWS issues unavoidable reboot schedules with short notice on many EC2 instances

forums.aws.amazon.com

141–150 of 160 posts

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#141

Earlier quoted context omitted.

You get reimbursed?!?! We've been pleading for several months now for a service credit or at least an acknowledgment that they screwed up. Discovered an arcane issue with ARPing to elasticache from within a vpc. Cost us ~$8000 in instances we left running at their request to diagnose, and about the same in man time from our side. Took them 6 weeks to diagnose, too - bloody pathetic. We spend $30k a month with AWS and…

Hi madaxe_again, I work at AWS (npinguy does not to the best of my knowledge). If you've spent $8,000 on maintaining instances you wouldn't have running otherwise to reproduce a bug on our behest, we don't want you to have to pay for that. I'd like to look into getting a refund for you. Is there an email address I can reach you at to get more details on the situation?

No, don't work at AWS, for the record. But responses like this is why I'm a big fan of the Amazon platform and the point I was trying to make. Oh well.

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#142

Earlier quoted context omitted.

Ideally, that would be great. I doubt that would be an option though due to capacity. Would you rather stop/start your instance and risk a capacity error or have your impacted instances rebooted in 48 hours?

> Would you rather stop/start your instance and risk a capacity error or have your impacted instances rebooted in 48 hours? Is there that little slack in Amazon's compute capacity? I would hope not! If there isn't capacity to start my instance back up, I would hope that hitting Stop would generate a dialog to the effect of "Hey there, you won't be able to start this instance back up if you stop it right now."

> Is there that little slack in Amazon's compute capacity?

Amazon's ability to deliver sharp prices does not come from leaving unused tin lying around in datacentres.

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#143

Earlier quoted context omitted.

> Would you rather stop/start your instance and risk a capacity error or have your impacted instances rebooted in 48 hours? Is there that little slack in Amazon's compute capacity? I would hope not! If there isn't capacity to start my instance back up, I would hope that hitting Stop would generate a dialog to the effect of "Hey there, you won't be able to start this instance back up if you stop it right now."

> Is there that little slack in Amazon's compute capacity? Amazon's ability to deliver sharp prices does not come from leaving unused tin lying around in datacentres.

Amazon markets their cloud infrastructure as having the ability to scale up at a moment's notice. If they don't have excess capacity, where am I going to scale to? Back to a colo environment?

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#144
post #64

A couple of points: Autoscaling is your friend. If you're not leveraging it (multiple availability zones), you're doing it wrong. Even single instances can be launched in autoscaling groups with a desired capacity of 1 to ensure that if it falls over, a new one is spun up. Point 2: AWS is likely trying to rotate capacity for updates, which means they need to evict instances. That are running on doms that they need to…

This helps services, but as some point you have to run a database layer too ;) Cassandra helps, but it's not the whole story during large-scale close together reboots like these. It ends up being a decent bit of manual operator time spent when security patches force AWS to reboot. You have to be pretty careful about any service that can't lose members as quickly due to bootstrap times or technology limitations, e.g.…

Each AZ looks to me like it is a day apart. Surely that is enough time.

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#145

Pretty crappy that you cannot immediately check if an instance has restarted on a patched host or not. I would have expected Amazon to rush out a tool you can use to check or add a little marker to the dashboard or a simple API to query. Some sort of synchronous option. Having to wait possibly hours for an email to see if your vm migrated to patched host or not is a terrible solution.

> I would have expected Amazon to rush out a tool you can use to check or add a little marker to the dashboard or a simple API to query. Some sort of synchronous option. I would expect Amazon to mark unpatched hosts as bad and not permit new instances to be deployed to them, similar to queue draining. Not cool Amazon.

Stop relying on long running instances. Design your infrastructure for failure. This is not Amazon's responsibility.

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#146

Earlier quoted context omitted.

Ideally, that would be great. I doubt that would be an option though due to capacity. Would you rather stop/start your instance and risk a capacity error or have your impacted instances rebooted in 48 hours?

> Would you rather stop/start your instance and risk a capacity error or have your impacted instances rebooted in 48 hours? Is there that little slack in Amazon's compute capacity? I would hope not! If there isn't capacity to start my instance back up, I would hope that hitting Stop would generate a dialog to the effect of "Hey there, you won't be able to start this instance back up if you stop it right now."

Spot market anyone? Different regions, even different AZ's have different capacity.

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#147
post #145

Earlier quoted context omitted.

> I would have expected Amazon to rush out a tool you can use to check or add a little marker to the dashboard or a simple API to query. Some sort of synchronous option. I would expect Amazon to mark unpatched hosts as bad and not permit new instances to be deployed to them, similar to queue draining. Not cool Amazon.

Stop relying on long running instances. Design your infrastructure for failure. This is not Amazon's responsibility.

Stop assuming that everyone operates at Netflix scale. Not everyone wants to watch their database, memcached, and redis instances thrash all day as instances dance around from physical box to physical box.

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#148
post #95

Earlier quoted context omitted.

May be this: http://xenbits.xen.org/xsa/ XSA-108 2014-10-01 12:00 (Prereleased, but embargoed)

Cool speculation! Anyone with anything concrete? I still heard it is power issues.

Aren't you speculating as well?

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#149
post #109

Earlier quoted context omitted.

You get reimbursed?!?! We've been pleading for several months now for a service credit or at least an acknowledgment that they screwed up. Discovered an arcane issue with ARPing to elasticache from within a vpc. Cost us ~$8000 in instances we left running at their request to diagnose, and about the same in man time from our side. Took them 6 weeks to diagnose, too - bloody pathetic. We spend $30k a month with AWS and…

When a script mistakingly provisioned a ridiculous amount of read/write capacity on hundreds of DynamoDB tables, we were presented with a bill in the thousands of dollars. We got reimbursed after talking with our account manager for 15 minutes. Maybe my experience is the exception, but my account manager has always been extremely helpful at resolving whatever issues we had.

We had a similar experience regarding DynamoDB.

Re: AWS issues unavoidable reboot schedules with short notice on many EC2 instances

#150

Earlier quoted context omitted.

I'd be interested to know more about this as I've been curious for a while about how people do this stuff. No matter how many instances you have, surely you'll still be hosed if they all go down at the same time? Or if there's rolling downtime taking out instances faster than you can bring the restarted instances up to speed? So if you're replicated across three availability zones you're not truly prepared for any in…

There are lots of ways to set it up. I should note first that most interesting datastores you'll run in the cloud will end up needing instance stores for performance reasons anyway--you want sequential read perf, you know?--and so this is really just extending it to other nodes that, if you're writing twelve-factor apps, should pop back up without a hitch anyway. (If you're not writing twelve-factor apps...why not?)…

> (Building that part, auto-scaling groups and replacing dead instances, is probably the hardest part of this whole thing, even with a provisioner like Chef or Puppet.)

Not so much with Zookeeper, Eureka, or etcd.

Post reply on HN