Live data from Hacker News

January 28th Incident Report

github.com

181–190 of 198 posts

Re: January 28th Incident Report

#181
post #8
post #3

This just shows how difficult it is to avoid hidden dependencies without a complete, cleanly isolated, testing environment of sufficient scale to replicate production operations and do strange system fault scenarios somewhere that won't kill production.

It turns out that it's even hard then. Complex systems, by their very nature, fail in unexpected and unpredictable ways. If that weren't bad enough, hindsight bias makes it way too easy for us to look back with perfect knowledge and opine "That was so obvious, how could they have missed such a rudimentary issue?" If only things were that easy.

I'm not sure what part of servers failing to POST is especially complex or related to distributed computing.

For all the fawning over being provided technical details, this article was pretty light on them.

I don't think Github going down for a couple hours is that big of a deal TBH. But it does seem to expose a few really basic failings in their DR planning IMO.

I also think it's ridiculous that some commenters are trying to frame this as a distributed computing problem. It's not even a clustering problem (apparently). It's just looking at the iDRAC or whatever to see why the server isn't getting past POST and putting your recovery plan into action.

This is white box vanilla stuff that happens to everybody.

That servers had to be rebuilt as part of DR says a lot.

The fact that there was a Redis dependency during bootstrap? Probably a good thing. You know as well as anyone I'm sure the last thing you want is a bunch of processes that only look like they're up. And even if they could not error without their Redis connections, if Redis is used for caching, what's that going to do to availability? Would it be a good thing to have the processes up if they can only handle 10% of the usual load?

Those are details that aren't there.

But complex distributed computing problem this is not. Not as it was presented anyways.

Re: January 28th Incident Report

#182
post #162

Earlier quoted context omitted.

Huh, I wonder if the status page is in fact based on any automated monitoring at all, or just manual updates? I guess probably automated monitoring, just not very good automated monitoring.

IIRC, it's manual and way up the chain.

That is pretty ridiculous.

Re: January 28th Incident Report

#183
post #71
post #69

Earlier quoted context omitted.

The rest of the sentence is pertinent: "...but we can take steps to ensure recovery occurs in a fast and reliable manner. We can also take steps to mitigate the negative impact of these events on our users." The lessons that giants like Netflix have learned about running massive distributed applications show that you cannot avoid failure, and instead must plan for it. Now, having a single datacenter is not a good pla…

My point is: they shouldn't ONLY plan on ensuring recovery occurs fast; they should also plan on having multiple data centers, which to me is more important. It's frightening to know that such an important service is only operating in a single data center. However, their recovery report didn't mention anything about such a plan. << Edited: correct a grammar error.

I completely agree that geo-redundancy is a hard requirement for a site as critical to the functioning of the internet as Github.

A generous reading of "We can also take steps to mitigate the negative impact of these events on our users." would include improvements of that sort.

That said, I also didn't spot any concrete proposals for geo-redundancy in the post-mortem. Perhaps that's a detail that will be figured out in a following exercise, or perhaps they really don't have any plans for GR, in which case the generous reading would be unwarranted.

Re: January 28th Incident Report

#184
post #71

Earlier quoted context omitted.

My point is: they shouldn't ONLY plan on ensuring recovery occurs fast; they should also plan on having multiple data centers, which to me is more important. It's frightening to know that such an important service is only operating in a single data center. However, their recovery report didn't mention anything about such a plan. << Edited: correct a grammar error.

You're not going to fail over to a secondary datacenter in under 125 minutes. A RTO under that costs a prohibitively stupid amount.

Why not? There's no reason in principle that you can't have hot standbys that are switched over to immediately when the primary fails. Or even a no-primary setup with each cluster being master for some data and slave for others (a la Cassandra's replication model).

There may be specific aspects of Github's usecase that make this difficult, but please don't pretend that geo-redundancy is impossible. Look at Netflix's architecture for an example of a site that services traffic from multiple AZs.

Re: January 28th Incident Report

#185
post #98

Earlier quoted context omitted.

For people reading this, AZ in this context would be Availability Zone

Right, and not the Grand Canyon State. The space of acronyms/abbreviations is quite cluttered.

Heh, not from the US initially so that overloading did not occur to me :)

That's an interesting alternate reading though...

"To ensure the integrity of our data, we need to locate another Arizona, since this one is serving us so well."

Re: January 28th Incident Report

#186

Earlier quoted context omitted.

If you have a support agreement with them then file a ticket requesting better customer communication and link back here as an example of how to do it right. I think everyone complains in forums and online but doesn't actually file tickets about it. These things are worth tickets too.

I take it you have no experience filing tickets with them. A typical ticket goes something like this: 1. File ticket. 2. Wait. Then wait some more. Even if you pay big money for a support contract, they take a long time to respond (often > 1 hour). 3. Get a response from a first level rep who has no access to anything, has little dev experience, and asks some inane questions which I'm convinced is a purposeful stalli…

>2. Wait. Then wait some more. Even if you pay big money for a support contract, they take a long time to respond (often > 1 hour).

My experiences don't reflect this, perhaps we are familiar with different levels of support contracts. I use AWS for work only so I can only speak to one level if their support.

>3. Get a response from a first level rep who has no access to anything, has little dev experience, and asks some inane questions which I'm convinced is a purposeful stalling tactic. 4. Play the dumb question/obvious response dance, waiting an hour or more for a response each time.

I can't agree with this either. I almost always use their chat option and a rep is usually available within 15m unless there is an AWS outage.

I do however completely agree with 5 and 6, but I don't let it bother me. They can't expose too much info about their infrastructure. I'm usually just looking for a confirmation of an issue in their side or not which they have always been willing to provide.

If you're using aws for business and are unhappy with their current level if support maybe you should talk with their sales folks to find out about higher tier support plans.

Re: January 28th Incident Report

#187
post #151

"We identified the hardware issue resulting in servers being unable to view their own drives after power-cycling as a known firmware issue that we are updating across our fleet." Tell us which vendor shipped that firmware, so everyone else can stop buying from them.

I'm guessing they didn't disclose the vendor because they didn't want to be sued for defamation.

Truth is an absolute defense to libel in the US.

Re: January 28th Incident Report

#188

Earlier quoted context omitted.

"But there are package management systems and other stuff depending on being able to download from Github." Rust program building, for example, seems to require that Github be up.

Only if you need to fetch new dependencies.

Or do a clean rebuild.

Re: January 28th Incident Report

#189

Earlier quoted context omitted.

> Usually its just cheaper to be down for an hour or two, versus architect for the end of times The opposite of this philosophy was the motivation behind creation of the internet in the first place.

This seems precisely wrong. Some reading: http://web.mit.edu/Saltzer/www/publications/endtoend/endtoen... https://www.jwz.org/doc/worse-is-better.html [thanks for the hint 'thinkpad20! I don't know what I was thinking.]

It is not precisely wrong, and thanks for tricking me into opening an obscene picture at work, asshole.

The internet is designed to be highly fault tolerant, because it was based on an arpanet project to design a network that would NOT go down, even if there was damage to a significant percentage of nodes.

Re: January 28th Incident Report

#190
post #169
post #83

> One of the biggest customer-facing effects of this delay was that status.github.com wasn't set to status red until 00:32am UTC, eight minutes after the site became inaccessible. We consider this to be an unacceptably long delay, and will ensure faster communication to our users in the future. Amazon could learn a thing or two from Github in terms of understanding customer expectations.

> Amazon could learn a thing or two from Github in terms of understanding customer expectations. Do you mean that "the cloud provider that is bigger than the next 14 combined and whose jargon has spread through the community" doesn't understand what customers are interested in and delivering on that?

Do you mean that just because a company has huge market share it must be doing every single thing better than its competitors?
Post reply on HN