Disks lie. And the controllers that run them are partners in crime.

http://queue.acm.org/detail.cfm?id=2367378

by pwg • 14 years ago

141 42 14 years ago

queue.acm.org

jat850• 14 years ago

I wish I could post the video from the talk, but here are some slides at least. Good supporting talk on the pitfalls of making assumptions about how disks work, from OSCON '11:

http://www.slideshare.net/iammutex/what-every-data-programme...

ChuckMcM7• 14 years ago

During my tenure at NetApp I got to see all sorts of really really interesting disk problems and the lengths software had to go to reliably store data on them. Two scars burned into me from that were 1) disks suck, and 2) disks are not 'storage'.

The first part is pretty easy to understand, storage manufacturers have competed for years in a commodity market where consumers often choose price per gigabyte over URER (the unrecoverable read error rate), further at the scale of the market small savings of cents adds up to better margins. And while the 'enterprise' fibre channel and SCSI drives could (and did) command a hefty premium, the shift to SATA drives really put a crimp in the over all margin picture. So the disk manufacturers are stuck between the reliability of the drive and the cost of the drive. They surf the curve where it is just reliable enough to keep people buying drives.

This trend bites back, making the likely hood of an error while reading more and more probable. Not picking on Seagate here, they are all similar, but lets look at their Barracuda drive's spec sheet [1]. You will notice a parameter 'Nonrecoverable Read Errors per Bits read', and you'll see that its 1x10e14 across the sheet, from 3TB down to 250GB. It is a statistical thing, the whole magnetic field domain to digital bit pipeline is one giant analog loop of a error extraction. 1x10E14 bits. So what does that mean? Lets say each byte is encoded in 10 bits on the disk. Three trillion bytes is 30 trillion bits in that case, or 3x10E13 bits. Best case, if you read that disk from one end to the other (like you were re-silvering a mirror from a RAID 10 setup) you have a 1 in 3 chance that one of those sectors won't be readable for a perfectly working disk. Amazing isn't it? Trying to reconstruct a RAID5 group with 4 disks remaining out of 5, look out.

So physics is not on your side, but we've got RAID 6 Chuck! Of course you do, and that is a good thing. But what about when you write to the disk, the disk replies "Yeah sure boss! Got that on the platters now" but it didn't actually right it? Now you've got a parity failure waiting to bite you sitting on the drive, or worse, it does write the sector but writes it somewhere else (saw this a number of times at NetApp as well). There are three million lines of code in the disk firmware. One of the manufacturers (my memory says Maxtor) showed a demo where they booted Linux on the controller of the drive.

Bottom line is that the system works mostly, which is a huge win, and a lot of people blame the OS when the drive is at fault, another bonus for manufacturers, but unless your data is in a RAID 6 group or on at least 3 drives, its not really 'safe' in the "I am absolutely positive I could read this back" sense of the word.

[1] http://www.seagate.com/files/staticfiles/docs/pdf/datasheet/...

biot• 14 years ago

What were the least problematic drives in your experience?

protomyth• 14 years ago

Not original poster, but I favor WD over Seagate because lately all Seagate drives we have got (about 20) failed in a couple of months. I have had 2 WD failures this years (about 100 drives in various RAID configs).

Whatever brand ships with HP netbooks is basically a failure waiting to happen (we bought 100 HP netbooks with 3G from Verizon - they are very sick of us calling).

ChuckMcM7• 14 years ago

The ones that had been shipping for a few years. Like many things they all start life the least stable, go through several firmware revisions, maybe a couple of hardware revisions, and then everyone hits about the same level of reliability if they don't change them further.

obituary_latte• 14 years ago

How does Chuck imagine the increasing popularity (read: affordability) of solid state drives will affect this paradigm?

Very interesting post btw. Thanks.

ChuckMcM7• 14 years ago

I had a partner at a VC ask me that too :-) The question you have to ask is "What is Flash?" which sounds really dumb when you ask it but let me explain.

So in the storage business everything used to be done on the highest performance, most reliable drives. Typically those were 15K RPM Fibre Channel drives which cost 8x the price of an equivalent SATA drive [1]. In 2003 NetApp created the 'NearStore' line which was filers that used SATA drives. The idea was that tape was way to slow, you could put stuff on SATA drives and for low duty cycles get to it a lot faster, SATA drives were 'nearline' storage which was defined to be "about 99.8% available." This was hugely better than tape but not as good as a "real" disk array. Of course what people discovered was that you could have some pretty huge data sets be reasonably accessible that way, the first folks were the oil and gas folks [2] but lots of people jumped onto the bandwagon, it was cheaper than a storage array, faster than tape.

Now lets look at flash. Most people think of flash as a disk replacement because it connects to the computer through a disk interface (even though it doesn't have disk mechanicals). So it seems like a really fast disk. My assertion though is that it isn't a fast disk, its slow memory. It is 'near line' memory. Which is to say it takes a lot longer to access something in flash than it does in memory, but its craploads faster than getting off of spinning rust.

Four years ago, I told a guy who claimed to be Intel's key flash architect that if Intel would put flash on the same side of the MMU as the processor we would completely change the way servers are built. Why? Can you imagine that you've got 200GB of address space that is already ready to go when you turn on the processor? Once you start loading page tables you read in the ones in non-volatile flash and blam all your data structures are ready to go, right now. You want to make some sort of logical computation based on the state of a 50GB data structure, and all you do is follow the pointers? The 'driver' for flash attached as memory is

   var = *((var type *)(0xsome64bitaddress);

But we cannot do that because flash doesn't live on the front side bus, it lives, at best, in the PCI Express address space on the other side of the Southbridge. [3].

Bottom line Solid State drives are doomed, you can't make them much denser the physics doesn't work, you don't want to waste your time going through the disk driver and I/O subsystem to get to what is essentially more memory. But as flash moves closer to the CPU its impact will become pretty impressive.

[1] This lead people like IBM to propose 'bricks' which were 8 SATA drives in a RAID or Mirrored config pretending to be a single reliable drive.

[2] One of my favorite Dave Hitz quotes: "Oil and Gas companies have an awesome compression algorithm, they can take a 600TB data set and compress it to one bit, 'oil' or 'no oil.'"

[3] Yes the new Sandy Bridge DDIO architecture helps with this. (http://www.realworldtech.com/sandy-bridge-ep/2/)

dap• 14 years ago

Phantom writes are one reason ZFS stores checksums separately from the blocks being written. If you store checksums with the block itself, then failure modes like phantom writes can result in reading data that you think is valid (because the checksum matches) but it's the wrong data.

The worst part of this is that often when disks fail, they just become extremely slow (100s of milliseconds) rather than explicitly failing. That can be significantly worse than just failing explicitly and having the OS read from another disk.

Nit: Remember the old fallacy: if there's a 50% chance of rain on each of Saturday and Sunday, that doesn't mean there's 100% chance of rain this weekend. The quoted number of nonrecoverable errors per bits read is presumably an expected value on a uniform distribution (which is ludicrous, since errors are not even remotely independent, but I don't know what else they could be expecting the reader to assume). In that case, the expected probability of an error on each bit read is 1 / 1E14. The probability of zero errors after reading 3E13 bits is ((1E14-1)/1E14)^3E13, which is about 75%.

wazoox3• 14 years ago

> The worst part of this is that often when disks fail, they just become extremely slow (100s of milliseconds) rather than explicitly failing.

This is the main difference between consumer-grade and enterprise-grade drives firmware. Take the HGST Deskstar and Ultrastar, or Seagate Constellation ES and Barracuda 2 TB; they are physically exactly the same, but behave very differently when encountering an error. Basically the enterprise drive will fail shortly BUT recover (because it's probably RAID-backed), while the desktop drive will try to read the data when asked at all prices (because it's probably NOT RAID-backed), therefore suffering from extremely long time-outs.

> . The probability of zero errors after reading 3E13 bits is ((1E14-1)/1E14)^3E13, which is about 75%.

Still not the sort of statistics you want betting your precious data against...

recoiledsnake• 14 years ago

The article glosses over the fact that fsync() itself has major issues. For example, on ext3, if you call fsync() on a single file, all file system cached data is written to disk, leading to an extreme slowdown. This led to a Firefox bug, when the sqlite db used for the awesome bar and for bookmarks called fsync() and slowed everything down.

http://shaver.off.net/diary/2008/05/25/fsyncers-and-curvebal...

OS X does a fake fsync() if you call it with the defaults. https://developer.apple.com/library/mac/#documentation/Cocoa...

fsync in Mac OS X: Since in Mac OS X the fsync command does not make the guarantee that bytes are written, SQLite sends a F_FULLFSYNC request to the kernel to ensures that the bytes are actually written through to the drive platter. This causes the kernel to flush all buffers to the drives and causes the drives to flush their track caches. Without this, there is a significantly large window of time within which data will reside in volatile memory—and in the event of system failure you risk data corruption

btrask• 14 years ago

  So in summary, I believe that the comments in the MySQL news posting
  are slightly confused.  On MacOS X fsync() behaves the same as it does
  on all Unices.  That's not good enough if you really care about data
  integrity and so we also provide the F_FULLFSYNC fcntl.  As far as I
  know, MacOS X is the only OS to provide this feature for apps that
  need to truly guarantee their data is on disk.

The full post goes into detail. http://lists.apple.com/archives/darwin-dev/2005/Feb/msg00072...

scdeepak• 14 years ago

Me and my colleagues had worked on a solution to this problem a few years back. The results were published and is linked here.

ACM digital library link - http://dl.acm.org/citation.cfm?id=2056434

The paper - http://research.cs.wisc.edu/adsl/Publications/cce-dsn11.pdf

baruch5• 14 years ago

That's a really neat hack, but how many disks have you seen that do not adhere to their write-cache-disabled setting?

rarrrrrr• 14 years ago

At SpiderOak, every storage cluster writes new customer data to three RAID6 volumes on 3 different machines, which wait for fdatasync, before we consider it written.

... and before that begins, the data is added to a giant ring buffer that records the last 30 TB of new writes, on machines with UPS. If a rack power failure happens, the ring buffer is kept until storage audits complete.

I think every company that deals with large data they can't lose develops appropriate paranoia.

The behavior of hard drives is like decaying atoms. You can't make accurate predictions about what any one of them will do. Only in aggregate can you say something like "the half life of this pile of hardware is 12 years" or "if we write this data N times we can reasonably expect to read it it again."

baruch5• 14 years ago

Interesting, do you do disk scrubbing to make sure the data is still out there after a while? That would be the key method to ensure you can still recover the data upon need.

kabdib• 14 years ago

I had fun once diagnosing a bad bit in a drive's cache memory. Writes would go out, and sometimes come back with a bit set. All the disk-resident CRCs in the world won't help if your data is mangled before it makes it to the media.

File systems with end-to-end checking are good. (These can turn into accidental memory tests for your host, too, and with a large enough population you'll see interesting failures).

baruch5• 14 years ago

At the storage level there is T10 DIF that is supposed to help with such things (among many other things), though it is used in a very limited fashion and is only supported on the higher end disks.

Disks lie. And the controllers that run them are partners in crime.

Related Stories