Facebook explains worst outage in four years

24 Sep 2010

Facebook has apologised and explained how a software glitch saw the world’s most popular social networking site go down for 2.5 hours last night.

More than 500 million people worldwide use Facebook to keep in touch with friends, family and colleagues, and the site recently overtook Google as the most-visited website on the planet.

However, around 11.30am PST (7.30pm GMT), the site wasn’t functioning for users and didn’t come back online until around 2pm PST (10pm GMT).

“This is the worst outage we’ve had in over four years, and we wanted to first of all apologise for it,” Facebook’s software engineering director Robert Johnson, explained.

“We also wanted to provide much more technical detail on what happened and share one big lesson learned. The key flaw that caused this outage to be so severe was an unfortunate handling of an error condition. An automated system for verifying configuration values ended up causing much more damage than it fixed.

“The intent of the automated system is to check for configuration values that are invalid in the cache and replace them with updated values from the persistent store. This works well for a transient problem with the cache, but it doesn’t work when the persistent store is invalid.

“Today, we made a change to the persistent copy of a configuration value that was interpreted as invalid. This meant that every single client saw the invalid value and attempted to fix it. Because the fix involves making a query to a cluster of databases, that cluster was quickly overwhelmed by hundreds of thousands of queries a second.”

To make matters worse, Johnson explained that every time a client got an error attempting to query one of the databases it interpreted it as an invalid value, and deleted the corresponding cache key.

Fatal feedback loop

“This meant that even after the original problem had been fixed, the stream of queries continued. As long as the databases failed to service some of the requests, they were causing even more requests to themselves. We had entered a feedback loop that didn’t allow the databases to recover.

“The way to stop the feedback cycle was quite painful – we had to stop all traffic to this database cluster, which meant turning off the site. Once the databases had recovered and the root cause had been fixed, we slowly allowed more people back onto the site.

“This got the site back up and running today, and for now we’ve turned off the system that attempts to correct configuration values. We’re exploring new designs for this configuration system following design patterns of other systems at Facebook that deal more gracefully with feedback loops and transient spikes.

“We apologise again for the site outage, and we want you to know that we take the performance and reliability of Facebook very seriously,” Johnson said.

John Kennedy is a journalist who served as editor of Silicon Republic for 17 years