[Paper Review] End-User Effects of Microreboots in Three-Tiered Internet Systems

George Candea, Armando Fox|ArXiv.org|Mar 6, 2004

Distributed systems and fault tolerance33 references3 citations

TL;DR

This paper proposes microreboots—fine-grained restarts of individual software components in three-tiered Internet applications—as a lightweight, middleware-based recovery technique that reduces downtime and failed requests compared to full system reboots. Evaluated on a J2EE-based auction system, microreboots reduced failed user requests by 65% and perceived downtime by 78%, while enabling transparent retry mechanisms with minimal latency impact.

ABSTRACT

Microreboots restart fine-grained components of software systems "with a clean slate," and only take a fraction of the time needed for full system reboot. Microreboots provide an application-generic recovery technique for Internet services, which can be supported entirely in middleware and requires no changes to the applications or any a priori knowledge of application semantics. This paper investigates the effect of microreboots on end-users of an eBay-like online auction application; we find that microreboots are nearly as effective as full reboots, but are significantly less disruptive in terms of downtime and lost work. In our experiments, microreboots reduced the number of failed user requests by 65% and the perceived downtime by 78% compared to a server process restart. We also show how to replace user-visible transient failures with transparent call-retry, at the cost of a slight increase in end-user-visible latency during recovery. Due to their low cost, microreboots can be used aggressively, even when their necessity is less than certain, hence adding to the reduced recovery time a reduction in the fault detection time, which further improves availability.

Motivation & Objective

• Address the high cost and disruption of full system reboots in Internet services, especially for transient faults.
• Improve system availability by reducing mean time to recovery (MTTR) without requiring application-specific changes.
• Demonstrate that microreboots—restarting only faulty components—can be as effective as full reboots but with significantly less user impact.
• Evaluate the effectiveness of microreboots in real-world, interactive, componentized applications under realistic failure scenarios.
• Identify failure cases where microreboots fail and propose middleware-level fixes to improve robustness.

Proposed method

• Augmented an open-source J2EE application server (JBoss) with fault injection, instrumentation, and microreboot capabilities for individual EJBs and functional subsystems.
• Used trace playback and induced recovery to simulate real user workloads and measure end-user impact.
• Implemented transparent call-retry mechanisms to mask transient failures during microreboot, adding minimal latency.
• Designed the middleware to support application-generic recovery without requiring prior knowledge of application semantics.
• Evaluated microreboots in a three-tiered architecture (web, business logic, data layers), focusing on component boundaries and state persistence.
• Proposed middleware-level enhancements to handle cases where microreboots fail due to state corruption or incomplete recovery.

Experimental results

Research questions

• RQ1 How effective are microreboots compared to full reboots in reducing user-visible failures and downtime in a three-tiered web application?
• RQ2 Can microreboots mask transient failures effectively through transparent retry mechanisms without significantly increasing latency?
• RQ3 What types of failures are not resolved by microreboots, and what middleware-level changes can improve their success rate?
• RQ4 To what extent can microreboots reduce the number of users impacted by a transient fault compared to full reboots?
• RQ5 How does the use of microreboots enable faster fault detection and more aggressive failure monitoring strategies?

Key findings

• Microreboots reduced the number of failed user requests by 65% compared to full server process restarts.
• Perceived downtime was reduced by 78% with microreboots, significantly improving user experience.
• Microreboots were nearly as effective as full reboots in restoring service but caused far less disruption due to their fine-grained nature.
• The use of transparent call-retry during microreboots introduced only a slight increase in end-user-visible latency while masking transient failures.
• Microreboots reduced the total amount of work lost during recovery by minimizing the number of affected users and shortening recovery time.
• Specific failure cases—such as session state corruption—were not resolved by microreboots, but the authors proposed middleware-level fixes to address these limitations.