Just a quick update, I was invited to speak at Sys-Con’s Cloud Computing Expo 2008 West (how’s that for a mouthful?) and accepted, planning on talking about SkyNet, S3, and our future use of cloud computing. Alas, my Inbox is so crazy, I failed to see the handful of emails the conference sent me asking me to sign a contract of some type. So I missed the deadline and they canceled my spot. (BTW, I can’t recall a conference ever asking me to sign something to speak, but this one does and I was full of FAIL.) 😦
So, I’m sorry, despite being listed on the program, I’m *not* speaking there this week. It was my bad – I just missed the emails (as I miss so many emails these days). But still, a phone call from them wouldn’t have hurt, would it?
Who knows if I’ll be on their invitation list next year, but the conference will be great anyway, so have a great time without me!
I know a lot of you get your Amazon Web Services news from me, so I thought I’d better mention this one. It’s huge!! 🙂
Amazon announced S3 price reductions as you scale. For us, since we’re way beyond 500TB, this is huge. And for any of you who are still in their first tier, it’s something to look forward to. 🙂
DevPay also got a significant new release, pricing-wise, recently, so if you’re interested in that, better check it out.
Everyone knows that SmugMug is a heavy user of S3, storing well over half a petabyte of data (non-replicated) there. What you may not know is that EC2 provides a core part of our infrastructure, too. Thanks to Amazon, the software and hardware that processes all of your high-resolution photos and high-definition video is totally scalable without any human intervention. And when I say scalable, I mean both up and down, just the way it should be. Here’s our approach in a nutshell:
The architecture basically consists of three software components: the rendering workers, the batch queuing piece, and the controller. The rendering workers live on EC2, and both the queuing piece and the controller live at SmugMug. We don’t use SQS for our queuing mechanism for a few reasons:
- We’d already built a queuing mechanism years ago, and it hasn’t (yet?) hit any performance or reliability bottlenecks.
- SQS’s pricing used to be outta whack for what we needed. They’ve since dramatically lowered the pricing and it’s now much more in line with what we’d expect – but by then, we were done.
- The controller consumes historical data to make smart decisions, and our existing queuing system was slightly easier to generate the historical data from.
Our render workers are totally “dumb”. They’re literally bare-bones CentOS 5 AMIs (you can build your own, or use RightScale’s, or whatever you’d like) with a single extra script on them which is executed from /etc/rc.d/rc.local. What does that script do? It fetches intelligence. 🙂
When that script executes, it sends an authenticated request to get a software bundle, extracts the bundle, and starts the software inside. That’s it. Further, the software inside the bundle is self-aware and self-updating, too, automatically fetching updated software, terminating older versions, and relaunching itself. This makes it super-simple to push out new SmugMug software releases – no bundling up new AMIs and testing them or anything else that’s messy. Simply update the software bundle on our servers and all of the render workers automatically get the new release within seconds.
Of course, worker instances might have different roles or be assigned to work with different SmugMug clusters (test vs production, for example), so we have to be able to give it instructions at launch. We do this through the “user-data” launch parameter you can specify for EC2 instances – they give the software all the details needed to choose a role, get software, and launch it. Reading the user-data couldn’t be easier. If you haven’t done it before, just fetch http://169.254.169.254/latest/user-data from your running instance and parse it.
Once they’re up and running, they simply ping the queue service with a “Hi, I’m looking for work. Do you have any?” request, and the queue service either supplies them with work or gives them some other directive (shutdown, software update, take a short nap, etc). Once a job is done (or generated an error), the worker stores the work result on S3 and notifies the queue service that the job is done and asks for more work. Simple.
This is your basic queuing service, probably very similar to any other queueing service you’ve seen before. Ours supports job types (new upload, rotate, watermark, etc) and priorities (Pros go to the head of the line, etc) as well as other details. Upon completion, it also logs historical data such as time to completion. It also supports time-based re-queueing in the event of a worker outage, miscommunication, error, or whatever. I haven’t taken a really hard look at SQS in quite some time, but I can’t imagine it would be very difficult to implement on SQS for those of you starting fresh.
CONTROLLER (aka SkyNet)
For me, this was the fun part. Initially we called it RubberBand, but we had an ususual partial outage one day which caused it to go berzerk and launch ~250 XL instances (~2000 normal EC2 instances) in a single call. Clearly, it had gained sentience and was trying to take over the world, so we renamed it SkyNet. (We’ve since corrected the problem, and given SkyNet more reasonable thresholds and limits. And yes, I caught it within the hour.).
SkyNet is completely autonomous – it operates with with zero human interaction, either watching or providing interactive guidance. No-one at SmugMug even pays attention to it anymore (and we haven’t for many months) since it operates so efficiently. (Yes, I realize that means it’s probably well on its way to world domination. Sorry in advance to everyone killed in the forthcoming man-machine war.)
Roughly once per minute, SkyNet makes an EC2 decision: launch instance(s), terminate instance(s), or sleep. It has a lot of inputs – it checks anywhere from 30-50 pieces of data to make an informed decision. One of the reasons for that is we have a variety of different jobs coming in, some of which (uploads) are semi-predictable. We know that lots of uploads come in every Sunday evening, for example, so we can begin our prediction model there. Other jobs, though, such as watermarking an entire gallery of 10,000 photos with a single click, aren’t predictable in a useful way, and we can only respond once the load hits the queue.
A few of the data points SkyNet looks at are:
- How many jobs are pending?
- What’s the priority of the jobs?
- What type of jobs are they?
- How complex are the pending jobs? (ex: HD video vs 1Mpix photo)
- How time-sensitive are the pending jobs? (ex: Uploads vs rotations)
- Current load of the EC2 cluster
- Current # of jobs per sample processed
- Average time per job per sample
- Historical load and job performance
- How close any instances are to the end of their 1-hour cost window
- Recent SkyNet actions (start/terminate/etc)
.. and the list goes on.
Our goal is to keep enough slack around to handle surges of unpredictable batch operations, but not enough so it drains our bank account. We’ve settled on an average of roughly 25% of excess compute capacity available when averaged over a full 24 hour period and SkyNet keeps us remarkably close to that number. We always err on the side of more excess (so we get faster processing times) rather than less when we have to make a decision. It’s great to save a few bucks here and there that we can plow back into better customer service or a new feature – but not if photo uploads aren’t processing, consistently, within 5-30 seconds of upload.
Our workers like lots of threads, so SkyNet does its best to launch c1.xlarge instances (Amazon calls these “High-CPU Instances“), but is smart enough to request equivalent other instance sizes (2 x Large, 8 x Small, etc) in the event it can’t allocate as many c1.xlarge instances as it would like. Our application doesn’t care how big/small the instances are, just that we get lots of CPU cores in aggregate. (We were in the Beta for the High-CPU feature, so we’ve been using it for months).
One interesting thing we had to take into account when writing SkyNet was the EC2 startup lag. Don’t get me wrong – I think EC2 starts up reasonably fast (~5 mins max, usually less), but when SkyNet is making a decision every minute, that means you could launch too many instances if you don’t take recent actions into account to cover startup lag (and, conversely, you need to start instances a little earlier than you might actually need them otherwise you get behind).
SmugMug is a profitable business, and we like to keep it that way. The secrets to efficiently using EC2, at least in our use case, are as follows:
- Take advantage of the free S3 transfers. This is a biggy. Our workers get and put almost all of their bytes to/from S3.
- Make sure you have scaling down working as well as scaling up. At 3am on an average Wednesday morning, we have very few instances running.
- Use the new High-CPU Instances. Twice the CPU resources for the same $$ if you don’t need RAM.
- Amazon kindly gives you 30 days to monetize your AWS expenses. Use those 30 days wisely – generate revenues. 🙂
WHY NO WEB SERVERS?
I get asked this question a lot, and it really comes down to two issues, one major and one minor:
- No complete DB solution. SimpleDB is interesting, and the new EC2 Persistent Storage is too, but neither provides a complete solution for us. EC2 storage isn’t performant enough without some serious, painful partitioning to a finer grain than we do now – which comes with its own set of challenges, and SimpleDB both isn’t performant enough and doesn’t address all of our use cases. Since latency to our DBs matters a great deal to our web servers, this is a deal-killer – I can’t have EC2 web servers talking to DBs in my datacenters. (There are a few corner cases we’re exploring where we probably can, but they’re the exception – not the rule).
- No load balancing API. They’ve got an IP address solution in the form of Elastic IPs, which is awesome and major step forward, but they don’t have a simple Load Balancer API that I can throw my web boxes behind. Yes, I realize I can manually do it using EC2 instances, but that’s more fragile and difficult (and has unknown scaling properties at our scale). If the DB issue were solved, I’d probably dig into this and figure out how to do it ourselves – but since it’s not, I can keep asking for this in the meantime.
Let me be very clear here: I really don’t want to operate datacenters anymore despite the fact that we’re pretty good at it. It’s a necessary evil because we’re an Internet company, but our mission is to be the best photo sharing site. We’d rather spend our time giving our customers great service and writing great software rather than managing physical hardware. I’d rather have my awesome Ops team interacting with software remotely for 100% of their duties (and mostly just watching software like SkyNet do its thing). We’ll get there – I’m confident of that – we’re just not there yet.
Until then, we’ll remain a hybrid approach.
I realize I’m already way behind blogging about other new Amazon Web Services features like the recent EC2 release with static IPs, availability zones, and user kernels not to mention the new block storage service. I’ll still try to get to them – but I didn’t want to wait for this one.
I’ve been pushing Amazon hard to do something like this, and I’m thrilled it’s finally out. They have a great new service status dashboard complete with historical data and a mechanism for communicating to us, their customers, about any issues they may be having. Especially cool is that the data is provided via RSS, so you can programmatically poll the status and take steps as necessary. Awesome! Get all the details here.
One possible gotcha is that it looks like the dashboard is hosted at Amazon. We’ve run into outages (very rare) where all of amazon.com is down. In those cases, it’d be nice to have an externally-hosted site where they could post updates. Our customers asked us for this recently, so on January 29th, we were happy to comply. Perhaps Amazon could post to their TypePad blog in events like these, rare as they may be?
Next, they now offer paid premium support. Need some sort of help that’s not provided on the AWS forums or via searching Google? No worries – whip out your credit card and pay for it. Looks like they have two plans which should cover lots of use cases I’ve seen in my own comments and on the forums.
I’d still like to see a pay-per-incident model, personally, even with an extremely high price-tag for each incident. We rarely use support for AWS, but at the same time, we’re very big customers of theirs, so the monthly price is quite high. But if we really come up against a big problem, it’d be nice to know I could pay for support just that one time. I imagine most of their customers will like their Silver and Gold monthly packages, but for us, they’re just not quite the right fit. Do they work for you?
I’m pretty thrilled about this release, but maybe our use case is different from yours. Do you like these new features? Are they missing things you’d like to see?
First: Very cool.
Next: I think it’s interesting that Google has basically taken a sniper scope out and aimed it at a specific cloud computing target. App Engine is only for web applications. No batch computing, no cron jobs, no CPU/disk/network access, etc.
I think this is very smart of Google. Rather than attacking Amazon head-on, Google has realized there’s a huge playing field for cloud computing, and are attempting to dominate another portion of it, one where they have a lot of expertise. Very good business move, imho.
Will we use it? I wouldn’t be surprised. I’ve long thought that we’ll continue to mix in web services from a variety of providers, and it looks like App Engine can solve a slice of our datacenter need that other providers don’t yet provide.
I’m more than a little concerned, though, by how much vendor lock-in there is with App Engine. At first glance, it doesn’t look like the apps will be portable at all. If I want to switch providers, or add in other providers so I’m not relying solely on Google, I’m outta luck.
I’m hopeful other languages get supported, too. I think Python is great – don’t get me wrong – but we have a lot more experience with other languages, so there’ll be a learning curve.
Finally, I’m dying to find out what pricing for an application of our scale will look like. I can see some immediate, obvious things I’d like to try to do on App Engine, but the beta limits aren’t gonna cut it for us. 😦
Will it replace Amazon? It sure doesn’t look like it from where I sit. In fact, I don’t see this as much of a competitor to Amazon Web Services. There’s some overlap in some small area (hosted web apps on EC2), but I doubt that’s the bulk of Amazon’s business. As I said, we’ll likely end up using both (and other providers as they come along, too).
My favorite bit? In theory, Google has solved the data scaling problem. I don’t mean raw binary (blob) storage, which S3, SmugFS, MogileFS, and plenty of other things have solved, but the “database” scaling problem. Every popular web app runs into this problem, and it’s typically solved with a combination of memcached, federation, and replication. But it’s messy. In theory, Google has automated that piece for us. I can’t wait to play with it and see if that’s true.
I also can’t wait to see who else is going to wade into this fray. Sun? Microsoft? Yahoo? IBM?
Bring it on!
Amazon S3 had an outage today. First I knew about it was reporters emailing and calling me asking if we were knocked out by it.
We weren’t. No customers reported issues, and our systems were all showing typically low and acceptable error rates. To be honest, I’m surprised.
I wasn’t going to blog about it until I understood why we weren’t affected, but I’m really getting inundated with requests now, so I figured this would be a good way to optimize my time rather than spending all day on the phone. 🙂
We’re researching what happened now, but again, I didn’t know about the outage until after it was over, and I haven’t spoken to anyone at Amazon yet. Until I finish my research and speak with Amazon, I’m not going to speculate on what may have happened or why.
I can say, once again, that we pay the same rates everyone else pays and that, other than some early access to upcoming beta services, we don’t get any preferential treatment that I’m aware of.
Some thoughts, though:
- We expect Amazon to have outages. No website I’m aware of doesn’t, whether it’s Google, Amazon, your bank, or SmugMug.
- I’ve written about Amazon S3 outages in the past, but in the last ~12 months, we’ve only seen a single ~2 minute outage window (on January 22nd, 2008 at around 4:38pm Pacific). We also had one recent fairly major hiccup with EC2.
- Yes, I believe there will probably be times where SmugMug is seriously affected, possibly even offline completely, because Amazon (or some other web services provider) is having problems. Today wasn’t that day. Nobody likes outages, especially not us, but we’ve decided the tradeoffs are worth it. You should have your eyes wide open when you make the decision to use AWS or any other external service, though. It will fail from time to time.
- We’ve done our best to build SmugMug in such a way that we handle failures as gracefully as possible. We can’t cover every case, but I think that the fact that we didn’t experience customer-facing outages today is a testament to that. Again, I want to stress that we do expect Amazon to cause us (rare) outages in the future, and that’s unavoidable, but today we dodged that bullet.
- Amazon’s communication about this has been terrible. It took far too long to acknowledge the problem. Fixing a major problem can take forever, which is understandable, but communicating with your customers should happen very rapidly. Amazon’s culture, internally, is very customer focused, so this is a strange anomaly. I will definitely lean on them some about it, and everyone who was affected should rightfully howl too.
- I’ve asked Amazon repeatedly for an “Amazon Web Services Health” page that shows the current expected state of all their services. Then you can tell at a glance (and even poll and work into your own monitoring) whether any of the services are having problems. Something like Keynote’s Internet Health Report would be a good start, but as Jesse Robbins points out, trust.salesforce.com is the gold standard. This page could also double as a mechanism to let customers know what’s being worked on and current ETAs when there are problems.
I’ll try to post a follow-up about why we weren’t affected when I know more. It’s possible that some of the reasons we survived was due to some of our “secret sauce” and I just won’t be able to say, but I kinda doubt it.
Bottom line: While the outage was certainly a big deal to those affected, I think the bigger deal here is how Amazon handled the outage. They need to communicate better about these mission critical services and their health.
If I didn’t answer any questions you’d like me to answer, please post a comment and/or send me an email. I’ll do my best to respond.
UPDATE 1: I’m not sure why there’s all this confusion, but SmugMug *does* use Amazon as our primary data store. We maintain a small “hot cache” in our datacenters of frequently/recently viewed photos and videos, but there are massive numbers of them that are only at Amazon. This is a change from our initial usage of S3, and the change is based on how reliable they’ve been. Yes, we still consider them to be very reliable even after an outage like this. And yes, I suspect our “hot cache” did at least partially enable us to ride out this issue.