Since FOSDEM we’ve seen even more interest in Matrix than normal, and we’ve been having some problems getting the Matrix.org homeserver to keep up with demand. This has resulted in performance being slightly slower than normal at peak times, but the main impact has been the additional traffic exacerbating outages on the homeserver – either by revealing new failure modes, or making it harder to recover rapidly after something goes wrong.
Specifically: on Friday afternoon we had a service disruption caused by someone sending an unusual event into Matrix HQ. It turns out that both matrix-android-sdk and matrix-ios-sdk based clients (e.g. Riot/Android and iOS) handled this naively by simply resyncing the room state… which has been fine in the past, but not when you have several hundred clients actively syncing the room, and resulted in a thundering herd effect which overloaded the server for ~10 mins or so whilst they all resynced the room (which, in turn, nowadays, involves calculating and syncing several MB of JSON state to each client). The traffic load was then high enough that it took the server a further 10-20 minutes for the server to fully catch up and recover after the herd had dissipated. We then had a repeat performance on Monday morning of the same failure mode.
Similarly, we had disruption last night after a user who hadn’t used the service for ages logged on for the first time and rapidly caught up on a few rooms which literally had *millions* of unread messages in them. Generally this would be okay, but the combination of loaded DB and the sheer number of notifications being deleted ended up with 4 long-running DB deletes in parallel. This seems to have caused postgres to lock the event_actions_table more aggressively than we’d expect, blocking other queries which were trying to access it… causing most requests to block until the deletes were over. At the current traffic volumes this meant that the main synapse process tried to serve thousands of simultaneous requests as they stacked up and ran out of filehandles within about 10 minutes and wedged the whole synapse solid before the DB could unblock. Irritatingly, it turns out our end-to-end monitoring has a bug where it in turn can crash on receiving a 500 from synapse, so despite having PagerDuty all set up and running (and having been receiving pages for traffic delays over the last few weeks)… we didn’t get paged when we got actual failed traffic rather than slow traffic, which delayed resolving the issue. Finally, whilst rolling out a fix this afternoon, we again hit issues with the traffic load causing more problems than we were expecting, making a routine redeploy distinctly more disruptive.
So, what are we doing about this?
- Fix the root causes:
- The ‘android/iOS thundering herd’ bug is being worked on both the android/iOS side (fixing the naive behaviour) and the server side. A temporary mitigation is in now place which moves the server-side code to worker processes so that worst case it can’t take out the main synapse process and can scale better.
- The ‘event_push_actions table is inefficient’ bug had already been fixed – so this was a matter of rushing through the hotfix to matrix.org before we saw a recurrence.
- Move to faster hardware. Our current DB master is a “fast when we bought it 5 years ago” machine whose IO is simply starting to saturate (6x 300GB 10krpm disks in RAID5, fwiw), which is maxing out at around 500IOPS and 20MB/s of random access, and acting as a *very* hard limit to the current synapse performance. We’re currently in the process of evaluating SSD-backed IO for the DB (in fact, we’re already running a DB slave), and assuming this tests out okay we’re hoping to migrate next week, which should give us a 10x-20x speed up on disk IO and buy considerable headroom. Watch this space for details.
- Make synapse faster. We’re continuing to plug away at optimisations (e.g. stuff like this), but these are reaching the point of diminishing returns, especially relative to the win from faster hardware.
- Fix the end-to-end monitoring. This already happened.
- Load-test before deploying. This is hard, as you really need to test against precisely the same traffic profile as live traffic, and that’s hard to simulate. We’re thinking about ways of fixing this, but the best solution is probably going to be clustering and being able to do incremental redeploys to gradually test new changes. On which note:
- Fix synapse’s architectural deficiencies to support clustering, allowing for rolling zero-downtime redeploys, and better horizontal scalability to handle traffic spikes like this. We’re choosing not to fix this in synapse, but we are currently in full swing implementing dendrite as a next-generation homeserver in Golang, architected from the outset for clustering and horizontal scalability. N.B. most of the exciting stuff is happening on feature branches and gomatrixserverlib atm. Also, we’re deliberately taking the time to try to get it right this time, unlike bits of synapse which were something of a rush job. It’ll be a few weeks before dendrite is functional enough to even send a message (let alone finish the implementation), but hopefully faster hardware will give the synapse deployment on matrix.org enough headroom for us to get dendrite ready to take over when the time comes!
The good news of course is that you can run your own synapse today to avoid getting caught up in this operational fun & games, and unless you’re planning to put tens of thousands of daily active users on the server you should be okay!
Meanwhile, please accept our apologies for the instability and be assured that we’re doing everything we can to get out this turbulence as rapidly as possible.
We’re a little late with this, but Synapse 0.19.1 was released last week. The only change is a bugfix to a regression in room state replication that snuck in during the performance improvements that landed in 0.19.0. Please upgrade if you haven’t already. We’ve also fixed the Debian repository to make installing Synapse easier on Jessie by including backported packages for stuff like Twisted where we’re forced to use the latest releases.
You can grab it from https://github.com/matrix-org/synapse/ as always.
Changes in synapse v0.19.1 (2017-02-09)
- Fix bug where state was incorrectly reset in a room when synapse received an event over federation that did not pass auth checks (PR #1892)
FOSDEM this year was even more crazy and incredible than ever – with attendance up from 6,000 to 9,000 folks, it’s almost impossible to describe the atmosphere. Matt Jordan from Asterisk describes it as DisneyWorld for OSS Geeks, but it’s even more than that: it’s basically a corporeal representation of the whole FOSS movement. There is no entrance fee; there is no intrusive sponsorship; there is no corporate presence: it’s just a venue for huge numbers of FOSS projects and their users and communities to come together in one place (the Université Libre de Bruxelles) and talk and learn. Imagine if someone built a virtual world with storefronts for every open source project imaginable, where you could chat to the core team, geek out with other users, or gather in auditoriums to hear updates on the latest projects & ideas. Well, this is FOSDEM… except even better, it’s in real life. With copious amounts of Belgian beer.
Anyway: this year we had our normal stand on the 2nd floor of K building, sharing the Realtime Lounge chill-out space with the XMPP Standards Foundation. This year we had a larger representation than ever before with Matthew, Erik and Luke from the London team as well as Manu & Yannick from Rennes – which is just as well given all 5 of us ended up speaking literally non-stop from 10am to 6pm on both Saturday & Sunday (and then into the night as proceedings deteriorated/evolved into an impromptu Matrix meetup with Coffee, uhoreg, tadzik, realitygaps and others!). The level of interest at the Matrix booth was frankly phenomenal: a major change from the last two FOSDEMs in that this year pretty much everyone had already heard of Matrix, and were most likely to want to enthuse about features and bugs in Synapse or Riot, or geek out about writing new bridges/bots/clients, or trying to work out a way to incorporate Matrix into their own projects or companies.
Synapse 0.19 and Riot 0.9.7 were also released on Saturday to try to ensure that anyone joining Matrix for the best time at FOSDEM were on the latest & greatest code – especially given the performance and E2E fixes present in both. Amazingly the last-minute release didn’t backfire: if you haven’t upgraded to Synapse 0.19 we recommend going so asap. And if you’re a Riot user, make sure you’re on the latest version :)
We were very lucky to have two talks accepted this year: the main one in the Security Track on the Jansen main stage telling the tale of how we added end-to-end encryption to Matrix via Olm & Megolm – and the other in the Decentralised Internet room (AW1.125), focusing on the unsolved future problems of decentralised accounts, identity, reputation in Matrix. Both talks were well attended, with huge queues for the Decentralised Internet room: we can only apologise to everyone who queued for 20+ minutes only to still not be able to get in. Hopefully next year FOSDEM will allocate a larger room for decentralisation! On the plus side, this year FOSDEM did an amazing job of videoing the sessions – livestreaming every talk, and automatically publishing the recordings (via a fantastic ‘publish your own talk’ web interface) – so many of the people who couldn’t get into the room (as well as the rest of the world) were able to watch it live anyway by the stream.
You can watch the video of the talks from the FOSDEM website here and here. Both talks necessarily include the similar exposition for folks unfamiliar with Matrix, so apologies for the duplication – also, the “future of decentralised communication” talk ended up a bit rushed; 20 minutes is not a lot of time to both explain Matrix and give an overview of the challenges we face in fixing spam, identity, moderation etc. But if you like hearing overenthusiastic people talking too fast about how amazing Matrix is, you may wish to check out the videos :) You can also get at the slides as PDF here (E2E Encryption) and here (Future of Decentralisation).
Huge thanks to evevryone who came to the talks or came and spoke to us at the stand or around the campus. We had an amazing time, and are already looking forward to next year!
Matthew & the team
We’re happy to announce the release of Synapse 0.19.0 (same as 0.19.0-rc4) today, just in time for anyone discovering Matrix for the first time at FOSDEM 2017! In fact, here’s Erik doing the release right now (with moral support from Luke):
This is a pretty big release, with a bunch of new features and lots and lots of debugging and optimisation work following on some of the dramas that we had with 0.18 over the Christmas break. The biggest things are:
- IPv6 Support (unless you have an IPv6 only resolver), thanks to contributions from Glyph from Twisted and Kyrias!
- A new API for tracking the E2E devices present in a room (required for fixing many of the remaining E2E bugs…)
- Rewrite the ‘state resolution’ algorithm to be orders of magnitude more performant
- Lots of tuning to the caching logic.
If you’re already running a server, please upgrade! And if you’re not, go grab yourself a brand new Synapse from Github. Debian packages will follow shortly (as soon as Erik can figure out the necessary backporting required for Twisted 16.6.0)
And here’s the full changelog…
No changes since RC 4.
Changes in synapse v0.19.0-rc4 (2017-02-02)
- Bump cache sizes for common membership queries (PR #1879)
Changes in synapse v0.19.0-rc3 (2017-02-02)
- Fix email push in pusher worker (PR #1875)
- Make presence.get_new_events a bit faster (PR #1876)
- Make /keys/changes a bit more performant (PR #1877)
Changes in synapse v0.19.0-rc2 (2017-02-02)
- Include newly joined users in /keys/changes API (PR #1872)
Changes in synapse v0.19.0-rc1 (2017-02-02)
- Add support for specifying multiple bind addresses (PR #1709, #1712, #1795, #1835). Thanks to @kyrias!
- Add /account/3pid/delete endpoint (PR #1714)
- Add config option to configure the Riot URL used in notification emails (PR #1811). Thanks to @aperezdc!
- Add username and password config options for turn server (PR #1832). Thanks to @xsteadfastx!
- Implement device lists updates over federation (PR #1857, #1861, #1864)
- Implement /keys/changes (PR #1869, #1872)
- Improve IPv6 support (PR #1696). Thanks to @kyrias and @glyph!
- Log which files we saved attachments to in the media_repository (PR #1791)
- Linearize updates to membership via PUT /state/ to better handle multiple joins (PR #1787)
- Limit number of entries to prefill from cache on startup (PR #1792)
- Remove full_twisted_stacktraces option (PR #1802)
- Measure size of some caches by sum of the size of cached values (PR #1815)
- Measure metrics of string_cache (PR #1821)
- Reduce logging verbosity (PR #1822, #1823, #1824)
- Don’t clobber a displayname or avatar_url if provided by an m.room.member event (PR #1852)
- Better handle 401/404 response for federation /send/ (PR #1866, #1871)
- Fix ability to change password to a non-ascii one (PR #1711)
- Fix push getting stuck due to looking at the wrong view of state (PR #1820)
- Fix email address comparison to be case insensitive (PR #1827)
- Fix occasional inconsistencies of room membership (PR #1836, #1840)
- Don’t block messages sending on bumping presence (PR #1789)
- Change device_inbox stream index to include user (PR #1793)
- Optimise state resolution (PR #1818)
- Use DB cache of joined users for presence (PR #1862)
- Add an index to make membership queries faster (PR #1867)
As many will have noticed there was a major outage on the Matrix homeserver for matrix.org last night (UK-time). This impacted anyone with an account on the matrix.org server, as well as anyone using matrix.org-hosted bots & bridges. As Matrix rooms are shared over all participants, rooms with participants on other servers were unaffected (for users on those servers). Here’s a quick explanation of what went wrong (times are UTC):
- 2017-01-24 16:00 – We notice that we’re badly running out of diskspace on the matrix.org backup postgres replica. (Turns out the backup box, whilst identical hardware to the master, had been built out as RAID-10 rather than RAID-5 and so has less disk space).
- 2017-01-24 17:00 – We decide to drop a large DB index:
event_push_actions(room_id, event_id, user_id, profile_tag), which was taking up a disproportionate amount of disk space, on the basis that it didn’t appear to be being used according to the postgres stats. All seems good.
- 2017-01-24 ~23:00 – The core matrix.org team go to bed.
- 2017-01-24 23:33 – Someone redacts an event in a very active room (probably #matrix:matrix.org) which necessitates redacting the associated push notification from the event_push_actions table. This takes out a lock within persist_event, which is then blocked on deleting the push notification. It turns out that this deletion requires the missing DB constraint, causing the query to run for hours whilst holding the transaction lock. The symptoms are that anything reading events from the DB was blocked on the transaction, causing messages not to be relayed to other clients or servers despite appearing to send correctly. Meanwhile, the fact that events are being received by the server fine (including over federation) makes the monitoring graphs look largely healthy.
- 2017-01-24 23:35 – End-to-end monitoring detects problems, and sends alerts into pagerduty and various Matrix rooms. Unfortunately we’d failed to upgrade the pageduty trial into a paid account a few months ago, however, so the alerts are lost.
- 2017-01-25 08:00 – Matrix team starts to wake up and spot problems, but confusion over the right escalation process (especially with Matthew on holiday) means folks assume that other members of the team must already be investigating.
- 2017-01-25 09:00 – Server gets restarted, service starts to resume, although box suffers from load problems as traffic tries to catch up.
- 2017-01-25 09:45 – Normal service on the homeserver itself is largely resumed (other than bridges; see below)
- 2017-01-25 10:41 – Root cause established and the redaction path is patched on matrix.org to stop a recurrence.
- 2017-01-25 11:15 – Bridges are seen to be lagging and taking much longer to recover than expected. Decision made to let them continue to catch up normally rather than risk further disruption (e.g. IRC join/part spam) by restarting them.
- 2017-01-25 13:00 – All hosted bridges returned to normal.
Obviously this is rather embarrassing, and a huge pain for everyone using the matrix.org homeserver – many apologies indeed for the outage. On the plus side, all the other Matrix homeservers out there carried on without noticing any problems (which actually complicated spotting that things had broken, given many of the core team primarily use their personal homeservers).
In some ways the root cause here is that the core team has been focusing all its energy recently on improving the overall Matrix codebase rather than operational issues on matrix.org itself, and as a result our ops practices have fallen behind (especially as the health of the Matrix ecosystem as a whole is arguably more important than the health of a single homeserver deployment). However, we clearly need to improve things here given the number of people (>750K at the last count) dependent on the Matrix.org homeserver and its bridges & bots.
Lessons learnt on our side are:
- Make sure that even though we had monitoring graphs & thresholds set up on all the right things… monitoring alerts actually have to be routed somewhere useful – i.e. phone calls to the team’s phones. Pagerduty is now set up and running properly to this end.
- Make sure that people know to wake up the right people anyway if the monitoring alerting system fails.
- To be even more paranoid about hotfixes to production at 5pm, especially if they can wait ’til the next day (as this one could have).
- To investigate ways to rapidly recover bridges without causing unnecessary disruption.
Apologies again to everyone who was bitten by this – we’re doing everything we can to ensure it doesn’t happen again.
Matthew & the team.