Personal Workflow Blog

Waiting for Munin 2.0 - Native SSH transport

Steve Schnepp — Mon, 12 Jul 2010 14:11:00 +0200

In the munin architecture, the munin-master has to connect to the munin-node via a very simple protocol and plain TCP.

This has several advantages :

Very simple to manage & install
Optional SSL since 1.4 enabling secure communications
Quite simple firewall rules.

It has also some disadvantages :

A new listening service means a wider exposure
The SSL option might add some administrative overhead (certificates management, ...)
A native protocol isn't always covered by all firewall solutions
Some organisations only authorize a few protocols to simplify audits (ex: only SSH & HTTPS)

Native SSH

Theses down points may be solved by encapsulation over SSH, but it can be a tedious task to maintain if the number of hosts increases.

Therefore 2.0 introduces the concept of a native SSH transport. Its usage is dead simple : replace the address with an ssh:// URL-like one.

The node still has to be modified to communicate with stdin/stdout instead of a network socket. For now, only pmmn and munin-async are able to provide such a node.

Configuration

The URL is quite self-explanatory as shown in the example below :

[old-style-host]
    address host.example.com

[new-style-host]
    address ssh://munin-node-user@host.example.com:/path/to/stdio-enabled-node --params

Installation notes

Authentication should be done without password but via SSH keys. The connection is from munin-user@host-munin to munin-node-user@remote-node.

If you use munin-async, the user on the remote node might only be a readonly one, since it only needs to read spooled data. This implies that you use --spoolfetch and not --vectorfetch that updates the spool repository.

Upcoming HTTP(S) transport in 3.0

And the sweetest part is that since all the work has been done for adding another transport, adding a CGI-based HTTP transport one is possible (and therefore done) for 3.0.

Waiting for Munin 2.0 - Performance - Asynchronous updates

Steve Schnepp — Sat, 26 Jun 2010 16:07:00 +0200

munin-update is the fragile link in the munin architecture. A missed execution means that some data is lost.

The problem : updates are synchronous

In Munin 1.x, updates are synchronous : the value of each service^[1] is the one that munin-update retrieves each scheduled run.

The issue is that munin-update has to ask every service on every node for their values. Since the values are only computed when asked, munin-update has to wait quite some time for every value.

This very simple design enables munin to have the simplest plugins : they are completely stateless. While being one great strength of munin, it puts a severe blow on scalability : more plugins/node means obviously a slower retrieval.

Evolving Solutions

1.4 : Parallel Fetching

1.4 addresses some of these scalability issues by implementing parallel fetching. It takes into account that the most of the execution time of munin-update is spent waiting for replies. In 1.4 munin-update can ask max_processes nodes in parallel.

Now, the I/O part is becoming the next limiting factor, since updating many RRDs in parallel is the same as random I/O access for the underlying munin-master OS. Serializing & grouping the updates will be possible with the new RRDp interface from rrdtool version 1.4 and on-demand graphing. Tomas Zvala even offered a patch for 1.4 RRDp on the ML. It is very promising, but doesn't address the root defect in this design : a hard dependence of regular munin-update runs.

2.0 : Stateful plugins

2.0 provides a way for plugins to be stateful. They might schedule their polling themselves, and then when munin-update runs, only emit collect already computed values. This way, a missed run isn't as dramatic as it is in the 1.x series, since data isn't lost. The data collection is also much faster because the real computing is done ahead of time.

2.0 : Asynchronous proxy node

But changing plugins to be stateful and self-polled is difficult and tedious. It even works against of one of the real strength of munin : having simple & stateless plugins.

To address this concern, an experimental proxy node is created. For 2.0 it takes the form of a couple of processes : munin-async-server and munin-sync-client.

The proxy node in detail (`munin-async`)

Overview

These 2 processes form an asynchronous proxy between munin-update and munin-node. This avoids the need to change the plugins or upgrade munin-node on all nodes.

munin-async-server should be installed on the same host than the proxied munin-node in order to avoid any network issue. It is the process that will poll regularly munin-node. The I/O issue of munin-update is here non-existent, since munin-async stores all the values by simply appending them in a text file without any further processing. This file is later read by the client's munin-update, and it will be processed there.

Specific update rates

Having one proxy per node enables a polling of all the services there with a specific update rate.

To achieve this, munin-async-server forks into multiple processes, one for each proxied service. This way each service is completely isolated from the other, and therefore is able to have its own update rate, is safe from other plugins slowdowns, and it does even completely parallelize the information gathering.

SSH transport

munin-async-client uses the new SSH native transport of 2.0. It permits a very simple install of the async proxy.

Notes

[1] in 1.2 it's the same as plugin, but since 1.4 and the introduction of multigraph, one plugin can provide multiple services.

CGI on steroids with FastCGI, but on a CGI-only server - The FastCGI wrapper

Steve Schnepp — Mon, 21 Jun 2010 22:22:00 +0200

FastCGI is really CGI on steroids

FastCGI is very common way to increase performance of a CGI installation. It is based on the fact that usually the startup of CGI scripts is slow, whereas the response is quite fast.

So if you have a persistent process, you only have to take care of the startup once, and you then experience a real speedup.

FastCGI vs mod_perl (or mod_python, ...)

Once a big fan of mod_perl, I'm converted to FastCGI since. mod_perl was for a long time the answer for speeding up Perl CGI scripts. It has a very good track record of stability and has real hooks deep in the Apache processing requests.

FastCGI focuses on a different feature set that is more actual than mod_perl^[1] :

It is much simpler to install and configure, especially when having multiple applications.
Able to connect to a distant server (running as a different UID, chrooted or even on a remote host)
Able to mix scripting languages without any need to compile some other apache modules.
Able to be used with several webservers, even closed-source ones : FastCGI is a protocol, not an API.

But steroids do have some side effects

CGI issues

One downside is that your CGI script should be adapted to FastCGI and the fact that the script doesn't end with the end of the request.

In the real world that's quite easy. Every language that is commonly used for CGI offers CGI-wrapper libraries that works in a FastCGI context as well as a plain CGI one.

Webserver issues

Another issue can also come from the webserver. Since CGI is dead simple to implement even the micro-webserver thttpd implements it.

FastCGI on the other hand is a little more difficult to implement, since the webserver needs to create a container that monitors and calls the FastCGI-enabled script.

A standalone FastCGI container

Fortunately, the FastCGI team provided us with a ready-to-use container and a very simple client that acts a plain CGI script, but proxies it to a full-blown container.

Since the plain CGI part is a very small native executable its overhead is negligible compared to the reply time, even without comparison with the startup time of the whole script.

Its installation is also quite straightforward. I just installed the libfcgi package on Debian : it provides /usr/bin/cgi-fcgi.

I created a simple CGI wrapper for my previous munin benchmarking needs :

#! /bin/sh

exec /usr/bin/cgi-fcgi -connect /tmp/munin-cgi.sock \
     /usr/lib/cgi-bin/munin-cgi-graph

Notes

[1] who really need deep apache hooks ?

Waiting for Munin 2.0 - Performance - FastCGI

Steve Schnepp — Wed, 16 Jun 2010 23:25:00 +0200

1.2 has CGI, it is slow, unsupported, but it does exist.

1.4 has even an experimental FastCGI install mode.

Quoting from this page :

This is more a proof of concept than a recommended - it's slow. Also we do not test it before every release

In 2.0 lots of work has been done to take this experimental CGI mode into a supported one. It might even be the primary way of using munin since, when an install has a certain size, CGI becomes mandatory.

That's because munin-graph doesn't have time to finish its job when the next one is launched, and the new one doesn't run. It is not as dramatic as a missed munin-update execution, since the graphs will still be generated on the later round, but there will be random graph lags and it will put quite some stress on the CPU & I/O subsystem. This will slow munin-update down since it also uses the I/O subsystem much, and that's to be avoided at all costs.

Mainstream CGI has some consequences :

Only the FastCGI wrapper remained : the plain CGI one is dropped.
- The CPAN module CGI::Fast is compatible when launched as a normal CGI.
- Almost all HTTP servers support plain CGI, and with the cgi-fcgi wrapper from the FastCGI devkit (Debian package libfcgi), you can have the best of both worlds (a custom HTTP server & FastCGI). I even posted on how to have a working thttpd with FastCGI.
The old process limit mechanism is dropped also. The FastCGI server configuration is a much better way to control it. The old code was based on System V semaphores and was not 100% reliable.
A caching system has to be implemented, in order for each graph to be generated only once for its lifetime.
The CGI process is launched with the HTTP server user. Since it doesn't only read now, but also writes log files and images files, there is an extra step when installing it. But it's already described in the Munin CGI page given previously.
Since the process is launched only once, for now it read only once the config. So if some part of the config change, the FastCGI container MUST be restarted.

Some benchmarks

Now, the sweet part : I'm putting up some micro-benchmarks.

They should be taken with caution as every benchmark should be, but I think the general idea is conveyed. For the sake of simplicity I'm only doing 1 request in parallel and disabled IMS caching.

Basic 1.2 CGI

$ httperf --num-conns 10  --add-header='Cache-Control: no-cache\n' \
    --uri  /cgi-bin/munin-cgi-graph/localdomain/localhost.localdomain/cpu-day.png

Total: connections 10 requests 10 replies 10 test-duration 27.939 s

Connection rate: 0.4 conn/s (2793.9 ms/conn, <=1 concurrent connections)
Connection time [ms]: min 1653.9 avg 2793.9 max 5217.0 median 1912.5 stddev 1487.8
Connection time [ms]: connect 0.0
Connection length [replies/conn]: 1.000

Request rate: 0.4 req/s (2793.9 ms/req)
Request size [B]: 131.0

1.4 FastCGI

The munin-fastcgi-graph is only loaded once, but the munin-graph is reloaded each time.

$ httperf --num-conns 10  --add-header='Cache-Control: no-cache\n' \
    --uri  /cgi-bin/munin-fastcgi-graph/localdomain/localhost.localdomain/cpu-day.png

Total: connections 10 requests 10 replies 10 test-duration 13.807 s

Connection rate: 0.7 conn/s (1380.7 ms/conn, <=1 concurrent connections)
Connection time [ms]: min 1141.3 avg 1380.7 max 1636.1 median 1381.5 stddev 173.7
Connection time [ms]: connect 0.0
Connection length [replies/conn]: 1.000

Request rate: 0.7 req/s (1380.7 ms/req)

The response time is cut almost in half. That's expected, since only the top half of the processing isn't reloaded.

2.0 FastCGI

Here everything is loaded once.

$ httperf --num-conns 10  --add-header='Cache-Control: no-cache\n' \
    --uri  /cgi-bin/munin-cgi-graph-2.0/localdomain/localhost.localdomain/cpu-day.png

Total: connections 10 requests 10 replies 10 test-duration 1.668 s

Connection rate: 6.0 conn/s (166.8 ms/conn, <=1 concurrent connections)
Connection time [ms]: min 123.0 avg 166.8 max 513.4 median 127.5 stddev 121.9
Connection time [ms]: connect 0.0
Connection length [replies/conn]: 1.000

Request rate: 6.0 req/s (166.8 ms/req)

Now response time is cut almost by a ten factor ! That's quite good news, since it goes 20 times faster that the original CGI.

Waiting for Munin 2.0 - Performance - Architecture

Steve Schnepp — Thu, 10 Jun 2010 03:48:00 +0200

A little intro/refresh on munin's architecture on the master

Munin has a very simple architecture on the master : munin-cron is launched via cron every 5 minutes. Its only job is to launch in order munin-update, munin-graph, munin-html & munin-limits.

The various processes

munin-update

This process retrieves the values from the various nodes and to update the rrd files. This one should never take more than 5 minutes to run, otherwise there will be gaps since the next update will not be launched (lockfile-protected runs).

This process stresses the I/O on the master, and depends on the plugins execution time on the various nodes. On 1.4 the retrieval is multi-threaded^[1], so an slow node doesn't impact too much the whole process.

2.0 proposes asynchronous updates and vectorized updates.

munin-graph

This process generates all the image files from the rrd files.

It is usually a process that is quite CPU-bound, it generates also a fair load of I/O. Since 1.4 there might also be a parallel graphing generation in order to take advantage of multiple CPU / multiple I/O paths.

A simple optimization is to generate only needed graphs instead of all of them each time. This leads to CGI-generation of graphs. 1.2 & 1.4 took a first step in this direction, but it's quite a hack since it's only a very basic script that calls munin-update with the correct parameters.

A FastCGI port of the wrapper (munin-cgi-graph) removes the overhead of starting the wrapper for each call, but in 1.4 the code is quite experimental and has some serious bugs that would need extensive patching to be fixed.

2.0 completes the integration of CGI graphing with removing the overhead of calling munin-graph and does this extensive patching for bugs fixing

munin-html

This process generates all the html files from the rrd files. This one is quite fast for now.

munin-limits

This process checks the limits to see if there is a warning/alert to send via mail or nagios. This one is also quite fast for now.

Notes

[1] more multi-process actually

Waiting for Munin 2.0 - Introduction

Steve Schnepp — Tue, 08 Jun 2010 22:30:00 +0200

This is the first article of a series about the coming version 2.0 of Munin.

The idea came from the series Waiting from 8.5 about PostgreSQL.

The ironic part is that their 8.5 release has become a 9.0, just like our 1.5 will be a 2.0.

I'll post several small articles about new or enhanced-enough features. They will all be tagged munin20.

Planned summary :

Performance - Architecture context
Performance - FastCGI
Performance - Asynchronous updates
Performance - Misc
Native SSH transport
Custom data retention plans (keep more data)
Dynamic zooming

Don't use Excerpt... At least with DotClear.

Steve Schnepp — Thu, 01 Apr 2010 08:00:00 +0200

DotClear automatically generates a meta description tag from the blog entry, but it doesn't take the excerpt into account.

It just takes the beginning of the article content. Since the excerpt is also shown at the beginning of the article, I cannot just write 2 times the same content.

meta description is quite interesting since it is usually used for the little snipped under a search result in usual search engines, so having the beginning of the post in here is very nice.

This fact annihilates the good point of having excerpts.

I'm now falling back to removing progressively all the excerpts on my posts...

API Design: Avoid hidden costs of simple features

Steve Schnepp — Wed, 31 Mar 2010 21:00:00 +0200

Programmers are usually like water : they always use the path of least resistance.

Let's see how to use this fact to predict the usage of an API when you design it.

Initial API

Consider the very simple DB API that consumes a connected ResultSet and presents a disconnected version of it.

class DisconnectedResultSet{
        public DisconnectedResultSet (ResultSet rs);
        public boolean next();
        public Object getObject(int col_idx);
}

It's usage is quite easy :

while (drs.next()) {
        int col_idx = 1;
        drs.getObject(col_idx++); // Do something w/ 1st col
        drs.getObject(col_idx++); // Do something w/ 2st col
        //...
}

Just a little evolution...

Since the DisconnectedResultSet is disconnected, we can imagine that it should implement a rewind() method in order to use it several times without running the initial query again. We now have an updated class :

class DisconnectedResultSet{
        public DisconnectedResultSet (ResultSet rs);
        public boolean next();
        public Object getObject(int col_idx);   
        public void rewind(); // Be able to rewind it
}

And its classical usage :

while (drs.next()) {
        // do stuff...
}
// ...
drs.rewind();
while (drs.next()) {
        // do something else with the same data...
}
// ...
drs.rewind();
while (drs.next()) {
        // do something else with the same data...
}
// ...

A new need comes

A new need comes : see if the DisconnectedResultSet is empty or not in order to avoid sending header.

The usual way is to send them once when iterating like :

boolean is_headers_sent = false;
while (drs.next()) {
        if (! is_headers_sent) { 
                send_headers(); 
                is_headers_sent = true;
        }
        // do something else with the same data...
}

But since there is a nice rewind()method, just waiting to be used, the code might become :

if (drs.next()) {
        send_headers(); 
}
drs.rewind();
while (drs.next()) {
        // do something else with the same data...
}

Now, this code isn't generic anymore to accommodate a connected ResultSet.

So, as John Carmack said :

The cost of adding a feature isn't just the time it takes to code it. The cost also includes the addition of an obstacle to future expansion.

That's really true when you design APIs since their purpose is to last long and to be extended.

So, think twice when you propose an extension "just in case".

The little evolution, revisited...

To solve this case, don't propose a rewind() method, but offer a duplicate() one. It offers the same functionality, just in a new object.

The usage will be almost the same as shown below, but since it feels more performance-sensitive, it won't be used as lightly : the boolean is_headers_sent pattern has now more chances to be used.

while (drs.next()) {
        // do stuff...
}
// ...
drs = drs.duplicate();
while (drs.next()) {
        // do something else with the same data...
}
// ...
drs = drs.duplicate();
while (drs.next()) {
        // do something else with the same data...
}
// ...

It's an other example that immutable objects are the way to go, but for a different reason this time.

Note: Just finished my March 2010 article, even on time... I'm still trying to keep at least a one article per month blogging rate. So far so good for 2010, still 9 months to go !

Free Exception lunch : Use unchecked exceptions, but still announce which ones you might throw.

Steve Schnepp — Sat, 20 Feb 2010 16:01:00 +0100

In a previous article I choosed my side : Unchecked Exceptions are much simpler to use.

But, on the other side of this great division, there is a very valid point : You usually declare checked exceptions. Sure it's possible to only declare to throw Exception, but that would defeat the whole purpose of using checked exceptions.

The nicest thing is that you can also have a custom exception hierarchy, but based on RuntimeException instead of a plain Exception. This way it's like in C++. Everything might be thrown, and you don't need to handle them.

Declaring them, on the other side, is very interesting because you are documenting your interface for almost free.

So, use unchecked exceptions to free yourself of the checked catch-slavery, but still declare the custom ones you might throw.

Immutability of an URL

Steve Schnepp — Sat, 20 Feb 2010 15:18:00 +0100

In the pure spirit of Data is King I think that URL should never change. Even the W3C agrees with their Cool URIs don't change article.

But we all know that in IT never is only not in the foreseen future. So URL do change, at least after a while, and usually for technical reasons^[1].

Since you can update your website to update the URLs, but the inbound link cannot be easily updated. To handle this need, the HTTP protocol has specified the 301 response code.

The solution is that the site should remember all the urls that it generated and redirects accordingly. This way you'll never loose a potential reader to the infamous 404 (this page does not exist).

Some sites even try to approximate the page on a custom 404 page. That's another reason to have user-friendly urls : to be able to hint your reader to appropriate pages in case you don't find his initial destination.

Sadly, this redirect behavior isn't supported by my blog engine (dotclear)... That's for the eat your own dog's food, but I'm looking forward to do it on my current blogging platform.

Notes

[1] upgrade to another blog engine...

Avoid the Preprocessor : Use ''Compile-Time Polymorphism'' for Cross-platform Development

Steve Schnepp — Fri, 11 Dec 2009 23:00:00 +0100

When writing portable cross-platform code, don't litter your code with preprocessor macros, use compile-time polymorphism instead.

A flexible build system will enable you to use advanced OOP-like compile-time polymorphism. That way you can hide all the specifics of the different platform behind an interface firewall. It is the usual way that most cross-platform toolkits and frameworks (such as QT, GTK or wxWidgets) are designed.

We'll take a very simple file I/O subsystem here as an example (open, close). We'll also only take Linux and Windows, since that's usually the 2 most common platforms people want to develop for^[1].

The usual abstraction with the preprocessor

Usually preprocessor #ifdefs are used to compile specific parts for the underlying OS.

The file fileiosys.cpp looks^[2] like the one below :

fileiosys_filedesc open(char* filename) {
#ifdefine __WIN32__
    return OpenFile(
        filename, 
        GENERIC_READ | GENERIC_WRITE, 
        FILE_SHARE_READ | FILE_SHARE_WRITE, 
        NULL,
    );  
#else // UNIX
    return open(filename, O_READ | O_WRITE, 0666);
#endif
}

int close (fileiosys_filedesc fd) {
#ifdefine __WIN32__
    return CloseHandle(fd) ? 0 : -1;
#else // UNIX
    return close(fd);
#endif
}

The header fileiosys.h looks then like :

// Define a custom file descriptor
#ifdefine __WIN32__
    #define fileiosys_filedesc HANDLE
#else // UNIX
    #define fileiosys_filedesc int
#endif

fileiosys_filedesc open(char* filename); 
int close(fileiosys_filedesc fd);

Avoid the preprocessor Compile-time polymorphism

As the previous little example, the code isn't really easy to read. You have to always think which environnement you are in. All the specifics are multiplexed in the same file, and the programmer has to always demultiplex it in real time each time he reads the code.

The last part of the interface file is quite simple to read since it's already abstracted away. Now let's completely demultiplex the implementation in several implementation files.

The header file is the common interface

The interface is the most important part of the design. It should be high-level enough to mask the differences between the plateforms you want to support, but not too high-level, otherwise you'll end up duplicating to much code.

So, for our file I/O subsystem, we'll just abstract the usual syscalls open, close in the same way as before.

The parameters that are passed through the interface are also very important. You cannot usually leak a platform-specific structure. So here all the file descriptors are just an opaque handle, represented by a pointer to a structure defined only as a forward declaration in the header. This pattern, sometimes called the pimpl idiom, enables use to really share the representation while implementing it differently.

The header file is preserved as fileiosys.h, whereas the implementation is in the files linux/fileiosys.cpp and win32/fileiosys.cpp

`fileiosys.h`

// Define the forward declaration
struct fis_filedesc;
fis_filedesc* open(char* filename); 
int close(fileiosys_filedesc* fd);

`win32/fileiosys.cpp`

struct fis_filedesc {
    HANDLE handle;
};

fis_filedesc* open(char* filename) {
    fis_filedesc* fd = new fis_filedesc();
    fd->handle = OpenFile(
        filename, 
        GENERIC_READ | GENERIC_WRITE, 
        FILE_SHARE_READ | FILE_SHARE_WRITE, 
        NULL,
    );  

    return fd;
}

int close (fis_filedesc* fd) {
    int retval = CloseHandle(fd->handle) ? 0 : -1;
    delete(fd);
    return retval;
}

`linux/fileiosys.cpp`

struct fis_filedesc {
    int file_descriptor;
};

static fis_filedesc[32];

fis_filedesc* open(char* filename) {
    fis_filedesc* fd = new fis_filedesc();
    fd->file_descriptor = open(filename, O_READ | O_WRITE, 0666);
    return fd;
}

int close (fis_filedesc* fd) {
    int retval = close(fd);
    delete(fd);
    return retval;
}

The build system : `Makefile`

The makefile should take into account the different platforms, and only compile the needed implementation file. All the gluing magic will then be done at linking time instead of preprocessor time.

Conclusion

The interest of have multiple implementation files is obvious. It is much more straightforward to read and only marginally harder to write. But since most of the time code is read and not written, the choose is quite a no-brainer.

The nicest part is that all this is possible even without the expensive run-time polymorphism and RTTI, since the choose is done at compile-time.

Notes

[1] actually when targeting Linux, you usually target all Unix-like systems since they already have POSIX as a common abstraction

[2] The code is not real, it has been sweetened

Native SSH transport for Munin

Steve Schnepp — Thu, 26 Nov 2009 22:00:00 +0100

I blogged about the munin monitoring system a while ago.

The fact the Munin team did quite a remarkable job in cleaning up the 1.2 code for the 1.4 release enabled me to add a native SSH transport for Munin, and made be able to get rid of all SSH tunnels.

Actually the tunnel won't disappear, but they will be launched only when needed and, most importantly configured in munin.conf.

The native ssh for munin patch should applies quite cleanly on revision 3101 of the svn trunk.

Its use is quite straightforward : in /etc/munin/munin.conf, you just migrate address to the new configuration directive remote_connection_cmd that take the whole ssh command to launch a stdio munin-node such as pmmn.

If we take the examples from the previous post, it becomes clear it's much easier to configure.

munin.conf snippet - Inetd version

[server1]
    address localhost
    port 7001
[server2]
    address localhost
    port 7002

munin.conf snippet - Native SSH transport version

Right now, the address directive is still mandatory, but ignored when connecting.

[server1]
    address dummy
    remote_connection_cmd /usr/bin/ssh -- supusr@server1 /home/suprusr/pmmn/pmmn.pl
[server2]
    address dummy
    remote_connection_cmd /usr/bin/ssh -- supusr@server2 /home/suprusr/pmmn/pmmn.pl

Warning

Beware that the ssh process will now be launched by the munin user, so you have to update the key-based SSH authentication accordingly.

Sed is much slower than Perl, or not...

Steve Schnepp — Sat, 14 Nov 2009 12:18:00 +0100

I wanted to do some text replacement with a huge file (think ~18GiB), filled with huge lines (think ~2MiB per ligne)^[1].

I naïvely piped it through sed and I was quite shocked that it was CPU bound, and not I/O bound. The average rate was about 5 MiB/s (measured with pv, and the CPU was at almost 100%.The text file was gzipped on the filesystem, but with a 1/100 ratio, so the gzip process just took less than 2% CPU. I replaced then the sed -e with the Perl one-liner perl -lnpe, and .... tadaa, it was flying at a rate of 50MiB/s !

While I'm a big fan of Perl, and know its effectiveness to handle text streams, I'm was still astonished : being 10x faster than sed was something.

But in the good old saying Too good to be true means suspect, I remembered something about the character encoding of the regular expression. Since the system is entirely configured in UTF8, I suspected the infamous UTF8 overhead over plain ASCII.

I was right : a little LANG=C in front of the sed command line restored the rate to 50MiB/s.

So, beware of the performance impact of UTF8 strings, and try to avoid it if you can.

Notes

[1] For the record, it was a MySQL dump

Quickly replicate the clock between remote hosts with SSH

Steve Schnepp — Fri, 11 Sep 2009 08:00:00 +0200

NTP is very handy for server clock synchronisation, but it can be cumbersome to deploy.

Sometimes you just need to do a one-shot clock synchronisation, so you use the standard date command. But there isn't a flag to easily copy a setting to another.

From a remote host

Quite easy :

# date `ssh remoteuser@remotehost date +%m%d%H%M%Y.%S`

To a remote host

It's also very easy^[1] :

# ssh root@remotehost date `date +%m%d%H%M%Y.%S`

Notes

[1] Yes, I do know that logging remotely as root is a security pitfall...

Databases: Efficient Case-insensitive searches with Function-based Indexing

Steve Schnepp — Tue, 08 Sep 2009 22:00:00 +0200

Doing a case insensitive search is a very common task, but is quite hard to optimize correctly. But since it's done via a UPPER(MY_COLUMN) = UPPER('MY_DATA'), it doesn't use the index that could be on MY_COLUMN.

Different RDMS means different approaches.

Special case of case-insensitive search

In Oracle10g, you might use the new case-insensitive search with a NLS_SORT=BINARY_CI command.

Pro

Designed for this purpose, so it's very straightforward to use

Con

Limited to case-insensitive searching by design

Native functional indexes

Some databases provides native functional indexes.

On these databases optimization is done simply by creating an index on UPPER(MY_COLUMN) and letting the query optimizer transparently^[1] use the newly created index.

It usually work by applies a function to the data just before handing it to the index, so the function output doesn't exist in the database.

Pro

Very easy to use : it just feels right (you can naïvely create an index on the WHERE clause)
Doesn't take any extra space in the database (only the index).
Generic, can be used for something else than just case-insensitive searches.

Con

Since the data isn't stored in the database, a call to the function has to be made when
Functions have to be from the immutable category in the function volatility categories

Generated columns

DB2 provides something called generated columns. It's almost the same than the native indexes, except that the functional column is explicit.

Pro

Quite easy to use, since the column is updated and used transparently.
Generic, can be used for something else than just case-insensitive searches. Just make sure the optimizer uses the extra column. You might have to rewrite the request a little.

Con

Requires extra space in the table.
Removing a column can be cumbersome (in DB2 you have to recreate the whole table for example), whereas removing a simple index is much easier.
The extra column is returned when doing a SELECT * FROM ...^[2].

Trigger-based Generated columns Emulation

If nothing else is provided, you always have the option to emulate. The solution will be trigger-based since it's one of the few perfect match for them.

So, the base idea is derived from the Generated columns : have a special extra column that represents the output of the function. An index will be created on this column and used via a manual update of the involved requests (Adding an extra WHERE clause should be more than enough, this way you might even benefit from a partial match).

Pro

Universal. Useful if portability is paramount.
Very simple : there is no need to understand advanced database features.

Con

Only a poor man's solution : everything is manual
The same than Generated columns since it's the same idea, just manually implemented.

Notes

[1] You might have to update some kind of statistics for the new index

[2] But you don't do that anyway, do you ?

Overloading a method is hard : a common pitfall

Steve Schnepp — Mon, 07 Sep 2009 22:00:00 +0200

As I said in my equality article, overloading in Java^[1] is resolved by the static type of the argument, not the run-time type.

It's a generic problem of most compiled OO languages since usually overloading resolution happens at compile-time and not at runtime.

Now, that militates for the well known idiom :

Never overload a method with one that has the same number of parameters.

Actually, it should be enough to overload a method with one that accept parameters that are not inheritance-related : String and Number would be OK, but MyClass and Object would not.

Notes

[1] It's not really a Java-ism, it's the same in other languages, such as C++ .

A Simple Dns Server for a SOHO Network

Steve Schnepp — Mon, 10 Aug 2009 20:00:00 +0200

I'm in search of a very simple DNS Server for a small network. It should be :

recursive & caching (can be used as a proxy)
very simple administration (parsing /etc/hosts would be perfect, raw DNS zones like BIND would be a little bit overkill)
quite lightweight (aka no dependency on an SQL engine like MySQL, such as MyDNS)
Seamless integration to Windows lookups (nmblookup) via proxying functions (DNS to/from NMB)

Databases: Better Defer Constraints than Avoid Them

Steve Schnepp — Fri, 31 Jul 2009 08:00:00 +0200

Constraints are considered a Good Thing. They enable to rely more heavily on the validity of the database. It is quite important to note that validity is in terms of modeling and not in terms of business ^[1].

The biggest complains we can have about constraints is that it is sometimes quite annoying to do some updates while consistently validating the constraints. You have to care about the order of the operations you do.

Notes

[1] I'll write an article about this later

ACIDity of transactions as rescue...

Let's examine what all of the A, the C, the I and the D have for implications on our current subject.

Transactions are atomic (A)

The database should not really care about validating the constraints all the time Only the beginning and end state is really important. Inside a transaction, the data may be inconsistent : Dust hasn't yet settled.

Let's study an example. You have an unique index on an ordering.

TABLE ITEMS (
    ITEM_ID SERIAL,
    GROUP_ID INTEGER,
    ORDER INTEGER,
    LABEL VARCHAR
)

ADD UNIQUE INDEX ON ITEMS(GROUP_ID, ORDER)

Here, if you want to swap 2 items, you have to use an unused temporary value, otherwise the check won't be valid at all times.

Transactions are consistent (C)

The check needs to be done at least when the transaction ends. No special need here except that you need to re-enable before ending the transaction.

Transactions are isolated (I)

We can also easily imagine that the check only needs to be done when the transaction ends, just before the commit. Normally no one should be able to see the changing data meanwhile it's not completed.

One very important thing to know is that if you are using a READ UNCOMMITTED isolation for other transactions you will see inconsistent data.

Anyway, if you are doing that, you know what you are doing and are obviously taking special care about it, don't you ?

Transactions are durable (D)

This final property has nothing to do with our current issue. Good.

... But sometimes early warning is quite nice

When interacting with external systems, that don't participate in our transaction, extra care should be taken in order to cope with the exceptional case of a constraint failure. Distributed transactions is a very complex subject, and usually it's not ~~supported~~ done^[1].

Conclusion

With the principle of least surprise in mind, we can easily understand why deferred is not the default behavior, but it makes a very nice addition to our toolbox.

So now there isn't any good reason anymore not to use (and abuse) constraints in your databases.

Remember, your data is you most precious asset, protect it at all cost from evil misbehaved bug-ridden software^[2] !

Wow... Just in time before the end of the month... I would have failed my motto on URLs ;-)

Notes

[1] Do you always implement a double-phase commit on every SOAP/REST/XML-HTTP/POST interface that you expose ?

[2] Yeah, I have chosen my side in the coming war...

Checked or Unchecked Exceptions for Legacy Code ?

Steve Schnepp — Wed, 15 Jul 2009 20:55:00 +0200

This question can almost trigger a religious war. On Internet no fixed consensus on the matter seems to exists. But most of the articles there have usually something in common : they are always mostly applicable when you start a new application.

Is the situation the same when you have a certain amount of existing code to maintain ?

Checked Exceptions are breaking encapsulation

In theory it's quite nice since the called code can communicate with it's caller when something unexpected happened.

The key word here is unexpected. If you have to explicitly know the exceptions that could occur, it's not really unexpected. And if it's not unexpected, using exception handling just add an out-of-band data path. It's on par with transporting data in a private class field when calling a member instead of using its arguments. This leads to breaking encapsulation as Alan Griffiths wrote in Exceptional Java. This vision is also shared by Bruce Eckel in his article entitled Does Java need Checked Exceptions?.

Checked Exceptions are quite painful to use

Local Exception Handling is hard to manage

I personally find checked exceptions quite painful to use. By definition, you have to catch every exception that is thrown by the underlaying code.

And if the underlaying code doesn't know what to do with the exception, chances are, that you don't know either, so you just pass the exception to the caller. And so on...

Too much code to change

Therefore exceptions are usually caught at the top level with a generic catch-all structure that logs the error, since no layer could sensibly do something clever with the exception.

Then you just have to change all the signature of the whole stack, just to be able to catch them at the top. Using unchecked exception lets you have this for free, and conveys the meaning that nothing is caught until the top.

Unchecked Exceptions might be dangerous...

Obviously, unchecked means not checked. So you might fail to catch them at the top level and then the whole application crashes. Checked exceptions are a safeguard against that. Just like strong static typing is.

You trade compile-time safety (checked) for development-time speed and ease (unchecked).

... but are not really.

On the other hand, if you have a good design, you don't have much different top levels, and then the risk is somewhat limited.

Moreover, since you always have to take unchecked one into account, why don't use them ?

By the way, in C++, the exceptions are unchecked by default.

Databases: Efficient Denormalization with Views

Steve Schnepp — Tue, 02 Jun 2009 08:00:00 +0200

Everyone is unanimous that database normalization is considered a Good Thing.

But it usually comes with a cost : writing queries can be very tedious since you always have to join many tables together to be able to retrieve useful human data from all those reference tables.

On the other side, to denormalize is sometimes seen as a way to :

optimize development : you do not need to write (and debug) complex queries since all the data is nicely located in the same table
optimize performance : the data has a better locality (no need to fetch or compute data from elsewhere). You can even pre-compute order totals^[1].

Denormalize correctly is quite difficult since one change snowballs in multiple updates to keep the redundant data coherent. It is therefore usually done on the application side with ready-to-use ORM frameworks. But managing it at the application level comes with an ugly cost : it has to be reimplemented over and over each time the application switches technology, version or when a new application is connecting to the database.

In almost every programming language, code reuse is encouraged. Here, at the database level, we can also apply the same principles, and use views to transparently present a denormalized API (read tables) on a more normalized schema.

The main points are :

Views are the main code reuse vector at the database level. Current database usually correctly optimize (by rewrite and recombination) the simple queries so that performance is on par with a hand crafted query that doesn't use the views
Sometime even faster since the data is nicely organized, so there is much less data to transfer, and I/O bandwidth is a usual suspect.
The application part doesn't even need to know that normalization happens under-hood since updates to views are possible in many modern RDMs with the @@INSTEAD OF@@ trigger (or something equivalent).
Theses updates can be created with Materialized views are a step even further on the denormalizing road, since it provides the common benefits of denormalize without the implementation caveats. We can even hand-craft these Materialized views directly in an aggregation table in order to have the space benefits of normalisation and the performance benefits of denormalization.

So, nothing stops you from normalizing at will, and denormalizing when needed. Where to put the cursor is yours to decide, but moving it afterwards is finally easier that what is commonly admited.

Notes

[1] That article also explains why denormalization maintenance must stay at the database level with a very interesting metaphor

Personal Workflow Blog

Waiting for Munin 2.0 - Native SSH transport

Native SSH

Configuration

Installation notes

Upcoming HTTP(S) transport in 3.0

Waiting for Munin 2.0 - Performance - Asynchronous updates

The problem : updates are synchronous

Evolving Solutions

1.4 : Parallel Fetching

2.0 : Stateful plugins

2.0 : Asynchronous proxy node

The proxy node in detail (munin-async)

Overview

Specific update rates

SSH transport

Notes

CGI on steroids with FastCGI, but on a CGI-only server - The FastCGI wrapper

FastCGI is really CGI on steroids

FastCGI vs mod_perl (or mod_python, ...)

But steroids do have some side effects

CGI issues

Webserver issues

A standalone FastCGI container

Notes

Waiting for Munin 2.0 - Performance - FastCGI

Some benchmarks

Basic 1.2 CGI

1.4 FastCGI

2.0 FastCGI

Waiting for Munin 2.0 - Performance - Architecture

A little intro/refresh on munin's architecture on the master

The various processes

munin-update

munin-graph

munin-html

munin-limits

Notes

Waiting for Munin 2.0 - Introduction

Don't use Excerpt... At least with DotClear.

API Design: Avoid hidden costs of simple features

Initial API

Just a little evolution...

A new need comes

The little evolution, revisited...

Free Exception lunch : Use unchecked exceptions, but still announce which ones you might throw.

Immutability of an URL

Notes

Avoid the Preprocessor : Use ''Compile-Time Polymorphism'' for Cross-platform Development

The usual abstraction with the preprocessor

Avoid the preprocessor Compile-time polymorphism

The header file is the common interface

fileiosys.h

win32/fileiosys.cpp

linux/fileiosys.cpp

The build system : Makefile

Conclusion

Notes

Native SSH transport for Munin

munin.conf snippet - Inetd version

munin.conf snippet - Native SSH transport version

Warning

Sed is much slower than Perl, or not...

Notes

Quickly replicate the clock between remote hosts with SSH

From a remote host

To a remote host

Notes

Databases: Efficient Case-insensitive searches with Function-based Indexing

Special case of case-insensitive search

Pro

Con

Native functional indexes

Pro

Con

Generated columns

Pro

Con

Trigger-based Generated columns Emulation

Pro

The proxy node in detail (`munin-async`)

`fileiosys.h`

`win32/fileiosys.cpp`

`linux/fileiosys.cpp`

The build system : `Makefile`