17 ms·
SRE Fundamentals: SLIs, SLAs and SLOs
- ProAm 8y agoThis is an interesting article from a company that has almost nil customer support.
- johlindenbaum 8y agoWe buy a support package and receive excellent support for our GCP services.
- mmt 8y agoAlthough that, technically, refutes an accusation of non-existence of customer support, it begs the question of what it means to be a enough of a "customer" to receive support (and at what level): Is it enough to use a gratis product? ("Paying" for it with data or ad-eyeballs, I suppose) Is it enough to pay money for the product? Must one also pay a subscription fee in addition to paying for the product in the first place? [1] Is something else, sometimes, necessary (such as volume/clout)? I think we've seen most of the spectrum of answers from the software industry (especially "enterprise" software), with the main novelty being the existence of web/SaaS gratis products. [1] Depending on where on the spectrum between hand-holding and mere bug fixes the support ends up falling, this could be characterized as double-dipping
- rahimnathwani 8y agoFrom the movie The Negotiator: A Marine and a sailor are taking a piss. The Marine goes to leave without washing up. The sailor says, 'In the Navy they teach us to wash our hands.' The Marine turns to him and says 'in the Marines they teach us not to piss on our hands'. BTW it's not true that Google has almost nil customer support. There's extensive support for paying customers (for ads, GCP, GSuite etc.). But it's amazing to me how reliable things like Gmail are, and how in so many years I've never felt the need to seek support.
- iamdave 8y agoThe joke in that scene always baffled me, because the Marines are born of the Navy and still carry a lot of the Navy's epistemology-why would they be taught something so fundamental so differently? (Yes it's a joke but sometimes I overthink things, heh)
- jldugger 8y agoI've also seen it as Harvard and MIT graduates, then someone comes in, washes his hands first, saying "at Yale, they taught us to wash our hands before touching a holy object."
- tpfour 8y agoQuite OT but I almost always wash my hands _before_ (and after) using the restroom. Especially in a public place, it always made sense to me to do it before and after. It seems much more hygienic both for the "holy object" and other people!
- walshemj 8y agoI was told that if your work in a chemical plant or a chip fab you learn to wash your hands before you don't want chemicals on sensitive parts And of course you don't know what germs etc are on the taps :-)
- 8y ago
- astockwell 8y agoIIRC they define their customers as other internal teams, separate from external customers, who (I'm guessing) are handled by external product teams.
- smueller1234 8y agoThat's generally correct. Though a lot of SLOs of SRE teams are influenced by external commitments as well. But I suppose that's pretty obvious considering there's SRE teams supporting cloud products.
- jasonvorhe 8y ago> This is an interesting article from a company that has almost nil customer support. This never gets old. It's almost as predictable as some random reference to "don't be evil".
- theDoug 8y agoI'm not sure what "almost nil customer support" measures out to, but speaking for myself and not Google Cloud (my employer) I know we have: - fantastic support internally (probably not what you're caring about), - support to external globally-scaled customers whose issues don't exist because technical account management helped set up clear goals, such as uptime, described in the blog (probably also not what you're counting) - support for even the smallest companies willing to pay as little as $100/user/month for Role-Based Support[1] and also receive direct access to support until they decide it's no longer needed (and by design, scale support costs to zero) 1. https://cloud.google.com/support/ https://cloud.google.com/support/
- mulmen 8y agoIf you don’t think a company has customer support it’s because you aren’t a customer.
- walshemj 8y agoI suspect they meant there internal customers :-)
- bpchaps 8y agoWhen reading these articles, never forget that your company is NOT Google! If your company doesn't have a management/infrastructure/communication/skill structure that Google has, then it will be very difficult to implement these fundamentals. In many cases, an SRE is a job to save costs. If your company doesn't get its shit together and doesn't give your SREs the support it needs, then they'll hate their jobs and the company.
- closeparen 8y agoI have to disagree. The typical and intuitive ways of reasoning about outages and outage risk - screaming at the engineers until they fix it, desperately passing the buck, finding someone to fire in the aftermath - are not a good fit for any context. Every company can benefit from a more principled mental model of system reliability.
- bpchaps 8y agoIf your company's management doesn't even know what an SRE is, then you're stuck in the same exact place, where the SREs are the one being screamed at instead. Some companies just rename "devops" to "SRE".
- oblio 8y agoI have no idea why you’re being downvoted. It’s the same thing as Borg/Kubernetes, MapReduce/Hadoop: some things just don’t apply or aren’t as effective unless you’re operating at a huge scale and with Google’s culture.
- zzzcpan 8y agoSo, how do you choose that service level objective? How do you know which solutions to implement to not make things "overly reliable"? Isn't that more important question? As doing this without some sort of methodology will almost always result in useless solutions and overpaying to cloud and other hosting providers. Like implementing rather expensive failover within the datacenter, while ignoring how unreliable datacenters are and how cheaply you can implement failover between datacenters via DNS. I like the idea of modelling availability/reliability for this. Even if you don't have the right numbers and do it on a napkin, not in code, it still can highlight solutions with best cost/benefit ratios.
- gcardone_ 8y agoDisclaimer: I am an SRE at Google, opinions are my own. There's an excellent talk by Google VP of SRE Ben Treynor: https://www.youtube.com/watch?v=iF9NoqYBb4U https://www.youtube.com/watch?v=iF9NoqYBb4U. tl;dw: try to measure actual user experience, and make sure that even the long tile of customer still gets a good product experience. What "good product experience" means depends, on your product. The rest of the error budget is for you to spend on releasing new features, changing the underlying architecture, etc.
- strmpnk 8y agoThese distinctions started making more sense when I realize they map to OKRs which is generally how Google is said to track individual and team performance. In general, it's good to be precise about how you measure and when something is a hard or soft boundary. Otherwise, firefighting gets out of control. It's hard to determine when to stop something and put out a fire if you can't prioritize issues based on the boundaries you've set for your system.
- smueller1234 8y agoSLOs certainly don't rigidly map to OKRs. Maybe it's easier to consider them (two sided) commitments about the quality of service? They're more of an ongoing measure of quality rather than a quarterly objective.
- strmpnk 8y agoGood point on the quarterly vs continuous measurement. I'm not implying they are rigidly mapped but it makes sense you can put quality changes down as an objective for a team. This can be both end-of-quarter quality but also the general rate of change over the entire quarter. Depending on the situation, I have seen teams aim to achieve certain SLOs but it can also be that certain other things can be achieved without letting the SLOs suffer (if they're already at a reasonably high quality).
- yarrick 8y agoCorrect. Breaking or risking the SLO will instead lead to stopping new features until reliability is restored.
- pspeter3 8y agoThis is a great article for defining terms. For some reason though, this quote made me laugh out loud: "Excessive availability can become a problem because now it’s the expectation. Don’t make your system overly reliable if you don’t intend to commit to it to being that reliable."
- sdhgaiojfsa 8y agoThis is a semi-variant of Hyrum's law.
- sgift 8y agoIsn't that one of the reasons for Netflix' chaos monkey? To make sure no one thinks "my dependency will always be there"?
- sargun 8y agoThat's more part of CHaP: https://medium.com/netflix-techblog/chap-chaos-automation-platform-53e6d528371f https://medium.com/netflix-techblog/chap-chaos-automation-pl... and FIT: https://medium.com/netflix-techblog/fit-failure-injection-testing-35d8e2a9bb2 https://medium.com/netflix-techblog/fit-failure-injection-te... -- it's a mechanism to artificially inject errors to understand how upstream dependencies effect your availability.
- anonacct37 8y agoIt's funny but true. All observable properties of a system will eventually become hard dependencies for someone.
- frowawayz 8y agoThis is actually a serious point, not a joke. New services may be launched with provisional technology to establish or evaluate a market or pricing model. The underlying technology in the initial implementation may have different performance or availability characteristics to what's actually envisioned for the full-scale product, and care has to be taken to actually compensate for this - i.e. introducing synthetic delay/jitter/faults to avoid setting the wrong expectation for the product.
- insiderinsider 8y agoGetting the definitions right
- alttab 8y ago"Within Google, we implement periodic downtime in some services to prevent a service from being overly available." Uh..... what?
- nbm 8y agoServices have different relationships with each others in terms of dependencies, and in terms of what you think those dependencies are. If your idea of how things work is that services A, B, and C can optionally use service D, else use some fallback process, then if D has never failed, then you've never used that fallback process. And services X, Y, and Z which rely on services A, B, and C haven't had to deal with those services using their fallback processes either. So, instead of waiting for D to fail, you can take it down at a convenient time. This applies to services as a whole, or services within a locality, or all services in some availability zone.
- ak217 8y agoSimilar concept to Netflix Chaos Monkey.
- resonantjacket5 8y agoImagine if in python open('file.txt', 'r') never failed so no one ever bothered to put a try block. To prevent this from happening they purposely have open() fail a couple times.
- ebikelaw 8y agoThere’s a particular global system that’s very reliable — Global Chubby — and to keep people from putting it in their serving path they just regularly take it down for like an hour per quarter.
- goobynight 8y agoRead the full context of that quote. There's even more in the SRE book. "Don’t make your system overly reliable if you don’t intend to commit to it to being that reliable" If a service has exceeded the reliability target for a given time period, you can take it down to basically let users know that this can happen and to not expect more. You don't want them to get to the point where they are integrating so much with a service (and assuming a higher reliability that you have not promised ) that they end up mad at you when it performs worse, but still as intended, at a later date.
- peterwwillis 8y agoIf you're building a system from scratch, keep in mind that this way of designing your service may not be flexible enough. You don't want just service level objectives, agreements and indicators, you want customer level. Your service may end up providing for multiple customers with different requirements. Maybe 1% of your customers will end up using 99% of your resources, creating uncomfortable situations that affect the other 99% of customers. To get away from this you have to start spinning off multiple identical services just for groups of customers, which is really annoying to maintain. You may find you need to add hard resource limits to control customer behavior, which is hard to add after the fact. Instead, if you design your new system from scratch with customer-specific isolation and service levels, you can run one giant service and still prevent customer-specific load from hampering the rest of the service. You can also just run duplicate services at different levels of availability based on customer requirements, but that's not going to work forever. As an aside, I'm looking forward to reading ITIL 2019 to see what new processes they've adopted. I think everyone who's getting into SRE stuff should have a solid foundation on the basics of IT Operations management first.
- Animats 8y agoGoogle: "An SLA normally involves a promise to someone using your service that its availability should meet a certain level over a certain period, and if it fails to do so then some kind of penalty will be paid. This might be a partial refund of the service subscription fee paid by customers for that period, or additional subscription time added for free." "Partial refund". That's a very low standard for a service level agreement, but typical of Google. Your whole business is down, it's their fault, and all you get a partial refund on the service. A service level agreement is really a service packaged with an insurance product. The insurance product part should be evaluated as such - does it cover enough risk and is the coverage amount high enough? You can buy business interruption insurance from insurance companies, and should price that out in comparison with the cost and benefits of a SLA. If this is crucial to your core business, as with an entire retail chain going down because a cloud-based point of sale system goes down, it needs to be priced accordingly. See: [1] [1] https://www.researchgate.net/publication/226123605_Managing_Violations_in_Service_Level_Agreements https://www.researchgate.net/publication/226123605_Managing_...
- luhn 8y ago> "Partial refund". That's a very low standard for a service level agreement, but typical of Google. It seems to be the standard. The most generous SLA I've seen is 5% off the monthly bill for each 30 minutes of downtime (up to 100%). If I'm down for 10 hours, waiving one month of bills doesn't come close to the damage done. An SLA seems to be more of a promise than an agreement, because if the service goes down you're SOL and the provider gets a slap on the wrist (partial refund).
- stephengillie 8y agoI've worked for a cloud provider who paid 45x for downtime. If you were down for an hour, you got 45 hours of credit on your bill. My current ISP credits 5x - I was impacted in an outage expected to last all day, and they credited me 5 days on my next bill.
- joshuamorton 8y ago
- asn1parse 8y agoIn ops, we often have other internal groups that we either work with or support. It's often useful to view these groups as a customer, then you use the same policies, perhaps with a few exceptions in some cases, to manage the relationship. Typically we call this the OLA, the operating level agreement. I can only speak for my own experience, but operations groups I've been part of that don't have this concept of the operating level agreement typically suffer various types of damage to reputation. This is because there are no rules around how internal groups assess accountability, and therefore by having the terms of the OLA, you have the ability to defend your position as long as you stayed within the terms of the OLA. For example when we started building VAData data centers all over the world for Amazon, by having an OLA, we were able to push back on groups that claimed we were not holding up our end of the agreement.
- mlthoughts2018 8y agoI work in machine learning, where my team’s ML web services are typically requested by other in-house teams to provide features for their business logic, and so our SLAs are also agreements with other in-house teams. What I’ve found is that product managers and business people are typically extremely resistant to traditional concepts of software requirements or feature planning, because they want flexibility to change requirements late in development without any negative repurcussion to them. But somehow the language of SLAs magically clicks and they are more receptive to defining a service agreement. Then you ask them, from a business point of view, how much uptime does it need, what sort of throughput does it have to support, is the budget for outages or failures distributed equally across all features or more important for some features than others? This practically leads directly to the same scoping and requirements discussion you would have had in traditional software planning, but for some reason the language of SLAs is more palatable, so I’ve found it is an effective way to get around some non-tech person in the loop who might be fighting against detailing a proper spec or documenting priority delivery among features.
- deleted 8y ago[deleted]
- erikb 8y agoSo there is one obscure metric "service is available, i.e. can do its job", and this metric has different attributes: there are actual metric values (SLIs), there are internal goals (SLOs) and there are legally binding promises (SLAs) to users/customers. I would argue that this is not much content here. Content, imo, would be something like this: We define "available" as "processor_load<99% and disk_load<99% and ram_load<99% and server responds with http 200 on port xyz", because reason_a, reason_b, reason_c. But other people could argue that it is not as much about the node but about how service_x is experienced, so one could track the speed of http responses to user requests and they should be under 0.1sec over 95% of the time. etc... That you should track metrics, that you should set goals, and that you should define SLAs with your customers/users is standard business practice, not new knowledge.
- saywatnow 8y agoDoes Site Reliability include using assets from no less than 7 domains and requiring Javascript to present a few paragraphs of text?
- TheCoelacanth 8y agoPresumably their blog is very low on the list of things they care about the reliability of.