3 # Demand-Attach File-Server (DAFS)
5 OpenAFS 1.5 contains Demand-Attach File-Server (DAFS). DAFS is a significant departure from the more _traditional_ AFS file-server and this document details those changes.
7 ## Why Demand-Attach File-Server (DAFS) ?
9 On a traditional file-server, volumes are attached at start-up and detached only at shutdown. Any attached volume can be modified and changes are periodically flushed to disk or on shutdown. When a file-server isn't shutdown cleanly, the integrity of every attached volume has to be verified by the salvager, whether the volume had been modified or not. As file-servers grow larger (and the number of volumes increase), the length of time required to salvage and attach volumes increases, e.g. it takes around two hours for a file-server housing 512GB data to salvage and attach volumes !
11 On a Demand-Attach File-Server (DAFS), volumes are attached only when accessed by clients. On start-up, the file-server reads only the volume headers to determine what volumes reside on what partitions. When accessed by clients, the volumes are attached. After some period of inactivity, volumes are automatically detached. This dramatically improves start-up and shutdown times. A demand-attach file-server can be restarted in seconds compared to hours for the same traditional file-server.
13 The primary objective of the demand-attach file-server was to dramatically reduce the amount of time required to restart an AFS file-server.
15 Large portions of this document were taken / influenced by the presentation entitled [Demand Attach / Fast-Restart Fileserver](http://workshop.openafs.org/afsbpw06/talks/tkeiser-dafs.pdf) given by Tom Keiser at the [AFS and Kerberos Best Practices Workshop](http://workshop.openafs.org/) in [2006](http://workshop.openafs.org/afsbpw06/).
17 ## An Overview of Demand-Attach File-Server
19 Demand-attach necessitated a significant re-design of certain aspects of the AFS code, including:
21 - volume package has a number of severe limitations
22 - single global lock, leading to poor scaling
23 - lock is held across high latency operations, e.g. disk I/O
24 - no notion of state for concurrently accessed objects
25 - the vnode package suffers from the same limitations
26 - breaking callbacks is time consuming
27 - salvaging does not have to be done with the file-server offline
29 The changes implemented for demand-attach include:
31 - [[volume finite-state automata|DemandAttach#Volume_Finite_State_Automata]]
32 - volumes are attached on demand
33 - volume _garbage collector_ to detach unused volumes
34 - notion of volume state means read-only volumes aren't salvaged
35 - [[vnode finite-state automata|DemandAttach#Vnode_Finite_State_Automata]]
36 - global lock is only held when required and never held across high-latency operations
37 - automatic salvaging of volumes
38 - shutdown is done in parallel (maximum number of threads utilized)
39 - callbacks are no longer broken on shutdown
40 - instead, host / callback state is preserved across restarts
42 ## The Gory Details of the Demand-Attach File-Server
45 A traditional file-server uses the `bnode` type `fs` and has a definition similar to
48 parm /usr/afs/bin/fileserver -p 123 -L -busyat 200 -rxpck 2000 -cb 4000000
49 parm /usr/afs/bin/volserver -p 127 -log
50 parm /usr/afs/bin/salvager -parallel all32
53 Since an additional component was required for the demand-attach file-server, a new `bnode` type ( `dafs`) is required. The definition should be similar to
56 parm /usr/afs/bin/dafileserver -p 123 -L -busyat 200 -rxpck 2000 -cb 4000000 -vattachpar 128 -vlruthresh 1440 -vlrumax 8 -vhashsize 11
57 parm /usr/afs/bin/davolserver -p 64 -log
58 parm /usr/afs/bin/salvageserver
59 parm /usr/afs/bin/dasalvager -parallel all32
62 The instance for a demand-attach file-server is therefore `dafs`
63 instead of `fs`. For a complete list of configuration options see the
64 [dafileserver man page](http://docs.openafs.org/Reference/8/dafileserver.html).
66 ### <a name="File-server Start-up / Shutdown "></a> File-server Start-up / Shutdown Sequence
68 The table below compares the start-up sequence for a traditional file-server and a demand-attach file-server.
70 <table border="1" cellpadding="0" cellspacing="0">
72 <th bgcolor="#99CCCC"><strong> Traditional </strong></th>
73 <th bgcolor="#99CCCC"><strong> Demand-Attach </strong></th>
77 <td> host / callback state restored </td>
81 <td> host / callback state consistency verified </td>
84 <td> build vice partition list </td>
85 <td> build vice partition list </td>
88 <td> volumes are attached </td>
89 <td> volume headers read </td>
93 <td> volumes placed into <em>pre-attached</em> state </td>
97 The [[host / callback state|DemandAttach#FSStateDat]] is covered later. The _pre-attached_ state indicates that the file-server has read the volume headers and is aware that the volume exists, but that it has not been attached (and hence is not on-line).
99 The shutdown sequence for both file-server types is:
101 <table border="1" cellpadding="0" cellspacing="0">
103 <th bgcolor="#99CCCC"><strong> Traditional </strong></th>
104 <th bgcolor="#99CCCC"><strong> Demand-Attach </strong></th>
107 <td> break callbacks </td>
108 <td> quiesce host / callback state </td>
111 <td> shutdown volumes </td>
112 <td> shutdown on-line volumes </td>
116 <td> verify host / callback state consistency </td>
120 <td> save host / callback state </td>
124 On a traditional file-server, volumes are off-lined (detached) serially. In demand-attach, as many threads as possible are used to detach volumes, which is possible due to the notion of a volume has an associated state.
126 ### Volume Finite-State Automata
128 The volume finite-state automata is available in the source tree under `doc/arch/dafs-fsa.dot`. See [[=fssync-debug=|DemandAttach#fssync_debug]] for information on debugging the volume package.
132 ### Volume Least Recently Used (VLRU) Queues
134 The Volume Least Recently Used (VLRU) is a garbage collection facility which automatically off-lines volumes in the background. The purpose of this facility is to pro-actively off-line infrequently used volumes to improve shutdown and salvage times. The process of off-lining a volume from the "attached" state to the "pre-attached" state is called soft detachment.
136 VLRU works in a manner similar to a generational garbage collector. There are five queues on which volumes can reside.
138 <table border="1" cellpadding="0" cellspacing="0">
140 <th bgcolor="#99CCCC"><strong> Queue </strong></th>
141 <th bgcolor="#99CCCC"><strong> Meaning </strong></th>
145 <td> Volumes which have not been accessed recently and hence are candidates for soft detachment. </td>
149 <td> Volumes which are administratively prevented from VLRU activity, i.e. will never be detached. </td>
152 <td> intermediate (mid) </td>
153 <td> Volumes transitioning from new -> old (see [[DemandAttach#VLRUStateTransitions][state transitions] for details). </td>
157 <td> Volumes which have been accessed. See [[DemandAttach#VLRUStateTransitions][state transitions] for details. </td>
161 <td> Volumes which are continually accessed. See [[DemandAttach.#VLRUStateTransitions][state transitions] for details. </td>
165 The state of the various VLRU queues is dumped with the file-server state and at shutdown.
167 The VLRU queues new, mid (intermediate) and old are generational queues for active volumes. State transitions are controlled by inactivity timers and are
169 <table border="1" cellpadding="0" cellspacing="0">
171 <th bgcolor="#99CCCC"><strong> Transition </strong></th>
172 <th bgcolor="#99CCCC"><strong> Timeout (minutes) </strong></th>
173 <th bgcolor="#99CCCC"><strong> Actual Timeout (in MS) </strong></th>
174 <th bgcolor="#99CCCC"><strong> Reason (since last transition) </strong></th>
177 <td> candidate->new </td>
180 <td> new activity </td>
183 <td> new->candidate </td>
184 <td> 1 * vlruthresh </td>
186 <td> no activity </td>
189 <td> new->mid </td>
190 <td> 2 * vlruthresh </td>
195 <td> mid->old </td>
196 <td> 4 * vlruthresh </td>
201 <td> old->mid </td>
202 <td> 2 * vlruthresh </td>
204 <td> no activity </td>
207 <td> mid->new </td>
208 <td> 1 * vlruthresh </td>
210 <td> no activity </td>
214 `vlruthresh` has been optimized for RO file-servers, where volumes are frequently accessed once a day and soft-detaching has little effect (RO volumes are not salvaged; one of the main reasons for soft detaching).
216 ### Vnode Finite-State Automata
218 The vnode finite-state automata is available in the source tree under `doc/arch/dafs-vnode-fsa.dot`
220 `/usr/afs/bin/fssync-debug` provides low-level inspection and control of the file-server volume package. **Indiscriminate use of <code>fsync-debug</code>** can lead to extremely bad things occurring. Use with care.
226 Demand salvaging is implemented by the `salvageserver`. The actual code for salvaging a volume remains largely unchanged. However, the method for invoking salvaging with demand-attach has changed:
228 - file-server automatically requests volumes be salvaged as required, i.e. they are marked as requiring salvaging when attached.
229 - manual initiation of salvaging may be required when access is through the `volserver` (may be addressed at some later date).
230 - `bos salvage` requires the `-forceDAFS` flag to initiate salvaging with DAFS. However, **salvaging should not be initiated using this method**.
231 - infinite salvage, attach, salvage, ... loops are possible. There is therefore a hard-limit on the number of times a volume will be salvaged which is reset when the volume is removed or the file-server is restarted.
232 - volumes are salvaged in parallel and is controlled by the `-Parallel` argument to the `salvageserver`. Defaults to 4.
233 - the `salvageserver` and the `inode` file-server are incompatible:
234 - because volumes are inter-mingled on a partition (rather than being separated), a lock for the entire partition on which the volume is located is held throughout. Both the `fileserver` and `volserver` will block if they require this lock, e.g. to restore / dump a volume located on the partition.
235 - inodes for a particular volume can be located anywhere on a partition. Salvaging therefore results in **every** inode on a partition having to be read to determine whether it belongs to the volume. This is extremely I/O intensive and leads to horrendous salvaging performance.
236 - `/usr/afs/bin/salvsync-debug` provides low-level inspection and control over the `salvageserver`. **Indiscriminate use of `salvsync-debug` can lead to extremely bad things occurring. Use with care.**
237 - See [[=salvsync-debug=|DemandAttach#salvsync_debug]] for information on debugging problems with the salvageserver.
241 ### File-Server Host / Callback State
243 Host / callback information is persistent across restarts with demand-attach. On shutdown, the file-server writes the data to `/usr/afs/local/fsstate.dat`. The contents of this file are read and verified at start-up and hence it is unnecessary to break callbacks on shutdown with demand-attach.
245 The contents of `fsstate.dat` can be inspected using `/usr/afs/bin/state_analyzer`.
247 ## <a name="File-Server Arguments (relating "></a> File-Server Arguments (relating to Demand-Attach)
249 These are available in the man-pages (section 8) for the fileserver; some details are provided here for convenience:
251 Arguments controlling the host / callback state:
253 <table border="1" cellpadding="0" cellspacing="0">
255 <th bgcolor="#99CCCC"><strong> Parameter </strong></th>
256 <th bgcolor="#99CCCC"><strong> Options </strong></th>
257 <th bgcolor="#99CCCC"><strong> Default </strong></th>
258 <th bgcolor="#99CCCC"><strong> Suggested Value </strong></th>
259 <th bgcolor="#99CCCC"><strong> Meaning </strong></th>
262 <td><code>fs-state-dont-save</code></td>
264 <td> state saved </td>
266 <td><code>fileserver</code> state will not be saved during shutdown </td>
269 <td><code>fs-state-dont-restore</code></td>
271 <td> state restored </td>
273 <td><code>fileserver</code> state will not be restored during startup </td>
276 <td><code>fs-state-verify</code></td>
280 <td> Controls the behavior of the state verification mechanism. Before saving or restoring the <code>fileserver</code> state information, the internal host and callback data structures are verified. A value of 'none' turns off all verification. A value of 'save' only performs the verification steps prior to saving state to disk. A value of 'restore' only performs the verification steps after restoring state from disk. A value of 'both' performs all verification steps both prior to saving and after restoring state. </td>
284 Arguments controlling the VLRU
286 <table border="1" cellpadding="0" cellspacing="0">
288 <th bgcolor="#99CCCC"><strong> Parameter </strong></th>
289 <th bgcolor="#99CCCC"><strong> Options </strong></th>
290 <th bgcolor="#99CCCC"><strong> Default </strong></th>
291 <th bgcolor="#99CCCC"><strong> Suggested Value </strong></th>
292 <th bgcolor="#99CCCC"><strong> Meaning </strong></th>
295 <td><code>vattachpar</code></td>
296 <td> positive integer </td>
299 <td> Controls the parallelism of the volume package start-up and shutdown routines. On start-up, vice partitions are scanned for volumes to pre-attach using a number of worker threads, the number of which is the minimum of <code>vattachpar</code> or the number of vice partitions. On shutdown, <code>vattachpar</code> worker threads are used to detach volumes. The shutdown code is mp-scaleable well beyond the number of vice partitions. Tom Keiser (from SNA) found 128 threads for a single vice partition had a statistically significant performance improvement over 64 threads. </td>
302 <td><code>vhashsize</code></td>
303 <td> positive integer </td>
306 <td> This parameter controls the size of the volume hash table. The table will contain 2^( <code>vhashsize</code>) entries. Hash bucket utilization statistics are given in the <code>fileserver</code> state information as well as on shutdown. </td>
309 <td><code>vlrudisable</code></td>
313 <td> Disables the Volume Least Recently Used (VLRU) cache. </td>
316 <td><code>vlruthresh</code></td>
317 <td> positive integer </td>
318 <td> 120 minutes </td>
319 <td> 1440 (24 hrs) </td>
320 <td> Minutes of inactivity before a volume is eligible for soft detachment. </td>
323 <td><code>vlruinterval</code></td>
324 <td> positive integer </td>
325 <td> 120 seconds </td>
327 <td> Number of seconds between VLRU candidate queue scans </td>
330 <td><code>vlrumax</code></td>
331 <td> positive integer </td>
334 <td> Max number of volumes which will be soft detached in a single pass of the scanner </td>
338 ## Tools for Debugging Demand-Attach File-Server
340 Several tools aid debugging problems with demand-attach file-servers. They operate at an extremely low-level and hence require a detailed knowledge of the architecture / code.
342 ### <code>**fssync-debug**</code>
344 **Indiscriminate use of `fssync-debug` can have extremely dire consequences. Use with care.**
346 `fssync-debug` provides low-level inspection and control over the volume package of the file-server. It can be used to display the file-server information associated with a volume, e.g.
348 ozsaw7 2# vos exam user.af -cell w.ln
349 user.af 537119916 RW 2123478 K On-line
351 RWrite 537119916 ROnly 0 Backup 537119917
353 Creation Wed Sep 17 17:48:17 2003
354 Copy Thu Dec 11 18:01:37 2008
355 Backup Thu Jun 25 01:49:20 2009
356 Last Update Thu Jun 25 16:17:35 2009
357 85271 accesses in the past day (i.e., vnode references)
359 RWrite: 537119916 Backup: 537119917
361 server ln1qaf01 partition /vicepb RW Site
362 ozsaw7 3# /usr/afs/bin/fssync-debug query -vol 537119916 -part /vicepb
363 calling FSYNC_VolOp with command code 65543 (FSYNC_VOL_QUERY)
364 FSYNC_VolOp returned 0 (SYNC_OK)
365 protocol response code was 0 (SYNC_OK)
366 protocol reason code was 0 (0)
371 partition = 0xf90dfb8
372 linkHandle = 0x10478400
373 nextVnodeUnique = 2259017
374 diskDataHandle = 0x104783d0
382 updateTime = 1245943107
383 vnodeIndex[vSmall] = {
389 vnodeIndex[vLarge] = {
395 updateTime = 1245943107
396 attach_state = VOL_STATE_ATTACHED
397 attach_flags = VOL_HDR_ATTACHED | VOL_HDR_LOADED | VOL_HDR_IN_LRU | VOL_IN_HASH | VOL_ON_VBYP_LIST | VOL_ON_VLRU
411 hash_short_circuits = {
427 last_attach = 1245891030
428 last_get = 1245943107
429 last_promote = 1245891030
430 last_hdr_get = 1245943107
431 last_hdr_load = 1245891030
432 last_salvage = 1242508846
433 last_salvage_req = 1242508846
434 last_vol_op = 1245890958
437 idx = 0 (VLRU_QUEUE_NEW)
442 Note that the `volumeid` argument must be the numeric ID and the `partition` argument must be the **exact** partition name (and not an abbreviation). An explanation of all these values is beyond the scope of this document. The important fields are:
444 - `attach_state`, which is usually
445 - `VOL_STATE_PREATTACHED` which means the volume headers have been read, but the volume is not attached
446 - `VOL_STATE_ATTACHED` which means the volume is fully attached
447 - `VOL_STATE_ERROR` which indicates that the volume cannot be attached
449 - `VOL_HDR_ATTACHED` means the volume headers have been read (and hence the file-server is aware of the volumes existence)
450 - `VOL_HDR_LOADED` means the volume headers are resident in memory
451 - `VOL_HDR_IN_LRU` means the volume headers are on the least-recently used queue
452 - `VOL_IN_HASH` indicates that the volume has been added to the volume linked-list
453 - `VOL_ON_VBYP_LIST` indicates that the volume is linked off the partition list
454 - `VOL_ON_VLRU` means the volume is on a VLRU queue
455 - the `salvage` structure (detailed [[here|DemandAttach#salvsync_debug]])
456 - the `stats` structure, particularly the volume operation times ( `last_*`).
457 - the `vlru` structure, particularly the VLRU queue
459 An understanding of the [volume finite-state machine](http://www.dementia.org/twiki//view/dafs-fsa.png) is required before the state of a volume should be manipulated.
461 ### <code>**salvsync-debug**</code>
463 **Indiscriminate use of `salvsync-debug` can have extremely dire consequences. Use with care**
465 `salvsync-debug` provides low-level inspection and control of the salvageserver process, including the scheduling order of volumes.
467 `salvsync-debug` can be used to query the current salvage status of a volume, e,g,
469 ozsaw7 4# /usr/afs/bin/salvsync-debug query -vol 537119916 -part /vicepb
470 calling SALVSYNC_SalvageVolume with command code 65540 (SALVSYNC_QUERY)
471 SALVSYNC_SalvageVolume returned 0 (SYNC_OK)
472 protocol response code was 0 (SYNC_OK)
473 protocol reason code was 0 (**UNKNOWN**)
475 state = 4 (SALVSYNC_STATE_DONE)
481 To initiate the salvaging of a volume
483 ozsaw7 5# /usr/afs/bin/salvsync-debug salvage -vol 537119916 -part /vicepb
484 calling SALVSYNC_SalvageVolume with command code 65537 (SALVSYNC_SALVAGE)
485 SALVSYNC_SalvageVolume returned 0 (SYNC_OK)
486 protocol response code was 0 (SYNC_OK)
487 protocol reason code was 0 (**UNKNOWN**)
489 state = 1 (SALVSYNC_STATE_QUEUED)
494 ozsaw7 6# /usr/afs/bin/salvsync-debug query -vol 537119916 -part /vicepb calling SALVSYNC_SalvageVolume with command code 65540 (SALVSYNC_QUERY)
495 SALVSYNC_SalvageVolume returned 0 (SYNC_OK)
496 protocol response code was 0 (SYNC_OK)
497 protocol reason code was 0 (**UNKNOWN**)
499 state = 2 (SALVSYNC_STATE_SALVAGING)
505 This is the method that should be used on demand-attach file-servers to initiate the manual salvage of volumes. It should be used with care.
507 Under normal circumstances, the priority ( `prio`) of a salvage request is the number of times the volume has been requested by clients. Modifying the priority (and hence the order volumes are salvaged) under heavy demand-salvaging usually leads to extremely bad things happening. To modify the priority of a request, use
509 salvsync-debug priority -vol 537119916 -part /vicepb -priority 999999
511 (where `priority` is a 32-bit integer).
513 ### <code>**state\_analyzer**</code>
515 `state_analyzer` allows the contents of the host / callback state file ( `/usr/afs/local/fsstate.dat`) to be inspected.
517 #### Header Information
519 Header information is gleaned through the `hdr` command
521 fs state analyzer> hdr
522 loading structure from address 0xfed80000 (offset 0)
528 timestamp = "Tue Jun 23 11:51:49 2009"
530 server_uuid = "002e9712-ae67-1a2e-8a-42-900e866eaa77"
542 server_version_string = "@(#) OpenAFS 1.4.6-22 built 2009-04-18 "
546 #### Host Information
548 Host information can be gleaned through the `h` command, e.g.
551 fs state analyzer: h(0)> this
552 loading structure from address 0xfed80500 (offset 1280)
553 host_state_entry_header = {
560 host = "161.144.167.187"
568 LastCall = "Tue Jun 23 11:51:45 2009"
569 ActiveCall = "Tue Jun 23 11:51:45 2009"
570 cpsCall = "Tue Jun 23 11:51:45 2009"
575 numberOfInterfaces = 2
576 uuid = "aae8a851-1d54-4b83-ad-17-db967bd89e1b"
578 addr = "161.144.167.187"
586 fs state analyzer: h(0)> next
587 loading structure from address 0xfed80568 (offset 1384)
588 host_state_entry_header = {
595 host = "10.181.34.134"
603 LastCall = "Tue Jun 23 11:51:08 2009"
604 ActiveCall = "Tue Jun 23 11:51:08 2009"
605 cpsCall = "Tue Jun 23 11:51:08 2009"
610 numberOfInterfaces = 4
611 uuid = "00107e94-794d-1a3d-ae-e2-0ab52421aa77"
613 addr = "10.181.36.33"
617 addr = "10.181.36.31"
621 addr = "10.181.32.134"
625 addr = "10.181.34.134"
629 fs state analyzer: h(1)>
631 #### Callback Information
633 Callback information is available through the `cb` command, e.g.
635 fs state analyzer> cb
636 fs state analyzer: fe(0):cb(0)> dump
637 loading structure from address 0xfed97b6c (offset 97132)
653 The `dump` command (as opposed to `this`) displays all call-backs for the current file-entry. Moving to the next file-entry can be achieved by
655 fs state analyzer: fe(0):cb(0)> quit
656 fs state analyzer: fe(0)> next
657 loading structure from address 0xfed97b90 (offset 97168)
658 callback_state_entry_header = {
675 fs state analyzer: fe(1)> cb
676 fs state analyzer: fe(1):cb(0)> dump
677 loading structure from address 0xfed97bd4 (offset 97236)