You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

Status

Current state: "Under Discussion"

Discussion thread: here [Change the link from the KIP proposal email archive to your own email thread]

JIRA: here [Change the link from KAFKA-1 to your own ticket]

Please keep the discussion on the mailing list rather than commenting on the wiki (wiki discussions get unwieldy fast).

Motivation

Historically, there have been numerous issues where the log compaction has failed for some reason, most commonly bugs in code ( KAFKA-3330 - Getting issue details... STATUS   KAFKA-6264 - Getting issue details... STATUS   KAFKA-6834 - Getting issue details... STATUS   KAFKA-6854 - Getting issue details... STATUS  to name some).

Currently, during log compaction, if the compaction of one log fails the whole `CleanerThread` responsible for compacting and deleting old logs exits. It is then not restarted at any point. This results in a Kafka broker that runs seemingly fine but does not delete old log segments at all.  This makes the broker a ticking time bomb - it is only a matter of time until the broker runs out of disk space and then all sorts of fatal scenarios ensue.

It would be very useful if Kafka had a way to quarantine these unexpected failures in certain logs such that they don't affect the cleaning of other logs. While this would not fix the issue, it would significantly slow down the process and provide users with adequate time for detection and repair.

Public Interfaces

Two New Metrics:

  • `uncleanable-partitions-count` (Int) - Count of partitions that are uncleanable
  • `uncleanable-partitions` (String) - Comma-separated names of the partitions that are uncleanable. Example: "2,3,4"

Proposed Changes

Catch any unexpected exceptions in `CleanerThread#cleanOrSleep()`.

Properly log the exception and mark the partition that caused the exception as "uncleanable" in a collection in `LogCleaner`'s `LogCleanerManager`.

When evaluating which logs to compact, skip the marked ones.

Needs Discussion

  • A metric that tracks the overall uncleanable bytes seems like it would be useful. I am not sure how easy that is to implement and I wonder if that functionality (fetching log segments and determining their size) could cause additional errors
  • Should said log directories be marked as "offline log directories" therefore stopping replicas from fetching said partitions?
  • Should we mark disk partitions as offline after a certain number of `IOException`s are caught? (as they imply that something might be wrong with the disk)

Compatibility, Deprecation, and Migration Plan

This KIP should have no compatibility issues.

Rejected Alternatives

If there are alternative ways of accomplishing the same thing, what were they? The purpose of this section is to motivate why the design is the way it is and not some other way.

  • Restart `CleanerThread` - it will most likely inevitably hit the same problem before it is able to compact more
  • Mark disk volumes as "uncleanable" on first encountered error. While this would work, in practice it would not help as most deployments use a single volume. Also, if the error is caused by a bug in the partition itself (as shown by most JIRA issues in the Motivation paragraph), this will unnecessarily stop compaction of all other partitions.
  • No labels