Why Do Upgrades Fail and What Can We Do about It?

Abstract. Enterprise-system upgrades are unreliable and often produce downtime or data-loss. Errors in the upgrade procedure, such as broken dependencies, constitute the leading cause of upgrade failures. We propose a novel upgradecentric fault model, based on data from three independent sources, which focuses on the impact of procedural errors rather than software defects. We show that current approaches for upgrading enterprise systems, such as rolling upgrades, are vulnerable to these faults because the upgrade is not an atomic operation and it risks breaking hidden dependencies among the distributed system-components. We also present a mechanism for tolerating complex procedural errors during an upgrade. Our system, called Imago, improves availability in the fault-free case, by performing an online upgrade, and in the faulty case, by reducing the risk of failure due to breaking hidden dependencies. Imago performs an end-to-end upgrade atomically and dependably by dedicating separat...

• Type: Conference
• Year: 2009
• Where: MIDDLEWARE
• Authors: Tudor Dumitras, Priya Narasimhan
• Keywords: Distributed And Parallel Computing, Hidden Dependencies, MIDDLEWARE 2009, Procedural Errors, Upgrade Procedure