Chapter 78. Test Your Disaster Plan
Tanya Reilly
Systems fail. That’s fine. Site reliability is a whole discipline that specializes in anticipating and mitigating failure. We build systems that are observable, introspectable, and recoverable that limit the blast radius of an outage. We design for failure.
Failure planning often includes fallback plans, alternate pathways through our code, and systems or processes that we’ll use when our regular mechanisms fail. A client may retry a failed request, for example, hoping it hits a healthier replica next time. A leader-elected system may move leadership away from an unresponsive server. Fallback plans sometimes involve humans; every time we page an on-caller or take some action in response to an outage, we’re executing a fallback plan.
Our regular pathways are constantly in use. We know they work, and we notice when they fail. Many of our fallback plans are also well-traveled, running so frequently that we’ll find out if they have problems. What about the less-traveled paths? If we only use them during emergencies, we might not find out they don’t work until we really need them.
An extreme illustration of this problem is an industry classic: the gently rotting disaster recovery site. A team anticipates a massive failure of their primary site and builds a replica of their system in another region or another data center. ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access