Microreboot – A Technique for Cheap Recovery
📜 Abstract
A significant fraction of software failures in large-scale Internet systems are cured by rebooting, even when the exact failure causes are unknown. However, rebooting can be expensive, causing nontrivial service disruption or downtime even when clusters and failover are employed. In this work we use separation of process recovery from data recovery to enable microrebooting – a fine-grain technique for surgically recovering faulty application components, without disturbing the rest of the application. We evaluate microrebooting in an Internet auction system running on an application server. Microreboots recover most of the same failures as full reboots, but do so an order of magnitude faster and result in an order of magnitude savings in lost work. This cheap form of recovery engenders a new approach to high availability: microreboots can be employed at the slightest hint of failure, prior to node failover in multi-node clusters, even when mistakes in failure detection are likely; failure and recovery can be masked from end users through transparent call-level retries; and systems can be rejuvenated by parts, without ever being shut down.
✨ Summary
Summary
The paper introduces microrebooting, a recovery technique that restarts only a faulty application component rather than an entire process, virtual machine, or node. It relies on fine-grained component isolation, externalized persistent and session state, loosely coupled dependencies, retryable requests, and lease-based resource management. The prototype extends JBoss and converts the RUBiS auction application into a crash-only system. Experiments show that component microreboots recover most tested application-level failures, typically in roughly 0.4–0.8 seconds, compared with approximately 19 seconds for a JVM/JBoss restart. Under the tested workload, microreboots reduced failed requests by 98%, preserved session state held outside the rebooted component, maintained more stable cluster response times, and enabled memory-leak rejuvenation without taking the application fully offline. The approach was less effective for failures involving the JVM, operating system, external unmanaged resources, persistent database corruption, or unsafe shared state.
Research influence
Subsequent research explicitly cited the paper as the basis for fine-grained recovery work in legacy storage-controller software. Seshadri and colleagues extended the idea from component restart toward dynamic, thread-level state restoration using dependency tracking and recovery protocols. (usenix.org) Otherworld later applied the microreboot concept at the operating-system-kernel level, preserving running applications while replacing a failed kernel. (usenix.org) The concept also became part of the broader recovery-oriented and self-healing-systems research literature. (onlinelibrary.wiley.com) The quick search found clear evidence of continued research use, but did not establish a specific commercial deployment attributable directly to this paper.