In a recent effort to empirically evaluate a newly-proposed power-aware scheduler for private IaaS clouds we ran into problems obtaining accurate simulation results for two cloud testbeds we were working with. This prompted us to investigate an approach for creating validated, yet light-weight simulation models using an approach inspired by Perturbation theory. The approach augments a simple cloud model with measurements taken from a small subset of an actual production system to produce highly accurate predictions at scale.
The “power manager” we investigate is designed to learn from and validate against production traces with multi-month time frames. The sheer duration of these traces makes it necessary to use faster-than-realtime simulation. Furthermore, we want to make predictions about the performance of the scheduler at larger scale than we can observe. Since we have to luxury of having access to two production-quality testbeds, we are also required to deliver a fully functional scheduler that handles workloads replayed on the real-world clouds flawlessly. This article is meant to be an accessible high-level How-To of our work on “Using Trustworthy Simulation to Engineer Cloud Schedulers” published at IC2E 2015.
Our primary goal is to build light-weight simulation models for our two specific private IaaS clouds to evaluate the power manager. These “clouds” have with 5 and 8 nodes, respectively, and are very small compared to commercial cloud installations. Due to their small size we have the opportunity to get away with a simple model while still achieving high accuracy. Having a production system at hand, we chose an approach inspired by Perturbation theory and start with a parsimonious model (“solvable”, e.g. simple model derived from the architecture overview diagram) of our cloud. We then iteratively perturb (“refine”) the model until the desired level of accuracy is achieved.
We lay out a minimal model with the end goal of evaluating the power manager in mind. The power manager draws on information on node occupancy and modifies the power states of individual nodes in our cloud. Hence, our simulation should accurately reproduce node utilization, occupancy, and power states and should allow for a plug-able scheduling algorithm and faster-than-realtime execution. Anything more than this is optional. Hence, we start with a simple model in which instance requests (and timer events) arrive at a scheduler which places instances on individual nodes. These instances then execute on the node for a fixed duration until they complete. Furthermore, the scheduler observes the system state in fixed intervals (epochs) and may hibernate and wake-up nodes as needed.
From experience working with clouds we also decide to run the simulation in a Monte-Carlo-style fashion which allows for non-determinism when it comes to state-transition times and failures in the system. This is necessary since multiple runs of the same workload – on the same cloud – are still subject to concurrency issues and tend to create similar but not necessarily equal results.
Our Perturbation approach then demands that we validate our model’s predictions at small scale – a single node in our case – against measurements of the real system. As expected, the prediction of the initial model diverge by a 15 percent margin and we enter our first round of iterative “perturbing” of the model. Looking at the logs of the production system versus the simulation, three types of unaccounted overheads stand out: instance setup, instance teardown and node power state changes. We extract these three overheads as variables for our model by storing their empirical distributions and later sampling them during the simulation. “Perturbing” our model by introducing these three variables indeed produces simulation results within 1 percent of the real 1-node cluster. But do these predictions hold when scaling up the simulation without collecting additional samples?
For the avid reader, the unsurprising answer to this question is “yes”. Even predictions made for our cloud with all 8-nodes validate against out-of-sample (i.e. later) measurements taken from the real-world system, with an error in the 1-2 percent range. Interestingly, this “cloud-specific” model for our 8-node cluster is trivially portable to the 5-node cluster and produces equally accurate results by swapping out the three empirical variables with measurements from a single node of the other cluster.
While these results are encouraging, a number of qualifications in order. Most importantly, scaling up a simple model cannot be expected to remain accurate for large systems. Shared resources such as network bandwidth or storage contention will put a cap on linear scaling sooner rather than later. Another aspect worth addressing is the assumption that nodes are homogeneous. Without this assumption, different nodes require different empirical distributions which increases model complexity and the required sample count. This may go to the extreme where each node is represented by it’s own samples, which defies the purpose of the approach. On the other hand, from a methodological perspective there are no restriction on “perturbing” the model further to account for these issues.
A practical takeaway of our Perturbation experiment is that it is indeed possible to build a simulation model that scales with the size of an implementation effort. The parsimonious simulation model is manually designed by the developer, which allows qualitative considerations, and augmented with empirical measurements, which adds quantitative information. The subsequent real-world testing of a component developed with the help of this perturbation model then generates new insights and empirical measurements at scale, which in turn can be fed back into the model by iterative “perturbing”.