9 ms·

Hate these X millions / billions per month or year or a centuary. Let’s do the math. So it’s 20B/30 = 660 m / day 660 / 24 ~= 25 m / hour 25000k / 3.6k sec

Hate these X millions / billions per month or year or a centuary. Let’s do the math. So it’s 20B/30 = 660 m / day 660 / 24 ~= 25 m / hour 25000k / 3.6k sec = 8000 events/sec Now peaks got to be larger then these measly 8000 events. Even say peak is 50k/second. Dang an Nginx can serve a web page faster then that on a single modern notebook. CPU won’t even saturate to do that. Or if you were to write them to a consumer grade spinning drive disk at 100mb/s you’d get 50k/s if each event is 2kbytes in size. As usual I’m not impressed.

zeeg 9y ago
We actually do a lot more than 20B (not sure what the number is actually pulled from), but it's also important to note that even 8000 events/sec isn't free. - 40k per event (average, it gets into 2mb territory for some) - streaming processing of everything on the fly - storage/querying of data
- DmitryOlshansky 9y ago
  I hear you, at the same time you have embarassingly parallel problem that can be easily sharded per customer. (Do I understand your service correctly?) Processing 8k * 40k is a feat but I’d think you have more then a few dozens of nodes. Then it gets into ~100s ev/s per node territory. Quite manageable even for e.g. complex search engines to ingress. Of course, it all depends on where your bottlenecks are.
  - the_mitsuhiko 9y ago
    > I hear you, at the same time you have embarassingly parallel problem that can be easily sharded per customer. (Do I understand your service correctly?) The actual event ingestion from an external consumer to our queue is indeed very boring. What makes Sentry internally complex is how incredibly complicated those events can get. For instance before we can make sense of most iOS (as wlel as other native) or JavaScript events we need to go through a fairly complex event processing system. A lot of thought went into making this process very efficient. Also obviously even if a problem like ours can be easily solved in parallel, you don't just want to add more servers you also want to run a reasonably lean operation. Instead of just throwing more machines at the issue we want to make sure we internally do not do completely crazy things but optimize our processes.
    - le-mark 9y ago
      This is an interesting line of discussion. How do you know you are optimally utilizing the hardware you do have? For example, is each machine running at near 100% cpu? Is the network card saturated? Is the database the bottleneck? How about the search indexing operation? What metrics are you tracking and how are you tracking them? If you're at liberty to discuss, it would be highly enlightening!
      - the_mitsuhiko 9y ago
        > How do you know you are optimally utilizing the hardware you do have? That's probably one better to answer for actual ops people. However what we generally do is looking at our metrics to see where we see room for improvement. Two obvious cases we identified and resolved through improving our approaches have been JavaScript sourcemap processing and debug symbol handling. There we knew we were slow based on how far p95 timing was from the average and median. We looked specifically at what problematic event types looked like and what we can do to handle them better. We now use just better approaches to dealing with this data, multiple layers of more intelligent caches and that cut down out event processing time and with it the amount of actual hardware we need. So the answer at least as far as event processing goes: for some cases we spent time on we were CPU bound and knew we can do better and did. I wrote a bit about what we did on our blog where we moved sourcemap processing from Python to Rust. The latests big wins in the processing department have been a rewrite of our dSYM handling where we now use a custom library to preprocess DWARF files and various symbol tables into a more compact format so we can do much faster lookups for precisely the data we are about. > Is the network card saturated? In other cases that has been an issue, but that's less of a problem on the actual workers which are relevant to that number we are discussing here. In particular as far as the load balancers goes there is a ton more data coming in but not all will make it to the system. A non uncommon case is someone deploys our code into a mobile app SDK and then stops paying. The apps will still spam us, but we want to block this off before it hits the expensive parts of the system etc. > Is the database the bottleneck? When is a database not a concern ;) What we are tracking is a ton, how we are tracking is a lot of datadog.
    - DmitryOlshansky 9y ago
Kiro 9y ago
How much is a lot for you? 1 billion/s?
- DmitryOlshansky 9y ago
  At 8k/s given a bunch of hardware a typical cloud service will throw at it it can be down to ~100ev/s per node. Yes I’d like at least 1k/s per node. That’s something interesting.
StavrosK 9y ago
> Hate these X millions / billions per month or year or a centuary. I hear you, I hate misleading examples too. > Dang an Nginx can serve a web page faster then that on a single modern notebook. "What? Your moon-rocket can only fit three people? My couch can do six. I am not impressed."
- DmitryOlshansky 9y ago
  I just gave some examples of what can be done at similar speed on dirt cheap hardware. I my view it helps to understand scale. More real world example an API at my work logs routinely more then 20M+ events per day, all indexed for NRT search. It’s just a byproduct of the actual work though. It’s considered business as usual, nobody counts how it adds up half a billion per month. I assume they index it in some search engine as well. Yeah the scale is x20 bigger, but it’s their _primary_ task.
  - the_mitsuhiko 9y ago
    > More real world example an API at my work logs routinely more then 20M+ events per day, all indexed for NRT search. It’s just a byproduct of the actual work though. But do your events require you to process gigabytes of debug symbol data per event? Or through megabytes of JSON sourcemap data to unobfuscate stacktrace where some operations are not even possible in linear time? Don't forget a Sentry event is not a simple data blob we store. It requires very expensive and complex processing.
    - deleted 9y ago
      [deleted]
    - DmitryOlshansky 9y ago
      Our events are a mess of text that is processed with some convoluted parser to build several cross-reference indexes. At least it allows to piece together events from the same request, etc. But the point is that it’s at best 1% of all the work being done, and it’s not the key problem solved by the system. Parsing a stack frame would be actually in the same ballpark. Yes, processing it would involve maybe a ~100 index lookups to match stack frames to the source etc, but see below. Gigabytes of debug symbols? Such as fitting all in a 1/10 of RAM of a typical server you mean? As a hash table, or heck even a trie so you could do range query as well. Same about a source map. It’s not THAT hard to build a largish lookup table entirely in RAM. Especially if its the MAIN POINT of your business. I’m curious about that non-linear problem with JSON source map. Could you elaborate? Also you don’t need to cross-reference symbols/events across your customers. The lookup is thus limited to a shard of that client which I’d dare say won’t contain gigabytes of debug symbols.
aidos 9y ago
I am impressed. Sentry is a brilliant bit of code available for everyone to download and use. It just works and gets better all the time. And really, in terms of load - at that scale it's all pretty impressive. The payloads are big. They contain the full stack trace along with most the local vars.
ubercore 9y ago
I mean, serving a web page is easy. Processing incoming events and everything else that Sentry does is not trivial. You're not comparing likes to likes.
- notyourday 9y ago
  If that's the case why NH littered with these kinds of issues? https://news.ycombinator.com/item?id=15584315 https://news.ycombinator.com/item?id=15584315
  - ubercore 9y ago
    I mean serving a web page, from nginx, which is what the person was talking about. Not a database-driven web application.
- DmitryOlshansky 9y ago
  Yes, but they don’t run the whole thing on a single laptop do they? Roughly speaking you take what a laptop can do and a multiply it by 1000x to estimate what a cloud service could easily do. (It’s just an estimate, the reality is not working like that, I KNOW) Do not take it as Nginx and webpages example, it’s indeed a poor analogy. I can’t remember the right number for e.g. ElasticSearch fuzzy search across 10m documents of out hand so I’d pick the simpler less relevant number. Actually fuzzy full text search across 10m documents is at least in the range of 100s/sec on a laptop. Meaning that they have resources to do at least e.g. 100k-500k/s full text searches across gigabytes of symbols. I bet their queries are simpler then that though (not fuzzy nor full text). It’s debug symbols after all not a natural text.
shallot_router 9y ago
Serving a static web page 8-50k times per second and doing some really complex processing 8-50k times per second are worlds apart.
ktamura 9y ago
At Treasure Data, we ingest about 1-2 million events per second. Using your #, this translates to ~6 trillion events per month. If you (or anyone on this thread) is interested in learning more, please feel free to ping me.

zeeg 9y ago

We actually do a lot more than 20B (not sure what the number is actually pulled from), but it's also important to note that even 8000 events/sec isn't free. - 40k per event (average, it gets into 2mb territory for some) - streaming processing of everything on the fly - storage/querying of data

DmitryOlshansky 9y ago
I hear you, at the same time you have embarassingly parallel problem that can be easily sharded per customer. (Do I understand your service correctly?) Processing 8k * 40k is a feat but I’d think you have more then a few dozens of nodes. Then it gets into ~100s ev/s per node territory. Quite manageable even for e.g. complex search engines to ingress. Of course, it all depends on where your bottlenecks are.
- the_mitsuhiko 9y ago
  > I hear you, at the same time you have embarassingly parallel problem that can be easily sharded per customer. (Do I understand your service correctly?) The actual event ingestion from an external consumer to our queue is indeed very boring. What makes Sentry internally complex is how incredibly complicated those events can get. For instance before we can make sense of most iOS (as wlel as other native) or JavaScript events we need to go through a fairly complex event processing system. A lot of thought went into making this process very efficient. Also obviously even if a problem like ours can be easily solved in parallel, you don't just want to add more servers you also want to run a reasonably lean operation. Instead of just throwing more machines at the issue we want to make sure we internally do not do completely crazy things but optimize our processes.
  - le-mark 9y ago
    This is an interesting line of discussion. How do you know you are optimally utilizing the hardware you do have? For example, is each machine running at near 100% cpu? Is the network card saturated? Is the database the bottleneck? How about the search indexing operation? What metrics are you tracking and how are you tracking them? If you're at liberty to discuss, it would be highly enlightening!
    - the_mitsuhiko 9y ago
      > How do you know you are optimally utilizing the hardware you do have? That's probably one better to answer for actual ops people. However what we generally do is looking at our metrics to see where we see room for improvement. Two obvious cases we identified and resolved through improving our approaches have been JavaScript sourcemap processing and debug symbol handling. There we knew we were slow based on how far p95 timing was from the average and median. We looked specifically at what problematic event types looked like and what we can do to handle them better. We now use just better approaches to dealing with this data, multiple layers of more intelligent caches and that cut down out event processing time and with it the amount of actual hardware we need. So the answer at least as far as event processing goes: for some cases we spent time on we were CPU bound and knew we can do better and did. I wrote a bit about what we did on our blog where we moved sourcemap processing from Python to Rust. The latests big wins in the processing department have been a rewrite of our dSYM handling where we now use a custom library to preprocess DWARF files and various symbol tables into a more compact format so we can do much faster lookups for precisely the data we are about. > Is the network card saturated? In other cases that has been an issue, but that's less of a problem on the actual workers which are relevant to that number we are discussing here. In particular as far as the load balancers goes there is a ton more data coming in but not all will make it to the system. A non uncommon case is someone deploys our code into a mobile app SDK and then stops paying. The apps will still spam us, but we want to block this off before it hits the expensive parts of the system etc. > Is the database the bottleneck? When is a database not a concern ;) What we are tracking is a ton, how we are tracking is a lot of datadog.
  - DmitryOlshansky 9y ago

Kiro 9y ago

How much is a lot for you? 1 billion/s?

DmitryOlshansky 9y ago
At 8k/s given a bunch of hardware a typical cloud service will throw at it it can be down to ~100ev/s per node. Yes I’d like at least 1k/s per node. That’s something interesting.

StavrosK 9y ago

> Hate these X millions / billions per month or year or a centuary. I hear you, I hate misleading examples too. > Dang an Nginx can serve a web page faster then that on a single modern notebook. "What? Your moon-rocket can only fit three people? My couch can do six. I am not impressed."

DmitryOlshansky 9y ago
I just gave some examples of what can be done at similar speed on dirt cheap hardware. I my view it helps to understand scale. More real world example an API at my work logs routinely more then 20M+ events per day, all indexed for NRT search. It’s just a byproduct of the actual work though. It’s considered business as usual, nobody counts how it adds up half a billion per month. I assume they index it in some search engine as well. Yeah the scale is x20 bigger, but it’s their _primary_ task.
- the_mitsuhiko 9y ago
  > More real world example an API at my work logs routinely more then 20M+ events per day, all indexed for NRT search. It’s just a byproduct of the actual work though. But do your events require you to process gigabytes of debug symbol data per event? Or through megabytes of JSON sourcemap data to unobfuscate stacktrace where some operations are not even possible in linear time? Don't forget a Sentry event is not a simple data blob we store. It requires very expensive and complex processing.
  - deleted 9y ago
    [deleted]
  - DmitryOlshansky 9y ago
    Our events are a mess of text that is processed with some convoluted parser to build several cross-reference indexes. At least it allows to piece together events from the same request, etc. But the point is that it’s at best 1% of all the work being done, and it’s not the key problem solved by the system. Parsing a stack frame would be actually in the same ballpark. Yes, processing it would involve maybe a ~100 index lookups to match stack frames to the source etc, but see below. Gigabytes of debug symbols? Such as fitting all in a 1/10 of RAM of a typical server you mean? As a hash table, or heck even a trie so you could do range query as well. Same about a source map. It’s not THAT hard to build a largish lookup table entirely in RAM. Especially if its the MAIN POINT of your business. I’m curious about that non-linear problem with JSON source map. Could you elaborate? Also you don’t need to cross-reference symbols/events across your customers. The lookup is thus limited to a shard of that client which I’d dare say won’t contain gigabytes of debug symbols.

aidos 9y ago

I am impressed. Sentry is a brilliant bit of code available for everyone to download and use. It just works and gets better all the time. And really, in terms of load - at that scale it's all pretty impressive. The payloads are big. They contain the full stack trace along with most the local vars.

ubercore 9y ago

I mean, serving a web page is easy. Processing incoming events and everything else that Sentry does is not trivial. You're not comparing likes to likes.

notyourday 9y ago
If that's the case why NH littered with these kinds of issues? https://news.ycombinator.com/item?id=15584315 https://news.ycombinator.com/item?id=15584315
- ubercore 9y ago
  I mean serving a web page, from nginx, which is what the person was talking about. Not a database-driven web application.
DmitryOlshansky 9y ago
Yes, but they don’t run the whole thing on a single laptop do they? Roughly speaking you take what a laptop can do and a multiply it by 1000x to estimate what a cloud service could easily do. (It’s just an estimate, the reality is not working like that, I KNOW) Do not take it as Nginx and webpages example, it’s indeed a poor analogy. I can’t remember the right number for e.g. ElasticSearch fuzzy search across 10m documents of out hand so I’d pick the simpler less relevant number. Actually fuzzy full text search across 10m documents is at least in the range of 100s/sec on a laptop. Meaning that they have resources to do at least e.g. 100k-500k/s full text searches across gigabytes of symbols. I bet their queries are simpler then that though (not fuzzy nor full text). It’s debug symbols after all not a natural text.

shallot_router 9y ago

Serving a static web page 8-50k times per second and doing some really complex processing 8-50k times per second are worlds apart.

ktamura 9y ago

At Treasure Data, we ingest about 1-2 million events per second. Using your #, this translates to ~6 trillion events per month. If you (or anyone on this thread) is interested in learning more, please feel free to ping me.