advanced26 min studyLesson 415 in Engineering

Reconstruct how one failure can become many symptoms

Trace retries, fan-out, queues, and shared dependencies in a fictional inference service without mistaking span order or downstream symptoms for causal proof.

On this page

What you’ll understand

  • Separate logical user requests from downstream attempts and fan-out.
  • Calculate a bounded retry-load model under declared independence.
  • Use trace and resource evidence to test a proposed propagation path.

One user-visible failure can produce a constellation of alerts across services. A slow feature lookup may retain inference workers, trigger retries, overload a connection pool, and delay telemetry itself. Reconstructing this propagation is more useful than declaring every alert an independent cause. Follow the actual dependency and resource path, distinguish logical operations from repeated attempts, and compare the predicted amplification with measured counters. The worked service and its numbers are fictional, with explicit simplifying assumptions rather than claims about a real outage.

Trace structure is evidence with a collection model

Trace identifiers and parent-child relationships help connect recorded work across services, provided context propagation and instrumentation are correct. A missing child span can reflect sampling, export loss, an uninstrumented hop, or work that never began. A parent span can include waiting, retries, and parallel children, so summing every child duration can double-count elapsed time. Establish whether the identifiers denote one logical request, one attempt, or a batch before using the trace to count work or locate the critical path.

W3C Trace Context standardizes propagation fields; it does not certify that a recorded relationship is an experimentally established cause of the incident. Compare traces with request counters, queue occupancy, version evidence, and resource metrics. Account for clock uncertainty before interpreting cross-host timestamps. Also include shared dependencies outside the apparent request tree, such as a host-level memory limit, model-loading storage, or a collector that competes with application work. The instrumented graph can omit the resource that actually couples the symptoms.

E[A]=1+q+q2\mathbb{E}[A]=1+q+q^2
For one downstream logical call with at most three attempts, each attempted call independently fails with probability q and retries occur only after failure. A counts actual attempts. The dimensionless expectation assumes no cancellation, backoff suppression, or shared correlated failures.↔ Scroll wide equations horizontally.

Retry amplification needs the correct counting boundary

A user request may fan out to several downstream calls, each with its own retry policy. A retry at an outer layer can repeat an entire fan-out, while a retry within one child repeats only that child. These are different load multipliers. Read the actual client and proxy policies, including maximum attempts, deadlines, and which failures are retryable. Reporting two retries as two total attempts is another common off-by-one error: an initial attempt plus two retries is three attempts.

A simple expectation can estimate work when assumptions are declared, but overload often creates dependence and feedback. More attempts increase queueing, which causes more timeouts, which induce more attempts. A fixed independent failure probability then stops describing the system. Measure attempts per logical operation and useful success separately. A mitigation that reduces retries may improve capacity while changing user-visible completion behavior, so verify those outcomes rather than presenting a lower downstream request rate as proof that the underlying dependency recovered.

λdownstream=fλuserE[A]\lambda_{\rm downstream}=f\lambda_{\rm user}\mathbb{E}[A]
f is a fixed number of child logical calls per user request, λ_user is user requests per second, and the result is downstream attempts per second. This expectation model assumes the stated attempt boundary and steady workload; it omits outer retries, feedback, batching, and shared-failure dependence.↔ Scroll wide equations horizontally.

A propagation claim should predict a measurable edge

If feature-service delay is alleged to exhaust inference workers, identify the retained resource and predict how its occupancy changes with delay and concurrency. Then inspect a control path that does not use that dependency, along with local worker and downstream evidence. A dashboard that turns red later is consistent with propagation but also with smoothing delay or a shared host failure. Record contradictory observations, such as unaffected requests sharing the same supposed bottleneck, and refine the model rather than removing them from the narrative.

The queue lab shows a normalized resource imbalance only. Reset, set both λ=3 and μ=2, predict the growth from four initial work units, then Play or Step. Reset again and set both λ=2,μ=3 for a separate drain comparison. Edits retain elapsed time and recompute from the initial four, rather than switching live rates. The model has no dependency graph, retries, finite worker pool, or causality test. Use its visible imbalance to motivate measuring actual retained work along the proposed propagation path.

Estimate one explicitly bounded retry layer

A fictional service receives 100 user requests per second and makes four child calls per request. Each child allows up to three attempts, with independent per-attempt failure probability 0.2. No outer retries or cancellations occur.

  1. For one child call, expected attempts are 1 + 0.2 + 0.2² = 1.24. The second and third attempts occur only if the preceding failures require them.

  2. There are 100×4 = 400 logical child calls per second, giving 400×1.24 = 496 expected downstream attempts per second under the model.

  3. The all-three-attempts bound is 400×3 = 1,200 attempts per second. If failures correlate under overload or an outer layer retries the fan-out, the 496 expectation no longer follows from the supplied independent model.

The result

The declared model predicts 496 attempts per second, distinct from 400 logical child calls and a 1,200-attempt worst-case count for this one bounded layer.

Explore the model

Interactive lab

Interactive lab · queue

A symptom can be retained work behind a dependency

For each fresh comparison, Reset, set both λ and μ, predict growth or drainage from four normalized items, then Play or Step. There are no retries, dependency edges, worker limits, or causal inference in this fluid instrument.

A symptom can be retained work behind a dependencyFluid backlog starts at 4 and follows max(0, 4 + (λ − μ)t). The separate M/M/1 residence-time formula assumes Poisson arrivals, exponential service and λ < μ. Current readings: Fluid backlog: 4; Net rate · λ − μ: −1 /s; M/M/1 mean residence: 1 s. All parameters are adjustable with the labeled controls below.02.557.51001.534.56Elapsed time · sFluid backlogλ < μ
Fluid backlogCurrent time
Fluid backlog
4
Net rate · λ − μ
−1 /s
M/M/1 mean residence
1 s
t = 0 s

Fluid backlog starts at 4 and follows max(0, 4 + (λ − μ)t). The separate M/M/1 residence-time formula assumes Poisson arrivals, exponential service and λ < μ. Parameter changes pause playback and recompute the model at the current elapsed time. Reset restores both parameters and returns time to zero. Playback starts paused. Adjust either parameter, then choose Play or Step.

Look forPropagation explanations connect logical attempts to specific resources and testable occupancy changes.

Check your understanding

A trace shows a slow child span and a long parent span. What additional evidence is needed before blaming the child for the incident?

Try it yourself

A workload makes two child calls for each of 50 user requests per second. Each child allows three attempts with independent failure probability 0.5. Compute expected attempts per second and explain one reason the estimate can fail during overload.

Take a moment to make a prediction or work it out on paper. Open a hint when you need one.

Give me a hint

Use 1+q+q² for one child, then multiply by logical child-call rate.

Compare with the solution

Expected attempts per child are 1 + 0.5 + 0.25 = 1.75. The logical child rate is 50×2 = 100 per second, so expected attempts are 175 per second. During overload, timeouts and retries can depend on shared queues and one another, invalidating the fixed independent q assumption. Outer retries, cancellation, or changing fan-out would also change the counting boundary.

Take it with you

  • Trace relationships need attempt, sampling, timing, and instrumentation context.
  • Fan-out and bounded retries can amplify logical traffic under explicit assumptions.
  • A propagation mechanism predicts resource evidence beyond merely ordered alerts.

Read further

Original sources and deeper explanations to follow at your own pace.

Optional progress, saved in this browser when available. Revisit any lesson at any time.

Lesson not marked complete.