1. 5/13/20151 PSU’s CS 587 16…. Recovery - Review (only for DB with updates…..!)  ACID: Atomicity & Durability  Trading execution time for recovery time  Mechanics of recovery  What is recovered and how  Write ahead logging  Mechanics of logging  Big Picture

2. 5/13/20152 PSU’s CS 587 Learning Objectives  Describe Force and No Steal policies and their implications  Describe write ahead log, commit and abort  What is the role of each element in crash recovery  LSN, before image, after image, FlushedLSN, pageLSN, dirty page table, transaction table, checkpoint  Be able to carry out the three phases of crash recovery in a simple example.

3. 5/13/20153 PSU’s CS 587 Review: The ACID properties  A  A tomicity:All actions in the transaction happen in their entirety or none of them happen.  C  C onsistency: If each transaction is consistent, and the DB starts in a consistent state, it ends in a consistent state.  I  I solation: Execution of one transaction is isolated from that of other transactions.  D  D urability: If a transaction commits, its effects persist. Recovery System Recovery System Concurrency Control System Programmers

4. 5/13/20154 PSU’s CS 587 Simple solutions to Crash Recovery  The crash recovery subsystem has two problems to solve, atomicity and durability. Here are some really simple ways to handle them.  Atomicity  Example: Deposit $100 into A, withdraw $100 from B. The OS crashes after $100 is deposited to A. The recovery manager must undo the deposit.  Solution (NO STEAL): Make sure no updates (e.g. the deposit) are written to disk until the transaction commits. The transaction will disappear when the OS crashes.  Durability  Same example, now the OS crashes after the commit and before the withdrawal was written to disk.  Solution (FORCE): Write every update to disk just before the transaction commits.

5. 5/13/20155 PSU’s CS 587 Why these simple solutions don’t work  No Steal: keep updates in memory until commit  If DBMS doesn’t steal, memory is full of updates and other transactions are starved for memory. Poor throughput.  Force: write all updates to disk immediately on commit  Force keeps the disk too busy and results in poor response time. The records being updated may be hot spots.  Why do you have to warn your OS before removing an external device? Because of the OS’s No Force Policy. Force No Force No Steal Steal Slow Execution; Easy recovery Fast Execution; Tough Recovery

6. 5/13/20156 PSU’s CS 587 The solution  Given that we are faced with the No Force and Steal policies, the crash recovery subsystem of every DBMS uses a Write Ahead Log (WAL) to manage crash recovery (and aborts also).  The WAL is put on a separate disk from the data (why?). It begins from each backup, which is typically taken each day.  A log record is written for every insert, update, delete, begin-trans, commit, abort and checkpoint.  A log record contains before image after image

7. 5/13/20157 PSU’s CS 587 Write Ahead Log (WAL) To be a write ahead log, the log must obey these rules: The atomicity rule: the log entry for an insert, update or delete must be written to disk before the change is made to the DB The durability rule: All log entries for a transaction must be written to disk before the commit record is written to disk.

8. 5/13/20158 PSU’s CS 587 Practice with a log  What did each transaction do before the crash?  After a crash, what should the recovery manager do to ensure that each transaction is atomic?   What guarantees that your solution (UNDO) will work?  After a crash, what should the recovery manager do to ensure that each transaction is durable?   What guarantees that your solution (REDO) will work? T1,A,update,100,200 T2,C,update,1000,500 T2,D,update,500,1000 T2,commit CRASH

9. 5/13/20159 PSU’s CS 587 Practice with a log  What must a recovery manager do after a crash to ensure the atomic and durability properties of ACID?  What are the final values of A and D?  Does the recovery manager return the DB to its state at the time of the crash? T1,A,update,’abc’,’de’ T1,A,update,’de’,’ab’ T2,D,update,10,0 T2,commit CRASH

10. 5/13/201510 PSU’s CS 587 Real recovery is more complicated  We have ignored many complexities in crash recovery  Managing normal aborts, some of which may be in progress at the time of the crash  Managing inserts and deletes  Supporting multiple lock levels  Managing updates to structures like B+ trees when pages split  Handling crashes that happen in the middle of recovery  In the early days of DBMSs many inflexible, inefficient and even incorrect recovery algorithms were implemented.

11. 5/13/201511 PSU’s CS 587 ARIES  In the early 1990s, C. Mohan of IBM proposed a relatively simple recovery algorithm called ARIES*  ARIES differs from our simple model in a few ways  It redoes every update, not just those of committed transactions. This simplifies the algorithm.  It logs changes when normal aborts are undone. This handles recovery for normal aborts.  It logs undos during recovery. This handles crashes during recovery.  And…. * Algorithms for Recovery and Isolation Exploiting Semantics

12. 5/13/201512 PSU’s CS 587 ARIES Runs in Phases Three phases. 1.Figure out which transactions are incomplete (ANALYSIS). 2.REDO actions for all transactions. 3.UNDO all actions of incomplete transactions. Start of log CRASH A RU time

13. 5/13/201513 PSU’s CS 587 ARIES Uses Checkpoints  Typically a backup is taken each night and the log begins anew each morning. If there is a crash in the afternoon, it may take hours to recover. This is unacceptable.  So the DBMS periodically (like every few minutes) takes a checkpoint.  At a checkpoint* the DBMS writes all dirty pages to disk and writes to the log a checkpoint record containing the IDs of all active transactions.  Then the recovery algorithm can begin at the last checkpoint and recovery is much faster. *This is not the text/ARIES definition of checkpoint but it is what most real DBMSs use

14. 5/13/201514 PSU’s CS 587 ARIES Phases with Checkpoints Start from a checkpoint. 1.Figure out which transactions are incomplete (ANALYSIS). 2.REDO all actions since the checkpoint. 3.UNDO all actions of incomplete transactions. Last chkpt CRASH A RU time

15. 5/13/201515 PSU’s CS 587 Practice with a log  What does ARIES do?  Why doesn’t ARIES REDO T4’s actions before the checkpoint?  Why does UNDO process log entries before the checkpoint? CHECKPOINT T3,T4 active T1,A,update,’ABC’,’DEF’ T3,X,update,’ABC’,DEF’ T2,C,update,1000,500 T4,Y,update,4.1,5.2 T2,D,update,500,1000 T4,commit T1,A,update,’DEF’,’GHI’ T2,commit CRASH

16. 5/13/201516 PSU’s CS 587 Using the WAL to manage aborts  We have seen that a Write Ahead Log, with ARIES, makes atomicity and durability easy to achieve.  A Write Ahead Log also makes transaction abort simple. A transaction does not have to keep track of the changes it has made to the DB so it can undo them in case of abort. It just looks at the Write Ahead Log!

17. 5/13/201517 PSU’s CS 587 Aborting a transaction  Note that this is normal processing – no crash in sight  What actions must the DBMS take to abort T1?   In what order should these actions be taken?   What guarantees that all of T1’s changes to the DB have been undone?   What if the update to B was not written to disk?  T1,A,update,’ABC’,’DEF’ T2,C,update,1000,500 T2,D,update,500,1000 T1,B,update,300,400 T1,A,update,’DEF’,’GHI’ T1,abort

18. 5/13/201518 PSU’s CS 587 Chapter 18: Crash Recovery  Write-Ahead Log  ARIES Algorithm  Parameters LSN, pageLSN, FlushedLSN  Log Record Details PrevLSN, Before_image, After_image, CLR  Transaction Table, Dirty Page Table  Checkpointing  Examples  Analysis, Redo, Undo

19. 5/13/201519 PSU’s CS 587 Crash Recovery Review: The ACID properties  A  A tomicity: All actions in the Xact happen, or none happen.  C  C onsistency: If each Xact is consistent, and the DB starts consistent, it ends up consistent.  I  I solation: Execution of one Xact is isolated from that of other Xacts.  D  D urability: If a Xact commits, its effects persist.  The Recovery Manager guarantees Atomicity & Durability. 18. Crash

20. 5/13/201520 PSU’s CS 587 Basic Idea: Logging  We’ll study the ARIES algorithms. Algorithm for Recovery and Isolation Exploiting Semantics  Record REDO and UNDO information, for every update, in a log.  Sequential writes to log (put it on a separate disk).  Minimal info (diff) written to log, so multiple updates fit in a single log page.  Log: An ordered list of REDO/UNDO actions  Log record contains:  and additional control info (which we’ll see soon). 18. Crash

21. 5/13/201521 PSU’s CS 587 Example Log 10 update: T1 writes P5 20 update: T1 writes P3 30 T1 commit 40 T1 end 50 update: T3 writes P1 60 update: T3 writes P3 CRASH, RESTART  LSN

22. 5/13/201522 PSU’s CS 587 Write-Ahead Logging (WAL)  The Write-Ahead Logging Protocol:  Must force the log record for an update before the corresponding data page gets to disk. ‚ Must write all log records for a Xact before commit.  #1 guarantees Atomicity.  #2 guarantees Durability.  Exactly how is WAL managed? Key idea is PageLSN 18. Crash

23. 5/13/201523 PSU’s CS 587 Motivation: PageLSN  At any time, memory contains database, log pages  Changes to database records are reflected in log records  Suppose a database page is to be written to disk  Must find all in-memory log records for changes to records on that database page  Must write their log pages sequentially, before the database page  How to keep track of those log records ?  Keep the last, largest, of the log records for that page  Called PageLSN  Stored with that page, in memory and in database  Important conclusions:  If Log entry# PageLSN is on disk, it’s safe to write the database page  A log entry, with LSN <= the PageLSN on disk, has been written to disk.

24. 5/13/201524 PSU’s CS 587 WAL & the Log  Each log record has a unique Log Sequence Number (LSN).  LSNs always increasing.  Each data page contains a pageLSN.  The LSN of the most recent log record for an update to that page.  System keeps track of flushedLSN.  The max LSN flushed so far.  WAL: Before a page is written,  pageLSN  flushedLSN LSNs DB pageLSNs RAM flushedLSN pageLSN Log records flushed to disk “Log tail” in RAM 18. Crash

25. 5/13/201525 PSU’s CS 587 Log Records Possible log record types:  Update  Commit  Abort  End (signifies end of commit or abort)  Compensation Log Records (CLRs)  for UNDO actions prevLSN XID type length pageID offset before-image after-image LogRecord fields: update records only 18. Crash LSN

26. 5/13/201526 PSU’s CS 587 Compensation Log Records  A CLR is written whenever an update is undone  A CLR represents a change to the database  CLRs are redone but not undone  Each CLR contains a field undoNextLSN  The LSN of the next log record to be undone

27. 5/13/201527 PSU’s CS 587 Key ARIES Ideas  Write Ahead Logging  We’ve seen how that is managed with PageLSN  Enables atomicity and durability with the other two ideas  REDO of committed Xacts  Why is it needed?  What does it involve?  UNDO of uncommitted Xacts  Why is it needed?  What does it involve?

28. 5/13/201528 PSU’s CS 587 Motivation: recLSN  A page in memory contains many records  Some records may be dirty, making the page dirty.  During recovery, need to redo dirty records in dirty pages  Problem: where in log to start redoing?  Answer: earliest log record of all dirty records  Called recLSN  Stored in dirty page table  Important conclusion:  All updates before recLSN are clean

29. 5/13/201529 PSU’s CS 587 Other Log-Related State in Memory  Dirty Page Table:  One entry per dirty page in buffer pool.  Contains recLSN -- the LSN of the log record which first caused the page to be dirty.  Transaction Table:  One entry per active Xact.  Contains XID, status (running/commited/aborted), and lastLSN. 18. Crash

30. 5/13/201530 PSU’s CS 587 Normal Execution of an Xact  Series of reads & writes, followed by commit or abort.  We will assume that write is atomic on disk. In practice, additional details to deal with non-atomic writes.  Strict 2PL.  STEAL, NO-FORCE buffer management, with Write-Ahead Logging. 18. Crash

31. 5/13/201531 PSU’s CS 587 Checkpointing  Periodically, the DBMS creates a checkpoint, in order to minimize the time taken to recover in the event of a system crash. Write to log:  begin_checkpoint record: Indicates when chkpt began.  end_checkpoint record: Contains current Xact table and dirty page table. This is a `fuzzy checkpoint’: Other Xacts continue to run; so these tables are accurate only as of the time of the begin_checkpoint record. No attempt to force dirty pages to disk; effectiveness of checkpoint limited by oldest unwritten change to a dirty page. (So it’s a good idea to periodically flush dirty pages to disk!)  Store LSN of chkpt record in a safe place ( master record). 18. Crash

32. 5/13/201532 PSU’s CS 587 The Big Picture: What’s Stored Where DB Data pages each with a pageLSN Xact Table lastLSN status Dirty Page Table recLSN flushedLSN RAM prevLSN XID type length pageID offset before-image after-image LogRecords LOG master record 18. Crash LSN

33. 5/13/201533 PSU’s CS 587 Example: Log P5 P6 P7 PgID recLSN DIRTY PAGE TABLE XID lastLSN T1 T2 TRANSACTION TABLE T1 update P5 3 21 ABC DEF T2 update P6 3 41 HIJ KLM T2 update P5 3 10 GDE QRS T1 update P7 3 21 TUV WXY T1 abort prevLSN XID Type PgID length offset before after LOG LSN 10 20 30 40 50 Undo nextLSN

34. 5/13/201534 PSU’s CS 587 Simple Transaction Abort  For now, consider an explicit abort of a Xact.  No crash involved.  We want to “play back” the log in reverse order, UNDO ing updates.  Get lastLSN of Xact from Xact table.  Can follow chain of log records backward via the prevLSN field.  Before starting UNDO, write an Abort log record. For recovering from crash during UNDO! 18. Crash

35. 5/13/201535 PSU’s CS 587 Abort, cont.  To perform UNDO, must have a lock on data.  No problem!  Before restoring old value of a page, write a CLR:  You continue logging while you UNDO!!  CLR has one extra field: undonextLSN Points to the next LSN to undo (i.e. the prevLSN of the record we’re currently undoing).  CLRs never Undone (but they might be Redone when repeating history: guarantees Atomicity!)  At end of UNDO, write an “end” log record. 18. Crash

36. 5/13/201536 PSU’s CS 587 Transaction Commit  Write commit record to log.  Release all locks  All log records up to Xact’s lastLSN are flushed.  Guarantees that flushedLSN  lastLSN.  Note that log flushes are sequential, synchronous writes to disk.  Many log records per log page.  Commit() returns.  Write end record to log. 18. Crash

37. 5/13/201537 PSU’s CS 587 Crash Recovery: Big Picture v Start from a checkpoint (found via master record). v Three phases. Need to: –Figure out which Xacts committed since checkpoint, which failed (Analysis). –REDO all actions. u (repeat history) –UNDO effects of failed Xacts. Oldest log rec. of Xact active at crash Smallest recLSN in dirty page table after Analysis Last chkpt CRASH A RU 18. Crash

38. 5/13/201538 PSU’s CS 587 Recovery: The Analysis Phase  Reconstruct state at checkpoint.  via end_checkpoint record.  Scan log forward from checkpoint.  End record: Remove Xact from Xact table.  Other records: Add Xact to Xact table, set lastLSN=LSN, change Xact status on commit.  Update record: If P not in Dirty Page Table, Add P to D.P.T., set its recLSN=LSN. 18. Crash

39. 5/13/201539 PSU’s CS 587 Example: Log PgID recLSN DIRTY PAGE TABLE XID lastLSN TRANSACTION TABLE prevLSN XID Type PgID length offset before after LOG Undo nextLSN  Assume P6 (only) written to disk. What is its PageLSN?  Assume LSN60 (only) not written to disk. What if P3 was written to disk?

40. 5/13/201540 PSU’s CS 587 Recovery: The REDO Phase  We repeat History to reconstruct state at crash:  Reapply all updates (even of aborted Xacts!), redo CLRs.  Scan forward from log rec containing smallest recLSN in D.P.T. For each CLR or update log rec LSN, REDO the action unless:  Affected page is not in the Dirty Page Table, or  Affected page is in D.P.T., but has recLSN > LSN, or  pageLSN (in DB)  LSN.  To REDO an action:  Reapply logged action.  Set pageLSN to LSN. No additional logging! 18. Crash

41. 5/13/201541 PSU’s CS 587 Example: Log P5 10 P6 20 P7 40 PgID recLSN DIRTY PAGE TABLE XID lastLSN T1 40 TRANSACTION TABLE prevLSN XID Type PgID length offset before after LOG Undo nextLSN  Assume P6 (only) written to disk.

42. 5/13/201542 PSU’s CS 587 Recovery: The UNDO Phase ToUndo={ l | l a lastLSN of a “loser” Xact} Repeat:  Choose largest LSN among ToUndo.  If this LSN is a CLR and undonextLSN==NULL Write an End record for this Xact.  If this LSN is a CLR, and undonextLSN != NULL Add undonextLSN to ToUndo  Else this LSN is an update. Undo the update, write a CLR, add prevLSN to ToUndo. Until ToUndo is empty. 18. Crash

43. 5/13/201543 PSU’s CS 587 Example begin_checkpoint end_checkpoint update: T1 writes P5 update T2 writes P3 T1 abort CLR: Undo T1 LSN 10 T1 End update: T3 writes P1 update: T2 writes P5 LSN LOG 00 05 10 20 30 40 45 50 60 prevLSNs 18. Crash PgID recLSN DIRTY PAGE TABLE XID lastLSN TRANSACTION TABLE

44. 5/13/201544 PSU’s CS 587 Example: Crash During Restart! begin_checkpoint, end_checkpoint update: T1 writes P5 update T2 writes P3 T1 abort CLR: Undo T1 LSN 10, T1 End update: T3 writes P1 update: T2 writes P5 CRASH, RESTART CLR: Undo T2 LSN 60 CLR: Undo T3 LSN 50, T3 end CRASH, RESTART CLR: Undo T2 LSN 20, T2 end LSN LOG 00,05 10 20 30 40,45 50 60 70 80,85 90 Xact Table lastLSN status Dirty Page Table recLSN flushedLSN ToUndo undonextLSN RAM 18. Crash

45. 5/13/201545 PSU’s CS 587 Additional Crash Issues  What happens if system crashes during Analysis? During REDO ?  How do you limit the amount of work in REDO ?  Flush asynchronously in the background.  Watch “hot spots”!  How do you limit the amount of work in UNDO ?  Avoid long-running Xacts. 18. Crash

46. 5/13/201546 PSU’s CS 587 Summary of Logging/Recovery  Recovery Manager guarantees Atomicity & Durability.  Use WAL to allow STEAL/NO-FORCE w/o sacrificing correctness.  LSNs identify log records; linked into backwards chains per transaction (via prevLSN).  pageLSN allows comparison of data page and log records. 18. Crash

47. 5/13/201547 PSU’s CS 587 Summary, Cont.  Checkpointing: A quick way to limit the amount of log to scan on recovery.  Recovery works in 3 phases:  Analysis: Forward from checkpoint.  Redo: Forward from oldest recLSN.  Undo: Backward from end to first LSN of oldest Xact alive at crash.  Upon Undo, write CLRs.  Redo “repeats history”: Simplifies the logic! 18. Crash