Inside Broker How Broker Leverages the C++ Actor Framework (CAF)

Transcription

1 Inside Broker How Broker Leverages the C++ Actor Framework (CAF) Dominik Charousset inet RG, Department of Computer Science Hamburg University of Applied Sciences Bro4Pros, February

2 What was Broker again? 2

3 Problem at Hand Bro A State Updates Events Logs Bro B User App. 3

4 Traditional Approach Bro A Child Process Child Process Bro B Events libbroccoli 4 Image source: Robin Sommer, BroCon 2015

5 Traditional Issues Persistency issues Possible race conditions with &synchronized Limited control over data flow 5

6 Broker Approach Bro A Broker Broker Bro B Broker Application C C++ Python 6 Image source: Robin Sommer, BroCon 2015

7 Broker Benefits Grant unified access to Bro events Empower users to manage state Provide a global, persistent key/value store 7

8 How does CAF relate to Bro? 8

9 Broker in Context Bro: monitor the network Broker: distribute network insights Events M CAF C C C M C C 9

10 Broker's Goals Provide flexible pub/sub data distribution Enable distributed, deep detection Support data-intense algorithms on realtime events 10

11 Broker's Requirements Efficient communication layer Expressive data model Persistent storage 11

12 Fueling Broker Broker uses CAF to meet its requirements: Structure: endpoints & messages Communication: send & receive Network: connect peers & distribute data 12

13 CAF in a Nutshell Programming interface based on the actor model Configurable runtime for infrastructure software* Emphasis on reliability, efficiency & maintainability *following def. in: Bjarne Stroustroup, Software Development for Infrastructure, IEE Computer 45,

14 What is our vision for a next-gen Bro? 14

15 Deep Detection Correlation in multi-hop processing pipelines Distribution with pub/sub data access Resilience through replicated data stores 15

16 Bro Cluster Internet Tap Local Network Vision Goal: monitor for a next-gen critical communication Bro with CAF. path. Frontend #1: split agile traffic rebalancing into many via netcontrol streams/flows. & broker. Worker Worker Worker #2: #2: (stateful) pub/sub traffic & consensus monitoring instead and protocol of shared analysis. state. Proxy Packets Logs State Manager #3: combine fault-tolerance and post-process & failover worker-generated through snapshotting. logs. 16

17 Leveraging CAF Bro has to grow with user demands Scaling up and out is key to meet future work loads CAF provides building blocks for a next-gen Bro 17

18 What is CAF, exactly? 18

19 Scalable Abstractions Actors avoid race conditions by design Unified API for concurrency & distribution Compose large systems from small components Scale runtime from the IoT up to HPC Microcontrollers Servers Supercomputers 19

20 The Actor Model Asynchronous message passing No shared state Divide & conquer work flow Actor FIFO mailbox Hierarchical failure handling & propagation 20

21 Anatomy of an Actor Actor Processing (Control Loop) Storage (State) Dequeue Message Internal Variables int count; string foo;... Communication (via FIFO mailbox) Invoke Behavior no Message Handlers (Behavior) done? yes [=](int x) { count += x; }... Address to an actor (allows enqueueing of messages) 21

22 CAF's Architecture Node Node Process Actor Message Network CPU GPGPU GPU Actor System Actor System Network Middleman Cooperative Scheduler GPGPU Wrapper Distribution Layer Socket API Thread API OpenCL 22

23 Communication Patterns CAF offers various messaging primitives: Asynchronous "fire & forget" messages Request/response messaging (with timeouts) Pub/sub-based group communication Streaming pipelines (soon-ish) 23

24 CAF Facts Sheet Developed at inet research group First commit: March 4, 2011 Active international community > 40,000 lines of code ( 24

25 What is next? 25

26 Streaming Streams as first-class citizen in CAF Priority-aware message processing Re-deployable actor pipelines with back pressure 26

27 Streaming Concept data flows downstream source stage sink demand flows upstream errors are propagated both ways 27

28 Streaming Bro Events Critical realtime data import. CAF Application Besteffort file imports Server Parser Worker 28

29 High-level Clustering Declarative API for deploying actors & pipelines Dynamic redeployment & -configuration Monitoring of running CAF applications 29

30 Debugging Support Debugging distributed applications is challenging CAF's logs can reproduce causal ordering Visualization helps devs understand their system, e.g., with ShiViz: 30 Image source:

31 ShiViz* UI with CAF App. 31 * see:

32 Tracing Lightweight monitoring of data flows Captures causal and temporal ordering of events Recording (debugging) or sampling (monitoring) 32

33 Tracing: Example Monitor Inject Annotated Request N4 (N4, N5, N6, N2, N1) (N4) N1 N5 (N4, N5, N6, N2) N3 (N4, N5) N7 N2 (N4, N5, N6) N6 33

34 Tracing: Visualization Path in the system Causal and temporal relationship User X Response (time) Frontend Request A Request rpc1 rpc2 rpc1 Management B C rpc2 rpc3 rpc4 rpc3 Backend D E rpc4 Fig. mod. from: Benjamin Sigelman et al., Dapper, a Large-Scale Distributed Systems Tracing Infrastructure, Google Technical Report,

35 Thanks for Listening bro/broker actor-framework actor_framework 35