mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-24 15:00:43 +02:00
* mount: bound each filer call so a wedged filer cannot hold the failover walk WithFilerClient callers run their RPCs on context.Background(), so a filer whose transport stalls without refusing (stopped peer, black-holed connection) blocks the call forever and the walk never reaches the remaining filer addresses. Run each attempt under a timeout; on expiry drop the cached channel so the abandoned call is unblocked and the next address is tried. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * mount: time out wedged mutation streams and rotate to the next filer doUnary and Rename wait on stream Send/Recv under context.Background(); a dead transport never delivers an error, so writes hang without ever reaching the unary fallback. Bound the waits and tear the stream down on timeout; teardown also advances the sticky filer index so the next stream opens against a different filer instead of redialing the dead one. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * mount: cover filer failover past a wedged filer Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * mount: cancel filer attempts by context and unwind them before retry Review follow-ups on the filer failover: - callFiler derives a per-attempt context instead of only abandoning the wait, so a timed-out attempt's RPCs die on their own without tearing down the shared cached channel. The walk now also waits for the attempt's callback to unwind before trying the next filer, so two runs of the same closure cannot race on the caller's captured results. Callbacks that ignore the attempt context are still forced out by dropping the channel, as a last resort after a grace period. - teardownStream captures the dying stream's filer index and rotates it while holding m.mu, so it can never rotate a successor generation's filer by mistake. - The unary rename fallback bounds silence on its dedicated stream the way the mux does, instead of trusting Recv on a wedged filer. - downloadRemoteEntry opts out of the metadata-call bound: a healthy whole-file download can legitimately outlast it. * mount: count only wire silence against the rename timeout Applying a rename event can outlast the silence bound on a healthy filer — a directory rename migrates an open child's DLM lock under another writer. Stop the mux's response timer for the local work and re-arm it before the next wait; the fallback stream's watchdog defers while the handler runs instead of cancelling a live stream. * mount: restart the rename fallback's silence bound after each event The bound covers the wait for the next response, not the rename's whole lifetime — a healthy rename that keeps sending events can outlast it. Re-arm after each handled event; the defer-while-handling stays for local work that outlasts the interval on its own. --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
154 lines
4.4 KiB
Go
154 lines
4.4 KiB
Go
package mount
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"sync/atomic"
|
|
"time"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/glog"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
)
|
|
|
|
const (
|
|
// Default quota check interval
|
|
defaultQuotaCheckInterval = 61 * time.Second
|
|
// Faster check interval when approaching quota (within 10%)
|
|
fastQuotaCheckInterval = 5 * time.Second
|
|
// Threshold for switching to fast check (90% of quota)
|
|
quotaWarningThreshold = 0.9
|
|
)
|
|
|
|
// uncommittedBytes tracks bytes written locally but not yet reflected in filer statistics.
|
|
// This is used for real-time quota enforcement between periodic checks.
|
|
var uncommittedBytes int64
|
|
|
|
// AddUncommittedBytes adds bytes to the uncommitted write counter.
|
|
// Called when data is written to the mount.
|
|
func (wfs *WFS) AddUncommittedBytes(bytes int64) {
|
|
if wfs.option.Quota > 0 {
|
|
atomic.AddInt64(&uncommittedBytes, bytes)
|
|
}
|
|
}
|
|
|
|
// SubtractUncommittedBytes subtracts bytes from the uncommitted counter.
|
|
// Called when data is flushed to filer or on quota refresh.
|
|
func (wfs *WFS) SubtractUncommittedBytes(bytes int64) {
|
|
if wfs.option.Quota > 0 {
|
|
current := atomic.AddInt64(&uncommittedBytes, -bytes)
|
|
// Don't let it go negative
|
|
if current < 0 {
|
|
atomic.StoreInt64(&uncommittedBytes, 0)
|
|
}
|
|
}
|
|
}
|
|
|
|
// ResetUncommittedBytes resets the counter after a quota check syncs with filer.
|
|
func (wfs *WFS) ResetUncommittedBytes() {
|
|
atomic.StoreInt64(&uncommittedBytes, 0)
|
|
}
|
|
|
|
// GetUncommittedBytes returns the current uncommitted byte count.
|
|
func (wfs *WFS) GetUncommittedBytes() int64 {
|
|
return atomic.LoadInt64(&uncommittedBytes)
|
|
}
|
|
|
|
// IsOverQuotaWithUncommitted checks if quota is exceeded including uncommitted writes.
|
|
// This provides real-time quota enforcement between periodic checks.
|
|
func (wfs *WFS) IsOverQuotaWithUncommitted() bool {
|
|
if wfs.option.Quota <= 0 {
|
|
return false
|
|
}
|
|
if wfs.IsOverQuota {
|
|
return true
|
|
}
|
|
// Check if uncommitted writes would exceed quota
|
|
uncommitted := atomic.LoadInt64(&uncommittedBytes)
|
|
_, usedSize := wfs.diskSizes()
|
|
return (int64(usedSize) + uncommitted) > wfs.option.Quota
|
|
}
|
|
|
|
func (wfs *WFS) loopCheckQuota() {
|
|
|
|
// Skip quota checking if no quota is set
|
|
if wfs.option.Quota <= 0 {
|
|
return
|
|
}
|
|
|
|
// Check quota immediately on mount, don't wait for first interval
|
|
wfs.checkQuotaOnce()
|
|
|
|
for {
|
|
// Adaptive interval: check more frequently when approaching quota
|
|
interval := wfs.getQuotaCheckInterval()
|
|
time.Sleep(interval)
|
|
|
|
if wfs.option.Quota <= 0 {
|
|
continue
|
|
}
|
|
|
|
wfs.checkQuotaOnce()
|
|
}
|
|
}
|
|
|
|
// getQuotaCheckInterval returns the check interval based on current usage.
|
|
// Returns a shorter interval when approaching quota limit.
|
|
func (wfs *WFS) getQuotaCheckInterval() time.Duration {
|
|
if wfs.option.Quota <= 0 {
|
|
return defaultQuotaCheckInterval
|
|
}
|
|
|
|
_, usedSize := wfs.diskSizes()
|
|
uncommitted := atomic.LoadInt64(&uncommittedBytes)
|
|
totalUsed := int64(usedSize) + uncommitted
|
|
|
|
// If we're at 90% or more of quota, check more frequently
|
|
if float64(totalUsed) >= float64(wfs.option.Quota)*quotaWarningThreshold {
|
|
return fastQuotaCheckInterval
|
|
}
|
|
return defaultQuotaCheckInterval
|
|
}
|
|
|
|
func (wfs *WFS) checkQuotaOnce() {
|
|
err := wfs.withFilerClient(context.Background(), false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
|
|
|
|
request := &filer_pb.StatisticsRequest{
|
|
Collection: wfs.option.Collection,
|
|
Replication: wfs.option.Replication,
|
|
Ttl: fmt.Sprintf("%ds", wfs.option.TtlSec),
|
|
DiskType: string(wfs.option.DiskType),
|
|
}
|
|
|
|
resp, err := client.Statistics(ctx, request)
|
|
if err != nil {
|
|
glog.V(0).Infof("reading quota usage %v: %v", request, err)
|
|
return err
|
|
}
|
|
glog.V(4).Infof("read quota usage: %+v", resp)
|
|
|
|
// Update the stats cache with latest filer data
|
|
wfs.stats.UsedSize = resp.UsedSize
|
|
wfs.stats.TotalSize = resp.TotalSize
|
|
wfs.stats.LogicalUsedSize = resp.LogicalUsedSize
|
|
wfs.stats.LogicalTotalSize = resp.LogicalTotalSize
|
|
|
|
// Reset uncommitted counter since we now have fresh data from filer
|
|
wfs.ResetUncommittedBytes()
|
|
|
|
_, usedSize := wfs.diskSizes()
|
|
isOverQuota := int64(usedSize) > wfs.option.Quota
|
|
if isOverQuota && !wfs.IsOverQuota {
|
|
glog.Warningf("Quota Exceeded! quota:%d used:%d", wfs.option.Quota, usedSize)
|
|
} else if !isOverQuota && wfs.IsOverQuota {
|
|
glog.Warningf("Within quota limit! quota:%d used:%d", wfs.option.Quota, usedSize)
|
|
}
|
|
wfs.IsOverQuota = isOverQuota
|
|
|
|
return nil
|
|
})
|
|
|
|
if err != nil {
|
|
glog.Warningf("read quota usage: %v", err)
|
|
}
|
|
}
|