Video of the presentation at SoCC 2018 is available: https://youtu.be/29A7ZDUc-Cs The paper can be downloaded from ACM: https://dl.acm.org/citation.cfm?id=3267823 Effective overload control for large-scale online service system is crucial for protecting the system backend from overload. Conventionally, the design of overload control is ad-hoc for individual service. However, service-specific overload control could be detrimental to the overall system due to intricate service dependencies or flawed implementation of service. Service developers usually have difficulty to accurately estimate the dynamics of actual workload during the development of service. Therefore, it is essential to decouple the overload control from service logic. In this paper, we propose DAGOR, an overload control scheme designed for the account-oriented microservice architecture. DAGOR is service agnostic and system-centric. It manages overload at the microservice granule such that each microservice monitors its load status in real time and triggers load shedding in a collaborative manner among its relevant services when overload is detected. DAGOR has been used in the WeChat backend for five years. Experimental results show that DAGOR can benefit high success rate of service even when the system is experiencing overload, while ensuring fairness in the overload control.

1. Overload Control for Scaling
WeChat Microservices

2. WeChat
The new way to connect
Chat Moments Contacts Search Pay
1 Billion
monthly active users

3. WeChat’s Microservice Architecture
• Service DAG
– Vertex: a distinct service; Edge: call path
– Basic service: out-degree = 0
– Leap service: out-degree ≠ 0
o Entry service: in-degree = 0

4. Dealing with Overload
• It’s usually hard to estimate the dynamics of workload during
the development of microservices.
Subsequent Overload
How about random load shedding?

5. Dynamic Workload
Relative Statistics of WeChat Service Requests

6. DAGOR
• Overload detection
• Service admission control
• Requirements
– Service agnostic
o Benefit the ever evolving microservice system
o Decouple overload control from the business logic of services
– Independent but collaborative
o Decentralized overload control
o Service-oriented collaboration among nodes
– Efficient and fair
o Sustain best-effort success rate of service when load shedding becomes inevitable
o Bias-free overload control

7. Overload Detection
• Load indicator of a node: Queuing time
– Rationale: to manage queue length for SLA
• Why not response time?
• Why not CPU utilization?

8. Service Admission Control
Static
Shuffling on
an hourly basis
Exploit
histogram for
real-time
adjustment

9. DAGOR Workflow
Service agnostic
Independent but collaborative
Efficient and fair
Collaborative
Admission
Control

10. Overload Detection
Queuing Time vs. Response Time

11. Scalability
Overload Control
with Increasing Workload (M2)
Overload Control
with Different Types of Workload
Optimal Success Rate = 𝒇 𝒔𝒂𝒕 𝒇

12. Fairness
CoDel DAGOR

13. Takeaways: DAGOR Design Principles
1. Must be decentralized and autonomous in each service/node
– Essential for the overload control framework to scale with the ever evolving
microservice system
2. Employ feedback mechanism for adaptive load shedding
– Essential for adjusting thresholds automatically
3. Prioritize user experience

14. Thank You ALL!