The Failover Fallacy

I l @ ve RuBoard

One of the complaints that fans of expensive EJB platforms like to level against Tomcat is that it doesn't provide failover support.

By failover, they're referring to the capability to seamlessly move a session from one server to another if the first server goes belly up. Any server can offer the other kind of failover, which is dropping a dead server out of a server pool, if you use a smart switch.

Just how important is session failover? For most sites, not very. For example, suppose that you have a fairly unstable site, which results in a Web server crashing once a week (anything more frequent than that, and your site has no business being live). Further say that you have five servers and get around 100,000 users a day ”a pretty busy site ”and a typical user 's session lasts 10 minutes.

That's approximately 700,000 users a week. During any one time, you could expect (with even distribution), 1/144th of your daily users would be in a current session (1,440 minutes in a day, 10 minutes in a session).

Furthermore, your traffic is divided among five servers, so that's really 1/720th of your daily traffic, or about 138 users. So, out of 700,000 user sessions, you would lose state on 138, or .019%, of all sessions. This is a 99.981% uptime, a little off the gold standard of "three nines," but pretty close.

And what happens to those users who got dumped? Did their houses get repossessed? Did they have their tax returns audited ? No, they lost their current session state and got put back into a fresh, new session.

It's possible that a very few of them might have been at the critical point between authorizing the credit card and recording the order, but those chances are slim indeed ”and even a platform with session failover won't save you from that in all cases.

And implementing failover support is no small feat. Usually, all of your objects have to be serializable. You don't get the functionality "out of the box"; you have to design your entire application to take advantage of it.

So, unless you have an absolute mandate from someone of 100% uptime requirements, get a cup of cocoa and stop worrying about failover.

I l @ ve RuBoard