Tuesday, April 1, 2003
B17 Upson Hall
University of California, Berkeley
Undo for Operators: A Human-Centric Approach to Recovery
every productivity application on the market today offers its users the ability
to undo their actions, allowing them to recover from their mistakes and to
experiment with unfamiliar features in a forgiving environment.
Surprisingly, this safety net of undo is virtually nonexistent in the
domain of systems operations and management, where human error is the largest
single contributor to system and service outages.
This talk will address the challenge of creating an undo facility for
system operators, introducing an architecture for adding operator-undo
functionality as a wrapper around existing network service applications such as
electronic mail, online shopping, and auction services.
operator-undo architecture leverages proven techniques from the systems and
database domains, including non-overwriting storage, redo recovery, proxy-based
logging of user requests, and predicate-based consistency management.
It adapts and integrates these techniques to provide a recovery tool that
offers a virtual time-travel interface to the system operator.
Using our undo system, an operator can rewind system state to nullify the
effects of human error, software misbehavior, or external attack; can
retroactively insert arbitrary changes into the system to repair the problem or
forestall future occurrences; and can replay the system forward in time, merging
the original system timeline with the retroactively-inserted repairs and
compensating for any inconsistencies that arise as a result.
Ahuman-centric recovery tool like operator-undo requires an evaluation methodology that captures the influence of its human users on its effectiveness. To that end, the talk will also introduce an evaluation methodology that combines traditional systems benchmarking and human studies techniques, and will describe how we are using this methodology to evaluate the dependability and recovery benefits offered by a prototype implementation of operator-undo for an e-mail store service.