Rebooting Revisited

khess 0 Tallied Votes 595 Views Share

It seems that I caused quite a stir and some arguments among some of my readers with the likes of my 5 *nix Myths Busted and the ever popular Retraction: 5 *nix Myths Busted, when I referred to rebooting systems. I never thought that something so benign would cause such a fuss. Though shocked and awed by some of the responses, I can tell you that rebooting a system, any system, is a fact of life. Until now, that is.

A new service, created by real geniuses at MIT, alleviates the need to reboot after patching the Linux kernel. Awesome, huh?

Here's the full scoop:

Ksplice Abolishes the Reboot

* New Ksplice Uptrack service allows system
administrators to update Linux servers without the disruption
and downtime of a reboot

Cambridge, Mass., February 9, 2010 — Ksplice Inc. today
announced the general availability of its Uptrack service, eliminating
the need to restart Linux servers when installing crucial updates and
security patches.

Based on technology from the Massachusetts Institute of Technology,
Ksplice Uptrack is a subscription service that allows IT
administrators to keep Linux servers up-to-date without the disruption
and downtime of rebooting.

Before Uptrack, system administrators had to schedule downtime in
advance to bring Linux servers up-to-date, because updating the
central part of a computer's software — known as the kernel
— previously required rebooting the computer. Until a system can
be updated, it remains vulnerable to security flaws. By allowing IT
administrators to install kernel updates without downtime, Uptrack
dramatically reduces the cost of system administration.

"We've been thrilled with how Ksplice makes us more secure and
available while saving us time and hassle," said Dallas Kashuba, the
co-founder and chief technical officer of DreamHost, an early adopter
of Ksplice Uptrack. "Using Ksplice has improved our response time to
critical kernel exploits from a few days to only minutes," Mr. Kashuba
said.

Ksplice Uptrack is now available for users of six leading versions of
Linux: Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, CentOS,
Parallels Virtuozzo Containers, and OpenVZ. The subscription fee
starts at $3.95 per month per system, after a 30-day free trial. A
free version is also available for Ubuntu.

In 2009, major Linux vendors asked customers to install a kernel
update roughly once each month. Before Uptrack, each such update
required a reboot.

"Why reboot if you don't have to? Reboots are disruptive and require
costly supervision," said Jeff Arnold, Ksplice's chief executive
officer. "Now system administrators can keep their systems up to date
without coordinating outages, and they don't need to come in Sunday at
2 a.m. to take everything down. They can avoid the biggest headache of
server maintenance, with better availability and a smaller window of
vulnerability than ever before."

More than 40 leading Web hosting and IT infrastructure companies have
deployed Ksplice Uptrack as early adopters of the service, which has
successfully saved tens of thousands of reboots to date.

"Like other hosting providers, we've needed this capability for a long
time, but we didn't think that it was possible to apply these updates
without a reboot until we saw Ksplice in action," said Joshua Barratt,
chief technical officer of Media Temple, an early adopter of Ksplice
Uptrack. "This is an exciting change in how we run our systems."

"Ksplice is superb," said David Collins, chief technical officer of
HostGator, an early adopter of Ksplice Uptrack. "It reduces one of the
biggest costs associated with any server — system administrator
maintenance time — and helps us improve the quality of service we can
provide to our customers," Mr. Collins said.

About Ksplice: Ksplice is an enterprise software company making
reboots a thing of the past. Organizations use Ksplice Uptrack, the
company's first product, to make their Linux systems more secure,
reliable and maintainable through seamless updates. Ksplice was
founded in 2008, based on research from the Massachusetts Institute of
Technology. In 2009, the Wall Street Journal named Ksplice the most
innovative security company of the year. Ksplice is based in
Cambridge, Mass. For more information, please visit
http://www.ksplice.com.

Check out the number of reboots required in the past year due to Linux patches on the Ksplice why page.

Apparently, the need to reboot was so great that someone, namely the intelligent folk at MIT, thought it was necessary to create a way to prevent it. The need to reboot will still arise but at least you can now keep it to a minimum with the Ksplice service.

I wonder if Ksplice offers a Windows version of its service? Now, that would be impressive. I get seriously annoyed at the multiple reboots for the infinite number of patches on Windows systems.

For less than $50 US per year, it seems to be a service that many would like to explore. What about you? Do you think it's worth the cost to save reboot time?

Dani AI

Generated

flagged an important shift in update strategy; a few technical clarifications and practical notes follow for readers who land here later. The original Ksplice work grew out of MIT research and demonstrates that many kernel security fixes can be transformed into in-memory patches instead of forcing a full reboot. For background and the original evaluation, see the Ksplice paper and project notes. (pdos.csail.mit.edu)

Ksplice and similar tools operate at the object-code level: they build the kernel with and without a patch, compute what functions changed, and generate in-memory replacements (trampolines/jumps) so running CPUs resume into the updated code. The switch is done carefully (brief processor synchronization and safety checks) to avoid corrupting state while replacing function entry points. The implementation details and early community discussion are documented in the project writeups and announcement posts. (lkml.org)

Important limits and operational advice: the technique is safe only for patches that do not change the semantics of persistent kernel data structures unless helper code is provided; in the original study most security fixes fit that pattern, but some do not. Live-patching does not remove the need for occasional reboots — major kernel upgrades, ABI changes, driver swaps, or structural fixes still require full restarts. Treat live patching as a high-availability tool: test every patch in staging, enable vendor-provided channels for your distribution, monitor after each update, and keep a scheduled reboot cadence for full-version maintenance. (pdos.csail.mit.edu)

Note the commercial/maintenance angle: Ksplice was later acquired and integrated into vendor tooling, and other distributions now offer live-patching solutions (kpatch, kGraft/Live Patching, KernelCare) that differ in packaging and distro support — factor vendor SLA and kernel compatibility into any cost/benefit decision before relying solely on live patching. (oracle.com)

References (for deeper reading):

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.