USENIX Association Proceedings of the 28th Large Installation System Administration Conference (LISA14) November 9–14, 2014 Seattle, WA Conference Organizers Program Chair Workshops Coordinator Nicole Forsgren Velasquez, Utah State University Cory Lueninghoener, Los Alamos National Laboratory Content Coordinators USENIX Board Liaisons Amy Rich, Mozilla Corporation David Blank-Edelman, Northeastern University College Adele Shakal, Cisco of Computer and Information Science Carolyn Rowland, NIST Research Committee Co-Chairs Kyrre Begnum, Oslo University College of USENIX Training Program Manager Applied Sciences Rik Farrow, Security Consultant Marc Chiarini, MarkLogic Corporation Tutorial Coordinators Research Committee Thomas A. Limoncelli, Stack Exchange, Inc. Theophilus Benson, Duke University Matthew Simmons, Northeastern University Adam Oliner, University of California, Berkeley and Kuro Labs LISA Lab Chair Paul Krizak, Qualcomm, Inc. Invited Talks Coordinators Patrick Cable, MIT Lincoln Laboratory LISA Lab Coordinator Chris McEniry, Sony Network Entertainment Doug Hughes, D. E. Shaw Research, LLC Matthew Simmons, Northeastern University LISA Build Coordinators Branson Matheson, Blackphone Invited Talks Committee Brett Thorsen, Cranial Thunder Solutions John Looney, Google, Inc. Branson Matheson, Blackphone Local Chair Gareth Rushgrove, Puppet Labs Lee Damon, University of Washington Jeffrey Snover, Microsoft THE USENIX Staff Mandi Walls, Chef John Willis, Stateless Networks Lightning Talks Coordinator Lee Damon, University of Washington External Reviewers Paul Armstrong Matt Disney Adam Moskowitz Yanpei Chen Suzanne McIntosh Josh Simon Jennifer Davis Dinah McNutt Guanying Wu Proceedings of the 28th Large Installation System Administration Conference (LISA14) Message from the Program Chair . v Wednesday, November 12, 2014 Head in the Clouds HotRestore: A Fast Restore System for Virtual Machine Cluster . 1 Lei Cui, Jianxin Li, Tianyu Wo, Bo Li, Renyu Yang, Yingjie Cao, and Jinpeng Huai, Beihang University Compiling Abstract Specifications into Concrete Systems—Bringing Order to the Cloud . .17 Ian Unruh, Alexandru G. Bardas, Rui Zhuang, Xinming Ou, and Scott A. DeLoach, Kansas State University An Administrator’s Guide to Internet Password Research . .35 Dinei Florêncio and Cormac Herley, Microsoft Research; Paul C. van Oorschot, Carleton University Who Watches? Analyzing Log Analysis: An Empirical Study of User Log Mining . .53 S. Alspaugh, University of California, Berkeley and Splunk Inc.; Beidi Chen and Jessica Lin, University of California, Berkeley; Archana Ganapathi, Splunk Inc.; Marti A. Hearst and Randy Katz, University of California, Berkeley Realtime High-Speed Network Traffic Monitoring Using ntopng . .69 Luca Deri, IIT/CNR and ntop; Maurizio Martinelli, IIT/CNR; Alfredo Cardigliano, ntop Towards Detecting Target Link Flooding Attack . .81 Lei Xue, The Hong Kong Polytechnic University; Xiapu Luo, The Hong Kong Polytechnic University Shenzen Research Institute; Edmond W. W. Chan and Xian Zhan, The Hong Kong Polytechnic University Thursday, November 13, 2014 High Speed Automatic and Dynamic Configuration of Data Compression for Web Servers . .97 Eyal Zohar, Yahoo! Labs; Yuval Cassuto, Technion—Israel Institute of Technology The Truth About MapReduce Performance on SSDs . 109 Karthik Kambatla, Cloudera Inc. and Purdue University; Yanpei Chen, Cloudera Inc. ParaSwift: File I/O Trace Modeling for the Future . .119 Rukma Talwadker and Kaladhar Voruganti, NetApp Inc. Wednesday, November 12, 2014 Poster Session Pedagogical Framework and Network Laboratory Management Tool for Practical Network Administration Education . .133 Zahid Nawaz, University of Oslo An Investigation of Cultural and Organizational Impacts on EKR Use and EKR Use Outcomes Among System Administrators at NASA . .135 Nicole Forsgren, Utah State University; E. Branson Matheson III, Blackphone Linux NFSv4 .1 Performance Under a Microscope . .137 Ming Chen, Stony Brook University; Dean Hildebrand, IBM Research—Almaden; Geoff Kuenning, Harvey Mudd College; Soujanya Shankaranarayana, Stony Brook University; Vasily Tarasov, Stony Brook University and IBM Research—Almaden; Arun O. Vasudevan and Erez Zadok, Stony Brook University; Ksenia Zakirova, Harvey Mudd College Demand-Provisioned Linux Containers for Private Network Access . .139 Patrick T. Cable II, MIT Lincoln Laboratory Virtual Interfaces for Exploration of Heterogeneous & Cloud Computing Architectures . 141 Hal Martin and Wayne G. Lutters, University of Maryland Time-Synchronized Visualization of Arbitrary Data Streams for Real-Time Monitoring and Historical Analysis . .143 Paul Z. Kolano, NASA Ames Research Center Formalising Configuration Languages: Why is this Important in Practice? . 145 Paul Anderson and Herry Herry, University of Edinburgh Message from the LISA14 Program Chair Welcome to LISA14! This marks the 28th meeting of the USENIX Large Installation System Administration Conference, and I’m pleased to present this year’s program and proceedings. This year, we shook things up a bit, pulling together all aspects of the LISA conference under coordination of the Chair. This resulted in a carefully curated program with content that spans tutorials, workshops, and technical talks, providing attendees with the opportunity to tailor the conference to their needs. We’re excited about the coordinated content and the tracks, and we think you will be, too. Of course, I could not have done this without a fantastic team of conference organizers who coordinated content across several areas to deliver the amazing program you see here. I would also like to thank those who contributed directly to the program: authors, shepherds, external reviewers, speakers, tutorial instructors, attendees, the LISA Build team, USENIX Board of Directors liaisons, and the USENIX staff. I would also like to personally thank USENIX Executive Director Casey Henderson for her support as we chartered new territory in conference organiza- tion, and for securing Diet Coke for the conference venue. Casey has been wonderful to work with and a true team- mate and colleague. This year, the conference accepted nine peer-reviewed full research papers, resulting in an acceptance rate of 31%. The conference also accepted nine peer-reviewed posters, which appear in the conference proceedings as extended abstracts. This adds to USENIX’s considerable body of peer-reviewed published work. To foster interaction and discussion among the LISA community and to extend the reach and engagement of our research papers, all of our accepted papers have been invited to present a poster in addition to their paper presentation. We hope our attendees will take the opportunity to learn about the cutting-edge research that is happening in systems administration, and find out how it might affect their work in the months and years to come. I am very proud of this year’s program and hope you enjoy the conference. Most importantly, I hope you also enjoy the hallway track; say “hi” to old friends and meet some new ones. Don’t be afraid to introduce yourself to someone new! The strength of LISA lies in you, the attendees, and in the discussions and technical conversations that happen between sessions. Nicole Forsgren Velasquez, Utah State University LISA14 Program Chair USENIX Association 28th Large Installation System Administration Conference (LISA14) v HotRestore: A Fast Restore System for Virtual Machine Cluster Lei Cui, Jianxin Li, Tianyu Wo, Bo Li, Renyu Yang, Yingjie Cao, Jinpeng Huai State Key Laboratory of Software Development Environment Beihang University, China cuilei, lijx, woty, libo, yangry, caoyj @act.buaa.edu.cn huaijp @buaa.edu.cn { } { } Abstract ability of applications running inside the VMC. There are many approaches for reliability enhancement in vir- A common way for virtual machine cluster (VMC) to tualized environment. Snapshot/restore [25, 39, 40, 37] tolerate failures is to create distributed snapshot and then is the most widely used one among them. It saves the restore from the snapshot upon failure. However, restor- running state of the applications periodically during the ing the whole VMC suffers from long restore latency due failure-free execution. Upon a failure, the system can re- to large snapshot files. Besides, different latencies would store the computation from a recorded intermediate state lead to discrepancies in start time among the virtual ma- rather than the initial state, thereby significantly reducing chines. The prior started virtual machine (VM) thus can- the amount of lost computation. This feature enables the not communicate with the VM that is still restoring, con- system administrators to recover the system and imme- sequently leading to the TCP backoff problem. diately regain the full capacity in the face of failures. In this paper, we present a novel restore approach In the past decades, several methods have been pro- called HotRestore, which restores the VMC rapidly with- posed to create distributed snapshot of VMC, and most out compromising performance. Firstly, HotRestore re- of them aim to guarantee the global consistency whilst stores a single VM through an elastic working set which reducing the overhead such as downtime, snapshot size, prefetches the working set in a scalable window size, duration, etc [11, 25, 14]. However, restoring the VM- thereby reducing the restore latency. Second, HotRe- C has received less attention probably because restora- store constructs the communication-induced restore de-