Serve stale

Serve stale keeps reads working while the source is down. Entries expire after 10 s, and a stale window of 15 s covers a 10 s outage. A copy older than the 30 s limit must never be served.

Play a level

See it on the board

The same traffic runs on two boards. The simulator measured both when this page was built.

Board to show
HTTP/2SQLUsersRedis cache0.25 vCPU · 0.5 GBPostgres0.5 vCPU · 1 GB
HTTP/2SQLUsersRedis cache0.25 vCPU · 0.5 GBPostgres0.5 vCPU · 1 GB
Expired entries must reach the source: misses a goal
HTTP/2SQLUsersRedis cache0.25 vCPU · 0.5 GBPostgres0.5 vCPU · 1 GB
HTTP/2SQLUsersRedis cache0.25 vCPU · 0.5 GBPostgres0.5 vCPU · 1 GB
Expired entries served for 15 s more: meets the goals
See it on the board
Measure Goal Expired entries must reach the source Expired entries served for 15 s more
Availability at least 99% 91.5% Fail 99.465% Pass
Data age under 30 s 10 s Pass 19.9 s Pass
Monthly cost 8 USD/mo 8 USD/mo
p99 latency 24 ms 24 ms
Error rate 8.5% 0.5%

Key numbers

Default part values from the catalog. The mini board has an outage of 10 s and an age limit of 30 s.
NumberValue
Default time to live of a cache entry60 s
Default stale window0 s
Mean time between failures, one server8,760 h
Serve a stale copyTap or press Space to add a stale window

15 s stale window · 0 of 10 reads fail in the outage · oldest answer 25 s, limit 30 s

How it works

A cache entry has a time to live. When it ends, the next read must go to the source. If the source is down, that read fails, and the users see errors, even though the cache still holds an answer that is only a few seconds old.

Serve stale changes the rule. After the time to live ends, the cache may still answer with the old copy for a set window while it tries to refresh in the background. If the refresh works, the entry becomes fresh. If the source is down, readers still get an answer.

In the mini board the source is down from 0:30 to 0:40. Entries normally expire after 10 s. The system needs 99 percent of reads to work, but it must never serve a value older than 30 s. A stale window of 15 s covers the outage and stays inside the age limit. Without the window, about 4 reads in 10 fail during the outage.

The window is a decision about value, not about the cache. Some data can be old for a minute, like a product list. Other data cannot, like an account balance. Set the age limit for each kind of data, and make the cache refuse to serve anything older.

In the levels you set the stale window and check the age of the answers.