3f597aae16
* Tighten result type Command execution can't result in a sequencer error * New helper method for extracting used contracts * New error clause * Add a DAO query for the maximum time of contracts * Implement algorithm for finding ledger time CHANGELOG_BEGIN CHANGELOG_END * fixup ledgerTimeHelper * Use new ledger time algorithm * Mark LET/MRT as deprecated CHANGELOG_BEGIN - [Ledger API] DAML ledgers have switched to a new ledger time model. The ledger_effective_time and maximum_record_time fields of command submission are deprecated, the ledger time of transactions is instead set automatically by the ledger API server. Ledger time is no longer strictly monotonically increasing, but only follows causal monotonicity: ledger time of transactions is greater than or equal to the ledger time of any used contract. See `#4345 <https://github.com/digital-asset/daml/issues/4345>`__. CHANGELOG_END * Add ledger time skew check * Remove command updater LET/MRT are now deprecated, this class is now useless * Remove old time model validator * Switch to new time model check: kvutils * Switch to new time model check: in-memory ledger * Switch to new time model check: SqlLedger * Use initial ledger config * Ignore user provided LET * Use TimeProvider in submission services * Use deduplication_time in daml-script runner - Also remove unnecessary command completion output of CommandTracker. - Remove usage of maximum record time in CommandTracker. * Use arbitrary default value for deduplication time * Use built-in Instant ordering * Remove obsolete test * Remove obsolete test: CommandStaticTimeIT * Refactor test: TransactionMRTCompliance * Disable test: CommandTrackerFlow timeout * thread maxDeduplicationTime through to CommandTracker * Improve test * Refactor command client configuration * Deduplication time should always use UTC * Add missing method in TimedIndexService after rebase * Put more details into the deduplication error response. * Use system time for command dedup submittedAt. * Use explicit UTC time source in command validator * Revert CommandTracker[Flow] to previous completion-recovering-behavior * Adapt scala client command config to new config params Co-authored-by: Gerolf Seitz <gerolf.seitz@digitalasset.com> |
||
---|---|---|
.. | ||
ledger-api-akka | ||
ledger-api-auth | ||
ledger-api-auth-client | ||
ledger-api-client | ||
ledger-api-common | ||
ledger-api-domain | ||
ledger-api-health | ||
ledger-api-test-tool | ||
ledger-api-test-tool-on-canton | ||
ledger-on-memory | ||
ledger-on-sql | ||
participant-state | ||
participant-state-index | ||
recovering-indexer-integration-tests | ||
sandbox | ||
sandbox-perf | ||
scripts | ||
test-common | ||
README.md |
ledger
Home of our reference ledger implementation (Sandbox) and various ledger related libraries.
Logging
Logging Configuration
The Sandbox and Ledger API Server use Logback for logging configuration.
Log Files
The Sandbox logs at INFO
level to standard out and to the file sandbox.log
in the current working directory.
Log levels
As most Java libraries and frameworks, the Sandbox and Ledger API Server use INFO as the default logging level. This level is for minimal and important information (usually only startup and normal shutdown events). INFO level logging should not produce increasing volume of logging during normal operation.
WARN level should be used for transition between healthy/unhealthy state, or in other close to error scenarios.
DEBUG level should be turned on only when investigating issues in the system, and usually that means we want the trail loggers. Normal loggers at DEBUG level can be useful sometimes (e.g. DAML interpretation).
Metrics
Sandbox and Ledger API Server provide a couple of useful metrics:
Sandbox and Ledger API Server
The Ledger API Server exposes basic metrics for all gRPC services and some additional ones.
Metric Name | Description |
LedgerApi.com.digitalasset.ledger.api.v1.$SERVICE.$METHOD | A meter that tracks the number of calls to the respective service and method. |
CommandSubmission.failedCommandInterpretations | A meter that tracks the failed command interpretations. |
CommandSubmission.submittedTransactions | A timer that tracks the commands submitted to the backing ledger. |
Indexer
Metric Name | Description |
JdbcIndexer.processedStateUpdates | A timer that tracks duration of state update processing. |
JdbcIndexer.lastReceivedRecordTime | A gauge that returns the last received record time in milliseconds since EPOCH. |
JdbcIndexer.lastReceivedOffset | A gauge that returns that last received offset from the ledger. |
JdbcIndexer.currentRecordTimeLag | A gauge that returns the difference between the Indexer's wallclock time and the last received record time in milliseconds. |
Metrics Reporting
The Sandbox automatically makes all metrics available via JMX under the JMX domain com.digitalasset.platform.sandbox
.
When building an Indexer or Ledger API Server the implementer/ledger integrator is responsible to set up
a MetricRegistry
and a suitable metric reporting strategy that fits their needs.
Health Checks
Ledger API Server health checks
The Ledger API Server exposes health checks over the gRPC Health Checking Protocol. You can check the health of
the overall server by making a gRPC request to grpc.health.v1.Health.Check
.
You can also perform a streaming health check by making a request to grpc.health.v1.Health.Watch
. The server will
immediately send the current health of the Ledger API Server, and then send a new message whenever the health changes.
The ledger may optionally expose health checks for underlying services and connections; the names of the services are ledger-dependent. For example, the Sandbox exposes two service health checks:
- the
"index"
service tests the health of the connection to the index database - the
"write"
service tests the health of the connection to the ledger database
To use these, make a request with the service
field set to the name of the service. An unknown service name will
result in a gRPC NOT_FOUND
error.
Indexer health checks
The Indexer does not currently run a gRPC server, and so does not expose any health checks on its own.
In the situation where it is run in the same process as the Ledger API Server, the authors of the binary are encouraged to add specific health checks for the Indexer. This is the case in the Sandbox and Reference implementations.
Checking the server health in production
We encourage you to use the grpc-health-probe tool to periodically check the health of your Ledger API Server in production. On the command line, you can run it as follows (changing the address to match your ledger):
$ grpc-health-probe -addr=localhost:6865
status: SERVING
An example of how to naively configure Kubernetes to run the Sandbox, with accompanying health checks, can be found in sandbox/kubernetes.yaml.
More details can be found on the Kubernetes blog, in the post titled Health checking gRPC servers on Kubernetes.
gRPC and back-pressure
RPC
Standard RPC requests should return with RESOURCE_EXHAUSTED status code to signal back-pressure. Envoy can be configured to retry on these errors. We have to be careful not to have any persistent changes when returning with such an error as the same original request can be retried on another service instance.
Streaming
gRPC's streaming protocol has built-in flow-control, but it's not fully active by default. What it does it controls the flow between the TCP/HTTP layer and the library so it builds on top of TCP's own flow control. The inbound flow control is active by default, but the outbound does not signal back-pressure out of the box.
AutoInboundFlowControl
: The default behaviour for handling incoming items in a stream is to automatically signal demand
after every onNext
call. This is the correct thing to do if the handler logic is CPU bound and does not depend on other
reactive downstream services. By default it's active on all inbound streams. One can disable this and signal demand by
manually calling request
to follow demands of downstream services. Disabling this feature is possible by calling
disableAutoInboundFlowControl
on CallStreamObserver
.
ServerCallStreamObserver
: casting an outbound StreamObserver
manually to ServerCallStreamObserver
gives us access
to isReady
and onReadyHandler
. With these methods we can check if there is available capacity in the channel i.e.
we are safe to push into it. This can be used to signal demand to our upstream flow. Note that gRPC buffers 32Kb data
per channel and isReady
will return false only when this buffer gets full.