Servers
Zombie servers: the machines running for nobody
One study found about a quarter of physical servers did no useful work for six months. Why nobody switches them off, and what an unpatched one is worth.
The Ghost Patch begins with a server that was supposed to be wiped two and a half years ago. It’s still running. That sounds like fiction until you read what the people who measure data centres found.
What a zombie is
Jonathan Koomey, a researcher at Stanford, and Jon Taylor of Anthesis call a server comatose (or zombie) when it shows no network, user, connection, memory or CPU activity for six months or more. Not quiet. Dead on every instrument, and still drawing power.
How they measured it
The study took readings every five minutes and rolled them into 15-minute blocks, which gives 5,760 blocks per server over six months, and a server counted as active if at least 288 of them, 5 per cent, showed any sign of life. Anything between that and nothing was idle. Only a machine with no sign at all for six months or more earned the label comatose.
That bar is stricter than “barely used”, which is why the result is startling.
How many
Their first study covered about 4,000 servers in five facilities over six months in 2014. About thirty per cent were comatose. The follow-up, dated 3 April 2017, used a 2015 sample about four times bigger, drawn from twice as many facilities, and found that among companies that hadn’t done anything about the problem roughly a quarter of physical servers were zombies. About thirty per cent of the virtual machines on some of the host servers were too. The authors say the first result mirrored earlier work by the Uptime Institute and McKinsey, which also found very low utilisation.
One group of facilities turns up in both samples. In 2014, 34 per cent of its servers were zombies. A year later, after the companies had been shown the data, the figure was 8 per cent.
So clearing them out works. The hard part is seeing them.
Why nobody turns them off
The authors say few companies can identify these orphaned servers, and many don’t even know how many servers they have. There’s a trap in that. A switch-off needs someone to say yes, and a zombie, by definition, has nobody who would.
The security part
The electricity bill is the smaller problem. The report’s abstract says zombie servers are unlikely to have the latest security patches, which makes them “an open door” to many enterprise data centres. A server nobody uses is a server nobody patches.
That’s the story in the novel turned inside out. The machine in the blurb has been fixing the system since January. The real ones fix nothing, and wait.
What the numbers can’t tell you
It isn’t a census. The data came from companies using one vendor’s discovery software, from TSO Logic, and the authors adjust the sample to stand for typical enterprises, which is an assumption. Read “about a quarter” as a rough size of the problem, not a measurement of your own estate.
The test is simple enough to run yourself: no network, user, memory or CPU activity for six months. List what meets it, then work out who would miss each machine. If nobody can say, that’s the finding.
The Prologue and Chapter 1 of The Ghost Patch are free to read on this site.