Skip to main content
RunBook Academy

CephLXVII · Performance MethodologyPerformance Methodology

Working a slow-ops report

Advanced⏱ ~18 minceph

What you'll learn

  • Interpret a slow ops report correctly
  • Identify which OSDs and operations are involved
  • Apply the layered method to reach a cause
  • Resolve the common cases

Prerequisites

None — start here.

Verified against Ceph Tentacle 20.2.x · Ceph Squid 19.2.x (supported previous) · cephadm matches the verified Ceph release · podman 4.x · csi-rbd and csi-cephfs current · RBD / CephFS / RGW current (matches Ceph release) · Linux kernel 5.15+ (5.10 minimum) · Ubuntu 24.04 LTS (Ceph host baseline) · Debian 12 (Bookworm) (Ceph host baseline) · Rocky Linux / RHEL / AlmaLinux 9.x (Ceph host baseline) · Proxmox VE 9.x (cross-course integration) · Kubernetes 1.31+ (cross-course integration) · 2026-08-18

Not yet marked complete on this device.

Why this matters in production

SLOW_OPS is the health check that most often accompanies a user-visible performance problem, and it names the OSDs involved — which is most of the diagnosis if the output is read properly.

What the report says

ceph health detail
[WRN] SLOW_OPS: 47 slow ops, oldest one blocked for 92 sec, daemons
      [osd.12,osd.31] have slow ops.

Three facts: how many, how long the oldest has waited, and which daemons. The daemon list is the lead.

ceph daemon osd.12 dump_ops_in_flight | python3 -c '
import sys,json; d=json.load(sys.stdin)
for op in d.get("ops",[])[:5]:
    print(op.get("description","")[:80])
    print("   ", op.get("type_data",{}).get("flag_point"))'

The flag_point is the stage the operation is stuck at, which names the subsystem directly.

Reading the flag points

Flag pointMeaning
waiting for rw lockscontention on the object
waiting for subops froma replica is not acknowledging
waiting for degraded objectthe object is being recovered
commit sent; apply or cleanupthe local write is slow
queued for pgthe PG is busy or peering
reached pgprocessing has started

waiting for subops from [31] is the most informative: it names the OSD that is actually slow, which may not be the one reporting the slow op.

Applying the method

# 1. which OSDs, and is one of them named in the subops?
IFACE=bond0
THE_IMPLICATED_HOST=stor-04
ceph health detail | grep -o 'osd\.[0-9]*'
ceph daemon osd.12 dump_ops_in_flight | grep -o 'waiting for subops from.*'

# 2. device layer on the implicated host
ceph osd find 31
# on that host:
iostat -x 1 5
dmesg -T | tail -30
smartctl -a /dev/sdX | grep -iE 'pending|reallocated'

# 3. host layer
uptime
vmstat 1 5
free -g

# 4. network layer
ethtool -S ${IFACE} | grep -iE 'drop|err'
ping -c 100 ${THE_IMPLICATED_HOST}

The common cases

CauseSignatureFix
A failing devicepending sectors, kernel I/O errorsreplace the device
A saturated devicehigh %util, high queue depthreduce load or add capacity
CPU starvation on the hosthigh load average, vmstat run queuereduce daemons per host or add CPU
Network lossinterface error countersfix the link
Recovery contentionslow ops correlate with recoverythrottle recovery
A full OSDOSD_FULL also presentfree space
# rule several out quickly
ceph osd perf | sort -k2 -n | tail -5
ceph -s | grep -E 'recovery|degraded'
ceph health detail | grep -E 'FULL|NEARFULL'

Quiz

Knowledge check · 4 questions

  1. Q1. Why can one slow OSD cause slow ops to be reported by many other OSDs?

  2. Q2. An OSD reporting slow ops can be functioning perfectly, with the delay coming entirely from a replica it is waiting on.

  3. Q3. Work a slow-ops report.

    HEALTH_WARN reports 47 slow ops across osd.12 and osd.31, oldest blocked 92 seconds. Cluster is otherwise healthy with no recovery running.

  4. Q4. What three facts does a SLOW_OPS warning provide, and which is the lead?

Passing score: 75%. Answers are checked in this browser.

Production discipline

Read dump_ops_in_flight and its flag_point before investigating the OSDs named in a SLOW_OPS warning; “waiting for subops from” names the OSD actually responsible, which is often not in the warning. Check the device, host, and network layers on that host rather than on the reporting one.

Cross-course references

  • Kubernetes: a failing dependency surfaces as errors in every service that calls it
  • Linux: a slow NFS server produces symptoms on every client, not on itself