Zayneb Tayachi
email: tayachi.zayneb@gmail.com

Mohamed Escheikh
email: mohamed.escheikh@enit.rnu.tn

Kamel Barkaoui
email: kamel.barkaoui@cnam.fr

Performability Modeling and Analysis of Server Virtualized Systems subject to Workload-dependent Software Aging

Keywords: Server virtualization systems, Workload-dependent software aging, Software rejuvenation, Performability, SRNs, Workload-aware power management petri nets, cloud computing, systems, petri nets, mobile networks optimization, cloud computing and power management

come

Performability modelling and analysis of server virtualised systems subject to workload-dependent software aging

Zayneb Tayachi, Mohamed Escheikh, Kamel Barkaoui

Introduction

Nowadays the massive investment of cloud computing service providers in infrastructure as a service (IaaS) around the world had significantly contributed to the spectacular growth of IT infrastructure and the large proliferation of data centers deployment. This trend is mainly boosted by increasingly rising demand for computing resources generated by modern services such as compute-intensive and scientific applications. In order to consolidate data centers' efficiency a great deal of progress remains to be achieved today and concerns mainly leveraging the full benefits of both virtualization technologies and dynamic power management (DPM) mechanisms. Virtualization enables both flexibility and operating cost benefits. This is mainly achieved through migration and consolidation techniques. DPM provides interesting opportunities to rationalize power consumption and to avoid dramatic resource wastage accordingly. This is primarily fulfilled through suitable power management (PM) mechanisms making the most of Advanced Configuration and Power Interface (ACPI) specifications and complying with green data center sustainability needs. Another requirement emerges today for modern data centers concerns providing high performance while ensuring high availability in order to support critical applications. Server virtualized systems (SVSs) are considered nowadays the cornerstone of data centers and their successful migration toward green architectures for data centers operators requires 2. How to implement in SVS, a time-based workload-aware PM policy enabling energy savings for bursty workload?

3. How to make suitable and opportunistic decision about workload-aware switching between PMC soft states in order to minimize SVS energy consumption while keeping acceptable performance complying with service level agreement (SLA) constraints?

4. How to distinguish, from a design perspective, between different VMM rejuvenation techniques when conceiving versatile SVS SRN models?

5. How to define suitable reward-based measures in order to quantify dependencies between software aging, workload, and performability metrics (i.e. steady state availability, performability metrics and power metrics)?

The remainder of this paper is organized as follows. In Section 2 we address related work. In Section 3 we first examine workload handled by SVSs. We succinctly describe SVS issues such as software rejuvenation, software fault tolerance techniques and PM in SVSs. Lastly, we discuss in the same section correlations between workload, software aging, PM policy and power consumption in SVSs. Section 4 provides a detailed description of the proposed versatile SVS SRN models. Next, we illustrate the main contributions provided in this paper.

In Section 5 we define some selected parameters and metrics of the versatile SVS SRN models cited above. In Section 6 we illustrate by means of numerical analysis how workload with bursty nature impacts software aging, steady-state availability, performability metrics, power metrics and power-performance metric in SVS. Finally Section 7 concludes this paper.

Related Work

In literature, different modeling approaches have been proposed to better describe the dynamic of different entities involved in virtualized systems. Authors in [START_REF] Cotroneo | A survey of software aging and rejuvenation studies[END_REF] and [START_REF] Cotroneo | Software aging and rejuvenation: Where we are and where we are going[END_REF] propose surveys on the main studies given in literature on software aging and rejuvenation (SAR). In [START_REF] Alonso | A comparative experimental study of software rejuvenation overhead[END_REF] authors present a comparative experimental study of six rejuvenation strategies, categorized in terms of granularity, to mitigate software aging effects. They show that performance overheads caused by software rejuvenation techniques are closely dependent on granularity level. In the same work, authors provide comprehensive guidelines to handle decision making related to rejuvenation scheduling algorithms and to select the suitable rejuvenation mechanism. Authors in Saito and Dohi (2016) present an approach based on semi-Markov models to investigate how software aging testing affects system behavior and its availability in the operational phase. It's worth mentioning the above models account for both aging-related bugs and non-aging-related bugs. At PM level a set of works have been proposed. [START_REF] Chen | Managing Server Energy and Operational Costs in Hosting Centers[END_REF] investigated trade-offs between energy consumption and performance based on SLA. They highlighted time overhead of switching on/off nodes and the relevant energy consumption on reliability. [START_REF] Nathuji | Feedback Driven QoS Aware Power Budgeting for Virtualized Servers[END_REF] developed PM system for virtualized distributed architectures referred to as virtual power. They proposed the notion of soft power states and related mapping with hard power states to enable VM managing soft power with traditional techniques. Control theory is used successfully in [START_REF] Gaoa | Quality of Service Aware PM for Virtualized Data Centers[END_REF] and [START_REF] Beloglazov | Energy-aware resource allocation heuristics for efficient management of data centers for cloud computing[END_REF] to tackle issues on PM server. [START_REF] Elnozahy | Energy-efficient server clusters in Power-Aware Computer Systems[END_REF] applied two PM mechanisms (Vary-On Vary-Off, VOVO) to explore power efficiency resource management problem in homogenous cluster hosting a single web application with SLAs requirements. In the above work, authors proposed five resource management policies to estimate the needed CPU frequency meeting response time requirements. At fault tolerant level, SRN modeling approach was used in [START_REF] Han | Availability Models for Virtualized Systems with Rejuvenation[END_REF] and [START_REF] Machida | Modeling and Analysis of Software Rejuvenation in a server virtualized system[END_REF] to build availability models for virtualized systems including VM and VMM subject to software rejuvenation.

In [START_REF] Machida | Modeling and Analysis of Software Rejuvenation in a server virtualized system[END_REF] authors present a comparative study between availability models of three VMM rejuvenation techniques referred to as Cold-VM, Warm-VM, and Migrate-VM. They show that rejuvenation trigger intervals of both VM and VMM need to be carefully chosen so as to reach high-level VM steady-state availability. In [START_REF] Wang | Performability analysis of clustered systems with rejuvenation under varying workload[END_REF] and [START_REF] Xie | Software rejuvenation policies for cluster systems under varying workload[END_REF] time-based rejuvenation policies under varying workload have been developed to enhance the performability measure of cluster system. A comparative study of three different rejuvenation policies is achieved through analytical models using deterministic and stochastic Petri net (DSPN) models. VM consolidation techniques [START_REF] Takeda | A rank-based VM consolidation method for power saving in datacenters[END_REF], [START_REF] Ye | Virtual machine based energy efficient data center architecture for cloud computing: A performance perspective[END_REF]) and energy management policies [START_REF] Feller | State of the art of power saving in clusters and results from the EDF case study[END_REF]) are investigated to enable cloud computing energy saving. Authors in James and Ian ( 2013) introduce an energy-efficient technique for private cloud, namely workload mixes, for assigning tasks to servers to balance application performance and energy consumption. [START_REF] Kaur | Performance Evaluation of Power Aware VM Consolidation using Live Migration[END_REF] propose a performance evaluation of power aware VM consolidation using live-migration. The objective is to assign workload to servers according to a function of their cost to operate. [START_REF] Ghosh | Power-Performance Trade-offs in IaaS Cloud: A Scalable Analytic Approach[END_REF] developed a scalable analytical model to quantify power-performance trade-off. The model enables to judiciously configure physical machine pools. Recovery methods in IaaS context are investigated by Beloglazov et al. (2011) through a Markov chain model and a control algorithm for recognizing overloading problems during dynamic VM consolidation and to achieve load balancing through migration if needed. Recovery methods are also used by [START_REF] Bobroff | Dynamic placement of virtual machines for managing sla violations[END_REF] to avoid SLA violations. Also, power-performance tradeoff has been investigated by [START_REF] Escheikh | A versatile traffic and power aware performability analysis of server virtualized system[END_REF] and [START_REF] Escheikh | Versatile workload-aware power management performability analysis of server virtualized systems[END_REF] through modeling a workload-aware PM mechanism for SVS subject to Cold-VM. Authors in Grottke and Schleich (2013) investigate the optimal energy requirement of a computing cluster in a proportional data center to maintain a specific workload and performance objectives. They show how optimizing switching between running and hibernating servers' states to fulfill a selected service level objective (SLO) with minimum energy overhead. Work in [START_REF] Araujo | Software aging in the eucalyptus cloud computing infrastructure: characterization and rejuvenation[END_REF] investigates software aging impact in the Eucalyptus framework. It highlights potential harmful issues related to system dependability and performance, involving RAM memory, swap space exhaustion as well as highly excessive CPU utilization by the VM. In the same work, authors propose a predictive approach based on time series analysis to schedule rejuvenation, so as to reduce downtime. They show therefore that their approach outperforms in terms of availability the threshold-triggered rejuvenation method based on continuous monitoring of resources utilization. Authors in [START_REF] Kuehn | Automatic energy efficiency management of data center resources by load-dependent server activation and sleep modes[END_REF] develop a versatile multi-server queuing model for data center servers enabling load-dependent server consolidation. They show through numerical results how to quantifying tradeoff between energy efficiency and QoS.

Performability analysis of SVSs

Performability is defined as a combination of system's performance and its dependability measure in the presence of faults. It can be thought of as the "quality of service (QOS), provided the system is correct" [START_REF] Meyer | Performability: a retrospective and some pointers to the futur[END_REF]. Dependability is an all-encompassing definition for reliability, availability, safety and security [START_REF] Laprie | Dependability: Basic concepts and terminology[END_REF]. We focus in this paper on the combination of performance and availability measures of SVS.

In order to investigate SVSs performability analysis, it's recommended to consider several attributes such as PM, time-varying workload, dynamic speed scaling, software aging, failure, and rejuvenation. This enables better representation and understanding of different underlying potential interactions between all these attributes and to draw among them better performance-dependability trade-off. In the design and development processes of virtualized systems, many pertinent questions regarding time-varying workload impact on software aging, availability, performability, power-saving, and efficiency have to be considered. In order to achieve this purpose, performability techniques would be very useful to conceive appropriate models representing the desired behavior in a flexible, concise and modular way. Particularly modeling approach based on high level Petri nets formalism and their variants are among the most appropriate techniques. To tackle these issues SRNs formalism specifically involving non-Markovian distributions is commonly used. This enables to establish interesting dependability analysis, thanks to its ability to describe with relaxed assumptions more realistic models. In addition, using SRNs in virtualized system modeling would define and adopt other attributes fitting the best with green computing requirements. We propose in this paper a non-Markovian SRN-based modeling approach to investigate performability analysis of a SVS subject to VMM rejuvenation enabling elastic resource provisioning and relying on workload-aware PM mechanism. This approach describes and captures in a modular and concise way correlations and interactions between the following entities: (i) time-varying workload of bursty nature in SVS environments;

(ii) VMM and VM subject to workload-dependent aging, failure, and rejuvenation; (iii) workload-aware PM scheme; (iv) on-demand service provisioning with dynamic speed scaling. The key contributions of this work are modeling: (i) how VMM or VM unavailability due to failure or rejuvenation affects service provisioning; (ii) PMC with multiple power states (having idle states (C-states) and operational states (P-states)) with dynamic and scalable resource provisioning; (iii) how workload tracking-based PMC scheme governs opportunistic transitions between PMC power states (P-states and C-states) to maximize efficiency. In what follows we detail the main performability attributes of SVS namely workload, fault tolerance, PMC, and workload-aware PM mechanism.

Workload in SVSs

Intensive and/or delay sensitive applications handled by SVSs are usually on demand and require usually dynamic provisioning. To meet stringent requirements of such applications, there is a need to dynamically adapt and manage virtualized system capabilities (scaling up/down CPU processing rates, switching opportunistically between CPU power states). These requirements are usually expressed and specified in SLA form in terms of throughput, waiting time, response time, quality of service and power efficiency. From a modeling perspective, it's highly recommended to use versatile processes such as Markov Modulated Poisson Process (MMPP) to capture time-varying nature of SVS handled workload and to illustrate dynamic speed scaling of resource provisioning. This will be more detailed in section 4. In the rest of this paper, we consider a SVS belonging to hypervisor-based configuration category (Fig. 1). Hypervisor, called also VMM, is a software implementation of server virtualization hosting guest operating systems (i.e VM).

Software rejuvenation in SVSs

To cope with software aging effects on VM and VMM, preventive maintenance (a.k.a. proactive fault management) techniques referred to as rejuvenation are used. Such techniques actually reduce unpredictable outage of cloud applications, postpone crash failures and improve software performance but at the expense of occasional and controlled unavailability. VMM software aging problem directly affects all hosted VMs. These latter need to be controlled since their execution environment is likely to be cleared just before VMM rejuvenation.

Fault tolerance in SVSs

When running modern applications (i.e. data intensive or delay sensitive applications) in highly dynamic computing environments such as virtualized datacenters characterized by a highly varying on-demand traffic, several disruptive events and undesirable conditions may occur. Among these events or incidents, we distinguish software aging manifested in different forms (errors, faults, ...) and becoming more pronounced as time progresses and workload becomes higher. The more solicited virtual software resources become the higher memory leakage risk. Memory leak concerns in computing science incorrect memory allocation management where memory is not released even if it's no longer needed. This may involve potential failures leading obviously to SVS unavailability. To cope with these problems preventive maintenance (a.k.a. proactive fault management) techniques referred to as rejuvenation are used to postpone or prevent system failures. Given that VMM hosts VM, failure or rejuvenation of the former affects accordingly the latter. Such techniques actually postpone crash failures and improve software performance but at the expense of occasional and controlled unavailability. For SVS, software aging affects potentially both VMM and VM and any relevant performability analysis should take into consideration such key factors.

In the rest of this section we present some attributes and characteristics related to PMC, next we detail principles of workload-aware PM mechanism in SVSs.

PMC in SVSs

The main PMC feature in SVSs is to allow multiple operation modes to achieve workloadaware power-performance trade-off. Actually having several operation modes increases flexibility and enables finer control. It may incur however additional costs in terms of delay or performance loss. In practice, the number of operation modes is limited. To that end, and in order to reduce operating cost and to rationalize energy consumption, ACPI Hewlett-Packard Corporation et al. (2011) industry standard has defined performance and power component states. The main purpose is to allow operating systems to fully monitor and control aspects related to power saving of their underlying hardware. In the following, let us detail the above PMC power states.

• P-states: are referred to as performance states and denoted as (P 0 ,P 1 , ..., P n ). They determine capabilities of a working (i.e. active /loaded) CPU to save power. It should be pointed out that the number of P-states is component specific. Switching from one P-state to another is enabled through scaling both frequency and voltage. The higher P-state number, the lower frequency. Therefore power consumption decreases with respect to P-state number's increase. • Off states: They include only one state referred to as off state which consumes no power.

Hence PMC's power states maybe classified in an ascending order of energy consumption as follows; off, sleep, idle, wakeup, slowactive and fastactive.

Workload-aware PM mechanisms in SVSs

For SVSs, different workload-aware PM schemes maybe adopted to cope with on-demand traffic of data intensive as well as latency-sensitive applications [START_REF] Beloglazov | A taxonomy and survey of energyefficient data centers and cloud computing systems[END_REF]. Such applications often generate highly time-varying workload incurring several nonuniform unpredictable fluctuations and including workload burst periods of variable lengths.

From PM point of view, appropriate control schemes should be adopted in order to meet stringent SLA requirements. A carefully designed PM scheme should rely on coordinated solutions combining multiple policies to handle multi-objective adaptations. Adopting a PM policy (or a logic) enables a clear description of advantages, related costs and overheads of each adaptation alternative. This will be used to make the good decision at the right time about the right resources in a dynamic and flexible manner. Therefore, each adaptive alternative should be evaluated before making a decision but also reevaluated at each adaptation period. This could be achieved by building self-tuning schemes enabling self-configuring properties through adapting dynamically PMC power states according to workload variations without causing unbearable overheads. These overheads may result from several reasons often related to satisfying at the same time several conflicting needs in terms of efficiency, correctness and stability while complying with constraints. Workload-aware PM encompasses DPM and dynamic voltage frequency scaling (DVFS) policies. DPM tries to fully exploit knowledge about real-time resource usage and applications' nature to minimize energy consumption. It includes timeout, predictive and stochastic PM policies and is usually used for system components having multiple power states. Whereas DVFS is convenient for components supporting multiple speed and voltage levels dynamically scaled up or down.

In timeout PM scheme, PMC is forced to sleep state whenever it's idle for more than a specified period of time (referred to as timeout). Note that this period should be at least equal to break-even time which corresponds to the minimum necessary time PMC has to hold in the low-power state to recover switching costs to and from low-power state. Thus, it is preconized to filter out relatively short idle periods. The more PMC responds faster the smaller filter intervals are. Authors in [START_REF] Simunic | Dynamic power management for portable systems[END_REF] found that the most appropriate range of filter intervals for hard disk is included in [0.5 s, 2 s], while for WLAN card filter intervals are considerably shorter (50 ms, 200 ms) since these devices respond much faster than the hard disk. Unlike timeout policies, predictive policies rely on predicting upcoming idle period duration and take shutdown decision straight after PMC becomes idle. Stochastic PM policy is a DPM policy where workload and PMC behavior are described by stochastic processes and where PM maybe formulated as a power-performance optimization problem. PMCs such as CPU may support the two policies cited above (DPM, DVFS). This enables virtualized resources to meet QoS requirements of handled applications while rationalizing power resource utilization. In order to face changing scenarios and to fully benefit from available resources, applications should include self-configuring capabilities. This enables to take appropriate decisions squeezing most out of competing adaptation mechanisms and avoiding potential oscillations whenever two or more correlated objectives need to be reached simultaneously. Design of dynamic adaptive PM mechanisms suitable for SVSs context needs to capture correlations between PMC behavior and workload's dynamic via appropriate modeling approach.

Correlations between workload, software aging, PM policy and power consumption in SVSs

Software aging is commonly accelerated with time and with respect to workload increase. This should be captured in our modeling approach by considering workload-dependent software aging. Also energy efficient PM policy should minimize energy consumption by judiciously adapting PMC power states with respect to workload variations. This may be accounted in our proposed models by considering a time-based workload-aware PM This demonstrates also close correlation between on one hand this kind of PM policy and workload and on the other hand PM policy and workload-dependent aging. Given that PM policy aims to switch adaptively from one PMC power state to another, its impact on software aging is almost impalpable for both light and heavy workloads. Indeed in the first case PMC is almost always in sleep state whereas in the second case PMC is almost always in active state and therefore in both cases dynamic workload aware PM policy would not provide significant gains.

SRNs modeling of versatile SVS with workload-aware PM mechanism

From a point of view combining performance and dependability, VM needs to assign dynamically virtualized resources such as vCPU, vRAM, vDDR, in an adaptive way taking into consideration impairments cited above and aiming to meet QoS requirements while preserving low power costs. These resources should be managed according to efficient pre-established policy in order to achieve convenient processing.

In this section, we first recall SRN paradigm. We give next a detailed description of two proposed versatile SVS SRN models. The first model accounts for Cold-VM whereas the second takes into consideration Migrate-VM. We examine also tunable parameters in the two SVS models and we detail the main contributions in this paper.

SRN basic principles

Petri nets (PNs) represent a high level formalism providing the underlying Markov model specification and a visualization of system's dynamic Tadao [START_REF] Murata | Petri nets: Properties, analysis and applications[END_REF]. They give easier representation of computer system features such as concurrency, synchronization, sequencing and resource sharing through a set of places (represented by circles) and transitions (represented by rectangles). Each place represents a system local state and may contain zero or more tokens (represented by black dots or integers). Each transition represents a system event and is connected to places via oriented arcs. A transition is enabled if at least one token is deposited in each input place. The firing of an enabled transition removes a token from each of its input place(s) and puts one token in each of its output place(s). The number of tokens in each place (a.k.a. marking) characterizes a PN state. We distinguish two kinds of marking: vanishing and tangible. Tangible marking maybe assigned a reward rate. A transition with an assigned marking dependent guard is enabled only if this guard is true. Notice also that transitions maybe immediate or timed. In this last case, transition firing time is a random variable. The use of non-Markovian transitions distributions such as deterministic or general, allows building more realistic models. Transitions which are never preempted are referred to persistent. However those which may be preempted are known as non-persistent. For non-Markovian non-persistent transitions, a firing policy has to be specified. The first kind of policies is known as preemptive resume (prs) whereas the second one is referred to preemptive different (prd). prs (resp. prd) policy means that when a transition is disabled without having fired, its performed work is maintained (resp. lost). A more concise description of the stochastic PN (SPN) model may be obtained by using several extensions such as marking dependent arc multiplicity, priorities and guards (i.e. enabling function) with firing dependent firing rates (also called reward rates and formulated with respect to the number of tokens in place P (i.e. #P )). Also associating reward description to PNs extends SPNs and is referred to as SRNs. The modeling paradigm based SRNs is recognized to be among the most powerful tools to investigate modelbased performability analysis combining performance and dependability evaluations. SRNs facilitate both reward structure specification and Markov reward model automatic generation. They allow to specify and calculate a variety of qualitative and quantitative performance measures. SRNs enhance both modeling power and modeling convenience and specify output measures as a reward-based function. In SRNs a tangible marking may be associated with a reward rate so as to facilitate the computation of several output measures. Classical output measures namely mean (expected) number of tokens in a place, expected transition throughput and probability that an event occurs may be derived from a SRN. Also, reward functions may be used to define more complex output measures.

Output measures in SRNs: Assume X a random variable representing a reward rate and describing a given output measure of interest. In steady-state the expected reward rate expression is given by:

E[X] = k∈T n k r k
where T is the set of tangible markings, n k (resp. r k ) is the steady-state probability (resp. reward rate) of tangible marking k.

Description of the proposed versatile SVS SRN models

We propose in this paper two versatile SVS SRN models representing SVS composed by one VMM hosting a VM which in turn handles data intensive applications with time-varying traffic. The first versatile SVS SRN model is subject to Cold-VM rejuvenation whereas the second one uses migrate-VM (i.e. live migration) as VMM rejuvenation technique. The two above models include a workload-aware PM mechanism enabling to judiciously adapt PMC's soft power states (a.k.a. P-states, C-states) in accordance to workload variations. In our modeling approach we assume that VM and VMM are subject during their operational processes to several impairments such as workload-dependent software aging, failure and rejuvenation. We assume likewise that VMM assigns dynamically to VM a PMC (i.e. virtualized resources such as vCPU) monitored by workload-aware PM policy. For illustrative purposes instead of using monolithic model we adopt a modular approach to better describe interactions between different sub-models of each proposed versatile SVS SRN model. This is justified by the need to better understanding complex SVS model involving several attributes. For more convenience, we will use in the rest of this paper the following notations:

• The first (resp. second) versatile SVS SRN model subject to Cold-VM (resp. Migrate-VM) rejuvenation is referred to as model 1 (resp. model 2 ).

• Each of theses models encompasses two dependent sub-models. The first one describes VMM and VM interactions in SVS, whereas the second sub-model represents a workload-aware PM mechanism.

• Model 1 is composed by sub-model 11 (Fig. 2, Tab. 1, Tab. 3, Tab. 6) and sub-model 12 (Fig. 4, Tab. 2, Tab. 4, Tab. 7).

• Model 2 includes sub-model 21 (Fig. 3, Tab. 1, Tab. 3, Tab. 6) and sub-model 22 (Fig. 4, Tab. 2, Tab. 5, Tab. 7).

• Notice that sub-model In the rest of this subsection, we provide a detailed description of model 1 and model 2 . Notice that we adopt the same notation for naming transitions and places. For example T vf p (resp. T hf p) name abbreviates fail-prone transition of VM (resp. VMM)). We next investigate tunable parameters in the workload-aware PM SRN sub-model before defining some pertinent performability metrics of the two proposed versatile SVS SRN models.

SVS SRN sub-model with Cold-VM rejuvenation (sub-model 11 )

Sub-model 11 (Fig. 2) encompasses a VMM model and a VM model. VMM model includes a VMM sub-model (Fig. 2a) and a VMM clock sub-model (Fig. 2b). Similarly VM model includes a VM sub-model (Fig. 2c) and a VM clock sub-model (Fig. 2d). VMM (resp. VM) clock sub-model is used to trigger VMM (resp. VM) time-based rejuvenation. The VM model is closely dependent of the VMM model. This is straightforward since failure or rejuvenation of VMM affects automatically the handled VM. Related dependencies between VM and VMM are illustrated through assigned guards in VM model. In what follows we recall detailed description given in [START_REF] Machida | Modeling and Analysis of Software Rejuvenation in a server virtualized system[END_REF] for sub-model 11 . We highlight also potential interactions between VMM and VM models.

VMM model description:

As soon as the latest VMM boot time expires, deterministic transition T hinterval with constant duration 1/τ h fires to trigger VMM rejuvenation as long as immediate transition T hpolicy is enabled. Fig. 2a represents and describes failure, recovery and time-based rejuvenation processes in VMM. Whenever VMM software aging transition T hf p fires, it deposits a token in P hf p. T hf ail firing assigns a token to P hf ail. The above place indicates the state of VMM failure caused by software aging. T hdet firing is conditioned by VMM failure detection whereas T hrepair firing is only enabled if VMM recovery process (from failure state) is fully achieved. VMM clock (Fig. 2b) enables to trigger VMM rejuvenation phase and as soon as this event occurs, immediate transition T hrejt or T hf prejt can fire and moves a token from P hf p to deposit another one in P hrej. As soon as VMM rejuvenation process achieved, transition T hrej fires and deposits a token in P hup.

VM model description: T vinterval (Fig. 2d)fires, after the latest VM start up time, and triggers VM rejuvenation whenever immediate transition T vpolicy is enabled. T vinterval duration (i.e. 1/τ v ) is considered constant and is represented by a deterministic transition. As soon as VM rejuvenation process finishes, T vreset is enabled and puts a token in place P vclock. Notice that VM model (Fig. 2c) includes different stages of failure, recovery and time-based rejuvenation. Notice also that since VM model closely depends on the underlying VMM model, whenever no token is present in P hup nor in P hf p, both immediate transitions T vdw and T vf pdw are enabled and a token is put in P vstop. Getting a token in P hup or P f up allows transition T vrestart to be enabled and consequently VM cannot be rebooted unless VMM is available again. Cold-VM rejuvenation consists in shutting down hosted VM before starting any VMM rejuvenation. This is expressed by immediate transitions T vpre and T vf ppre and their associated guards' functions. Te above transitions are enabled as soon as a token is deposited in place P hpolicy (Fig. 2b). Whenever T vpre (resp. T vf ppre) fires a token is deposited in P vsd (resp. P vf psd) and as a consequence transition T vsd (resp. T vf psd) is enabled. In VM model (Fig. 2c), firing either T vsd or T vf psd allows to deposit a token in P vstop and to enable then immediate transition T hpolicy which in turn triggers VMM rejuvenation process (Fig. 2b). Notice that VMM rejuvenation starting is assumed conditioned by the presence of a token in one of places, P vup, P vf p, P vsd and P vf psd. Notice also that T vinterval (resp. T hinterval) distribution is considered deterministic since it's used to model fixed VM (resp. VMM) rejuvenation trigger interval. All others timed transitions in Fig. 2 are assumed exponentially distributed.

Description of SVS SRN model with Migrate-VM (sub-model 21 )

Sub-model 21 (Fig. 3, Tab. 1, Tab. 3 and Tab. 6) consists of VM sub-model, VM clock sub-model, VMM sub-model and VMM clock sub-model. Notice that representation, associated notations and guards of sub-models (Fig. 3a, Fig. 3b and Fig. 3d) included in model 21 , are respectively exactly identical to those given in Fig. 2a, Fig. 2b and Fig. 3d (described above in subsection 4.2.1) T hpolicy guard function (Tab. 3). Fig. 3c shows sub-model of a VM housed by VMM subject to Migrate-VM rejuvenation. Migrate-VM rejuvenation uses live VM migration to move a running VM from the current VMM, just before triggering its rejuvenation, to a remote VMM. If a token is deposited in P vup or P vf p and immediate transitions T vpre and T vf ppre are enabled, VM migration process to remote host is triggered. T vpre and T vf ppre are enabled when a token is deposited in P hpolicy (Fig. 3b). While a token is present in P vmigd or P vf pmigd, VM execution on remote host will continue. As soon as VMM rejuvenation is completely achieved, immediate transitions T vpost and T vf ppost will be enabled and VM returns back from remote host to original host, again by live VM migration. To keep SVS SRN model more tractable, we assume that no failure occurs throughout VMM rejuvenation and VM migration periods. VMM rejuvenation can be triggered unless a token is deposited in P vup, P vf p, P vmig, P vf pmig, P vbac or P vf pbac. If a token is deposited in P vup, P vf p, P vmigd, or P vf pmigd, then VM becomes available and transition T vinterval is enabled. Sub-model 12 and sub-model 22 have the same representation (Fig. 4, Tab. 2, Tab. 7) but they have different guards (Tab. 4, Tab. 5). Control scheme implementing PM mechanism is conceived to achieve dynamic adaptive PM policy relying on workload tracking process. Tracking process aims to make appropriate opportunistic workload-aware decisions enabling to wisely choose how and when to force PMC to transit from one power state to another. This is achieved by choosing appropriate PMC power states accordingly. Application-driven PM policies for unpredictable time varying workload are commonly of stochastic and non stationary nature and change over time according to workload variations.

Assumptions

Table 1 Transitions description of sub-model 11 (Fig. 2) and sub-model 21 (Fig. 3) We particularly assume that:

Common
• transitions distributions are either immediate (imm.), exponential (exp.) or deterministic (det.);

• PMC has the following power states: off state (P of f ), active or operational states (P f astactive, P slowactive) and idle states (P idle, P wakeup ,P sleep). The lower power state the more time it experiences to come back to active state;

• PMC is initially in sleep state (P sleep);

• SVS is initially idle (#P queueplace = K = 3, where K is buffer capacity of the SVS model);

• PMC service processing follows a two states MMPP, this allows to capture dynamic speed scaling of PMC;

• PMC service processing is workload-dependent;

• request arrival follows a two states MMPP, this enables to capture traffic burstiness;

• there are 4 traffic sources (X high traffic sources and Y low traffic sources with X + Y = 4);

• initially there are 4 low traffic sources;

• PMC is initially in sleep state. According to this assumption and as a request arrival occurs, PMC service initiation (i.e. request processing) is not granted at once. Instead, T servslow (P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1)

T f 2s

(P hightraffic == 0) && (P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1)

T s2f

(P hightraffic > 0) && (P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1)

T f ast

(P servfast == 1)
T slow

(P servslow == 1)
T start (P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1)

T sleep2wakeup

(P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1) T wakeup (P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1) T timeout (P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1)

T lossjob

(P vup == 0) && (P vfp == 0) && (P vsd == 0) && (P vfpsd == 0)

T rejdown1

(P vup == 0) && (P vfp == 0) && (P vsd == 0) && (P vfpsd == 0)

T rejdown2

(P vup == 0) && (P vfp == 0) && (P vsd == 0) && (P vfpsd == 0)

T rejdown3

(P vup == 0) && (P vfp == 0) && (P vsd == 0) && (P vfpsd == 0)

T rejdown4

(P vup == 0) && (P vfp == 0) && (P vsd == 0) && (P vfpsd == 0)

T rejdown5

(P vup == 0) && (P vfp == 0) && (P vsd == 0) && (P vfpsd == 0) T notrejdown (P up == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1) it's deferred and triggered after a given delay has elapsed. This delay corresponds to a given time (T wakeup) needed by PMC to switch from sleep state to active state;

• PMC power consumption along T wakeup duration is maximum and equal to P owerf astactive.

Request processing process description

As soon as a request occurs (a token is deposited in P inqueue), and since there is initially a token in P sleep, transition T sleep2wakeup is enabled. Forthwith, a token is deposited in P wakeup and transition T wakeup is thereby enabled. Note that whenever T wakeup is enabled and before its firing, further request arrivals may enter the system and as much tokens are deposited in P inqueue. The number of tokens in P inqueue represents the number of requests waiting to be processed whereas P queueplace represents the available T servslow (P vup == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1)

T f2s

(P hightraffic == 0) && (P vup == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1)

T s2f

(P hightraffic > 0) && (P vup == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1) T fast

(P servfast == 1)
T slow VMM rejuvenation trigger rate 0.005952381 1 week system capacity. Forthwith T wakeup fires, PMC transits from wakeup state to idle state and a token is deposited in P idle. This enables, straight after, the immediate transition T start since at least a token is present in place P inqueue. Once T start fires, it moves one token from each of places P inqueue and P idle and forwards a token to P active.

(P servslow == 1)
Here indeed the actual request processing begins. The dynamic speed scaling of PMC following a MMPP process is expressed by transitions T servf ast and T servslow alternating between P servf ast and P servslow (using transitions T f 2s and T s2f ).

According to assigned guards one of the immediate transitions T f ast and T slow is enabled. When T f ast (resp. T slow) fires, it puts a token in P f astactive (resp. in P slowactive). Adapting service processing rate to workload variations is achieved through marking dependent firing rates. This adaptation is enabled by assigning guard(s) to one or both of transitions T s2f and T f 2s. ). This is captured in PM SRN model by immediate transitions T rejdown1, T rejdown2, T rejdown3, T rejdown4 and T rejdown5. These latter are enabled with the same assigned guard specifying that VM or VMM is unavailable. Indeed in such case, one of the above transitions fires, moves a token from one of the following places: P sleep, P idle, P f astactive, P slowactive, P wakeup and immediately forwards a token in place P of f . To summarize the above process let us consider time interval T int between instant when previous request is fully processed and instant when current request occurs. If T int is strictly shorter than a given time (corresponding to T timeout delay) then as soon as the processing of the previous request is achieved, PMC immediately transits from active state (P f astactive or P slowactive) to idle state (P idle). PMC remains in P idle until T int time interval is elapsed and straight after it switches to active state to initiate current request processing. Inversely if T int is greater than T timeout duration and as soon as this latter is elapsed, PMC switches from idle to sleep state. In the following we will discuss what kind of transitions' delays would be adaptively tuned according to workload's dynamic to achieve a workload-aware PM Policy.

transition Value T h2l = 1 σ T h2l 0.1 T l2h = 1 σ T l2h 0.01 T hightraf f ic = 1 λ T hightraf f ic [0.0015,...,250] T lowtraf f ic = 1 λ T lowtraf f ic [0.0003,...,50] T servf ast = 1 λ T servf ast 0.05 T servslow = 1 λ T servslow 0.002 T f 2s = 1 σ T f 2s 0.1 T s2f = 1 σ T s2f 0.01 T wakeup = 1 λ T wakeup 0.01 T timeout = 1 λ T timeout 0.02
A graphical illustration of request processing request is provided in Fig. 5 to better understand how PMC states evolve and how requests are processed vs time. For more explanation of the above process, let's define a cycle (Fig. 5) as the time period between instant of triggering T wakeup and T timeout expiry. For each cycle corresponds one firing occurrence of both T wakeup and T timeout. Workload's increase raises certainly departure frequency of SVS whereas it may increase, decrease or keep constant the number of T wakeup periods (T wakeup firing frequency) during time interval T . This is highlighted in Fig. 5 where three kinds of SVS workloads are considered. Notice that workload increase from very light level (Fig. Notice also that according to our modeling approach the request processing process maybe considered as a particular queuing system where the waiting time consists of three cumulative delays:

• the first one, D1, is due to T wakeup. In the best case D1=0 (if the request arrival occurs and finds PMC in idle state) and in the worst case D1=T wakeup duration (if request arrival occurs and finds buffer empty and PMC in sleep state). If an arrival occurs and transition T wakeup is already triggered (by a previous arrival) without being fired then D1 is equal to residual time of T wakeup. In this last case, the following equation holds 0 < D1 < T wakeup;

• the second, D2, is due to the waiting time in the SVS buffer (i.e queue) before beginning the service;

• the third delay, D3, corresponds to the expected request processing time (mean service duration).

The aforementioned analysis enables to better explain the waiting time accumulated by a request from its arriving instant until its departure from the SVS. This allows also to better understand the overall SVS model.

Place invariants (P-invariants)

In what follows we detail P-invariants of workload-aware PM SRN sub-model (Fig. 4): the first P-invariant corresponds to system property that at most K buffer places are available (i.e. #P queueplace + #P inqueue + #P active + #P f astactive + #P slowactive = K); second P-invariant means that PMC is in one of possible states (i.e. #P of f + #P sleep +#P wakeup +#P idle +#P active +#P slowactive +#P f astactive = 1); third P-invariant (i.e. #P servslow + #P servf ast = 1) describes property that PMC, whenever is active, is either serving with fast or slow rate. The property that #P hightraf f ic + #P lowtraf f ic = n = 4 means that arrival traffic is composed of n sources.

Tunable parameters in the proposed Workload-aware PM Policy

In workload-aware PM SRN model (Fig. 4), we distinguish between two kinds of timed transitions:

• Transitions with non-tunable delay (T notrejdown and T wakeup ): They are assumed exponentially distributed. The corresponding delays of such transitions are inherent to PMC technology. T notrejdown corresponds to the PMC necessary time to transit from off state to sleep state. Whereas T wakeup duration is the time needed by PMC to transit from sleep state to idle state.

• Transitions with tunable delay according to the context and depending on workload are T timeout, T servf ast, T servslow, T s2f and T f 2s. Tuning delays of such transitions in opportunistic way may be a key factor to make appropriate decision of a given PM policy relying on workload attributes in order to reach good powerperformance trade-off without incurring unbearable oscillations. Oscillatory behavior may be avoided by choosing T timeout value beyond a given threshold. This threshold corresponds to the break-even time defined in previous sections and expressed by the needed time to switch to and from an active state.

In the following subsection we will define some SVS performability and efficiency metrics that will be investigated later through numerical results with respect to timeout parameter.

Main contributions of the proposed versatile SVS SRN models

In this section, we discuss the strong points and limitation of the proposed models when compared with similar ones presented in previous works [START_REF] Escheikh | A versatile traffic and power aware performability analysis of server virtualized system[END_REF] 2010)). This is mainly useful for more concrete numerical investigations.

• In the present paper we are concerned in this paper with workload-dependent software aging instead of workload-independent software aging for both VMM and VM (investigated in [START_REF] Escheikh | A versatile traffic and power aware performability analysis of server virtualized system[END_REF] and [START_REF] Escheikh | Versatile workload-aware power management performability analysis of server virtualized systems[END_REF]).

• We have introduced in the workload-aware PM mechanism presented in this paper (compared with works given in [START_REF] Escheikh | A versatile traffic and power aware performability analysis of server virtualized system[END_REF] and [START_REF] Escheikh | Versatile workload-aware power management performability analysis of server virtualized systems[END_REF]) a new PMC power state accounting for PMC switching between wakeup state and idle state. This provides more clarification and accuracy in describing PM mechanism.

• Numerical investigations and defined performability metrics in [START_REF] Escheikh | A versatile traffic and power aware performability analysis of server virtualized system[END_REF] and [START_REF] Escheikh | Versatile workload-aware power management performability analysis of server virtualized systems[END_REF] focus on PM impact regarding performance (i.e. mean waiting time), power usage as well as power-performance efficiency when using time varying bursty workload. The objective is to find opportunistic timeout value (the tunable parameter of the PM mechanism) providing optimal power-performance tradeoff for a given workload. In this paper, we are rather concerned with comparative study between SVS subject to Cold-VM rejuvenation and SVS subject to Migrate-VM rejuvenation for different SVS metrics. These metrics highlight the impact of workload-dependent aging, workload and workload burstiness on steady-state availability, performability metrics, power metrics and power-performance metric.

• Another distinction, in [START_REF] Escheikh | A versatile traffic and power aware performability analysis of server virtualized system[END_REF] and [START_REF] Escheikh | Versatile workload-aware power management performability analysis of server virtualized systems[END_REF], the proposed versatile SVS SRN models are solved using TimeNet 4.1 tool (Armin Zimmermann (2012)) whereas in this work we propose two versatile SVS SRN models and their performability analysis is achieved through SPNica tool [START_REF] German | Performance evaluation of IEEE 802.11 wireless LAN's with stochastic Petri nets[END_REF]).

Discussion about the proposed SVS models

In this subsection we enumerate first the main efforts of using the proposed SVS models. We address then the related limitations and eventual extensions.

Main efforts of using the proposed SVS models

The main efforts of using the proposed SVS models is to:

• concisely describe SVS behavior through SRN as a degradable system;

• adopt modular design approach providing more scalability and less complexity than monolithic approach.

• judiciously specify output measures as reward-based functions;

• capture more SVS properties through using extensive marking dependencies without leading to untractable model resolution;

• describe dependencies between on one hand workload and on the other hand software aging and PM mechanism is essentially useful for variable traffic.

• highlight how workload burstiness increases or decreases SVS performability;

2. Limitations and eventual extensions of the proposed SVS models:

The considered SVS models:

• consist of a hosting server handling a VMM with one hosted VM. This latter is assumed running one or more applications over a given operating system. Such assumption may be relaxed by considering a SVS handling several VMs on one VMM;

• assume only software failures;

• are examined for fixed values of Timeout time interval (The tunable parameter of the proposed workload-aware PM mechanism) and rejuvenation period (of either VM or VMM). Further investigations of the proposed SVS models may be done to optimize these parameters with respect to workload;

• are analysed only through steady state analysis. Further studies based on transient analysis may also be conducted for the same models.

Parameters and metrics of the proposed versatile SVS SRN models

We detail in this section some selected SVS parameters and metrics (traffic metrics, aging factor, performability metrics, power and power-performance metrics) defined from the proposed versatile SVS SRN models. If this is not explicitly stated otherwise we consider that the following metrics are valid by default for model 1 and model 2 .

Traffic parameters

Mean arrival rate (λ): is the mean requests' traffic arriving to SVS and is given by:

λ = λ T hightraf f ic .σ T l2h + λ T lowtraf f ic .σ T h2l σ T h2l + σ T l2h (1)
Index of dispersion for counts (IDC): measures burstiness of requests' traffic arriving to SVS and is given by:

IDC = 1 + 2(λ T hightraf f ic -λ T lowtraf f ic ) 2 σ T h2l .σ T l2h (σ T h2l + σ T l2h ) 2 (λ T hightraf f ic .σ T l2h + λ T lowtraf f ic .σ T h2l ) (2)

SVS Aging Factor (AF )

We define aging factor as an aging rate weight for both VM and VMM. Such definition is used to better express workload fluctuation impact on software aging rate. Notice that workload-independent software aging depends only on time whereas workload-dependent software aging depends both on time and workload. Definition: Let AF (Eq. 3) be a workload-dependent dimensionless index defined as the ratio between on one hand powers weighted sum of all PMC states (sleep, idle, slowactive, fastactive, wakeup) and on the other hand power corresponding to PMC in idle state. We choose this latter as a reference power state. Notice that the power weighted sum cited above encompasses the sum of each power value of a given PMC state with assigned weight equals to the probability of the PMC to be in this state. Notice that according to the above choice, AF may be smaller, equals to one or greater than one. For AF <1, AF enables to slow down aging and then enhance availability. For AF =1, aging and availability of SVS are insensitive to aging factor and aging rate is workload independent. For AF >1, aging is speeded up and availability decreases as well as workload increases. • Mean waiting time (W ) (s): is the ratio between the mean number of requests N in SVS (Eq. 7) and SVS throughput T h (Eq. 8)

W = N/T h (6)
• Mean number of requests (N ) in the system is given by:

N = E{#P inqueue} + E{#P slowactive} + E{#P f astactive} (7)
• SVS throughput (T h) (requests/second)

T h = E{#T servf ast} + E{#T servslow} (8)
• Mean firing frequency of T lossjob (requests/second): quantifies the mean request loss rate in SVS.

F T lossjob = (E{#P hightraf f ic}.λ T hightraf f ic + E{#P lowtraf f ic}.λ T lowtraf f ic ).(E{#P vstop} + E{#P vpre} + E{#P vf ail}) (9)

• Mean firing frequency of T wakeup (F T wakeup)

Cold-VM:

F T wakeup = A B .λ T wakeup (10)
Migrate-VM:

F T wakeup = C B .λ T wakeup (11)
where • Power utilization ratio (U ): is defined as the ratio between F oT P used and F oT P req:

U = F oT P used/F oT P req (16)
where F oT P used is the fraction of time active power states are used (i.e. PMC is in an active state) given by:

F oT P used = E{1 #P f astactive=1 } + E{1 #P slowactive=1 } (17)
and F oT P req is the fraction of time PMC is in a power-consuming state (i.e. slowactive, fastactive, wakeup, idle, sleep) is given by:

F oT P req = E{1 #P f astactive=1 } + E{1 #P slowactive=1 } + E{1 #P wakeup=1 }+ E{1 #P idle=1 } + E{1 #P sleep=1 } = E{1 #P of f =0 } (18)

Power-performance metric

• Efficiency (E) (joules/request): is the ratio between mean consumed power P (Eq. 15) and throughput T h (Eq. 8)

E = P T h (19)
6 Numerical results

Investigation of the versatile SVS SRN models (model 1 and model 2 ) may be achieved at two scales. The first one corresponds to SVS with idle-dominated workload where PM is mainly dominated by timeout tuning [START_REF] Escheikh | A versatile traffic and power aware performability analysis of server virtualized system[END_REF] and [START_REF] Escheikh | Versatile workload-aware power management performability analysis of server virtualized systems[END_REF]), whereas the second, known as computationally intensive workload, where PM is dominated by a heavy load asking the highest voltage/frequency setting. We make this distinction to focus separately on each kind of parameters enabling adaptive switching between PMC power states. In idle-dominated workload case timeout delay value (characterizing transition T timeout) is the main parameter considered. Whereas in computationally intensive workload case the key parameters are transition rates describing PMC serving process (T servf ast, T servslow, T f 2s, T s2f ). In this section we investigate some numerical results related to the versatile SVS SRN models (model 1 and model 2 ). We particularly focus on how workload with bursty nature impacts the behavior of these models. To get insight into workload influence on SVS parameters and metrics defined in the previous section we perform several set of experiments based on analytical analysis using SPNica tool [START_REF] German | Performance evaluation of IEEE 802.11 wireless LAN's with stochastic Petri nets[END_REF]. In what follows, we investigate numerical analysis performability and power metrics of SVS:

6.1 Workload impact on SVS aging factor (AF )

Fig. 6 shows the trend of aging factor AF versus workload (λ). Obviously aging factor is an increasing function of workload. According to the plot (Fig. 6), three well-differentiated phases can be appreciated. The first one corresponds to low traffic where AF is slowly increasing. In the second, AF increases sharply with respect to workload evolution. In the last phase, corresponding to overloaded SVS (beyond a certain load), aging factor tends to converge towards a saturation value where it is almost insensitive to workload variations and where PMC power consumption is maximum.

6.2 Workload impact on versatile SVS SRN models' metrics 6.2.1 Workload impact on versatile SVS SRN models' performability metrics

• SVS Availability (As) (Eq. 4 and Eq. 5): We observe from curves in Fig. 7 that workload impact on steady state availability (As) is clearly the most significant for a workload ranging between 0.001 and 1. Outside this range, As is almost insensitive to workload variations. Indeed light workload's impact is so small so that it can not significantly affect software aging and consequently availability, whereas for heavy workload the aging rate is at its highest value and more workload increase will not further affect availability. Notice also that for both rejuvenation techniques (Cold-Migrate and Migrate-VM) As keeps pace with AF . This behavior is relatively straightforward inasmuch as availability evolves proportionally to aging factor. It's worth mentioning also that model 2 exhibits a better availability than model 1 for a given workload. This result is predictable since SVS unavailability corresponding to the time spent during VM migration process (for Migrate-VM ) is significantly less than the necessary time for VMM rejuvenation (for Cold-VM rejuvenation).

• Mean waiting time (W) (Eq. 6): Fig. 8 exhibits the mean waiting time of request per second with respect to workload. It shows that as workload increases W increases in the two versatile SRN SVS models. This is obvious since a greater load in SVS gives rise to longer queue and more delay in request processing.

• Mean firing frequency of T lossjob (F T lossjob) (Eq. 9): Fig. 9 highlights F T lossjob evolution as a function of workload. We observe that F T lossjob increases as a function of the mean arrival rate. This is also straightforward since the more load in SVS the greater requests losses. Noticing also that model 1 suffers more losses than model 2 for any workload. This may be justified by the same arguments given above for the behavior of SVS steady state availability (Fig. 7) with respect to workload. • Firing frequency of T wakeup (F T wakeup) (Eq. 11, Eq. 10): F T wakeup is an increasing function of workload (Fig. 10). Several parameters may be involved in the explanation of such behavior. T wakeup delay ( 1 λ T wakeup , Tab. 7) represents transition time from sleep state to idle state. According to Fig. 4 notice that three conditions must be fulfilled simultaneously to enable T wakeup: (i) VM is available (see T wakeup guard in Tab. 4, Tab. 5), (ii) there is at least one token in P inqueue, (iii) there is a token in P sleep (resulting from firing of either T notrejdown or T timeout). Hence T wakeup firing is closely correlated to the firing of a set of transitions namely T notrejdown, T timeout, T hightraf f ic and T lowtraf f ic. Firing frequency of the above transition is intimately related to SVS load level. Firing frequency evolution of F T wakeup may be interpreted at different levels of workload.

-For very light traffic (λ <10 -2 ), workload increase does not affect significantly firing frequency of T hightraf f ic or T lowtraf f ic (which remains very low) and keeps P inqueue almost empty. In such case even if there is often a token in P wakeup, T wakeup will very rarely fire.

-For medium traffic (λ ∈ [10 -2 , 10 2 ]), workload increase increases PMC switching frequency between different ACPI states (sleep, wakeup idle, fastactive, slowactive and off). It increases also SVS alternating frequency between availability and unvailability states (which increases T notrejdown). All these events are potentially involved in the explanation of F T wakeup increase with respect to workload.

-For heavy traffic (λ > 10 4 ), workload increase increases the number of tokens in P inqueue (if it is not full) and accordingly T wakeup firing frequency depends almost only on token presence in P wakeup. This last condition is nearly equivalent to having a token in P sleep which in turn depends on the firing of T notrejdown or T timeout.

Workload impact on ACPI power PMC states

Fig. 11 shows an increasing probability of the PMC to be in state wakeup (#P wakeup) as function of workload. Note that the corresponding curves dynamic follows aging factor trend with respect to workload. Fig. 12 captures probability trend of the PMC to be in state idle (#P idle) as function of workload. Notice that #P idle evolves, for light traffic (i.e. workload), with a positive workload increases the mean inter-request time decreases leading to more requests and more frequent associated idle periods. Beyond a given workload threshold (3.10 -2 ), the inter-request time falls often under timeout value and in such case the next request will be likely processed before timeout expiry. For heavy traffic inter-request time becomes much smaller than timeout and consequently the PMC would process very probably a batch of requests before experiencing the full timeout period. Request batch size increases as workload increases. Thereby for light traffic each request processing corresponds, on average, to one timeout period whereas this latter is likely to correspond to a batch size greater than one for heavy traffic.

Obviously as workload increases, PMC's probability to be in state sleep decreases (Fig. 13). Indeed workload increase extends time periods where PMC is busy. This consequently shortens time periods where PMC is in sleep state. Fig. 15 and Fig. 14 illustrate how ACPI power PMC states evolve for different workloads.

Workload impact on versatile SVS SRN models' power metrics

• Mean consumed power (P) (Eq. 15): PMC's power consumption against a changing mean arrival rate is depicted in Fig. 16. For small λ (λ < 10 -3 ) P is low since PMC is nearly always in sleep state consuming by far the smallest power value. Gradually as λ increases, PMC tends to go more to active states and thereby P raises and tends to converge toward a fixed value (this corresponds to maximum power threshold where PMC is almost always in active state). The above explanation is valid for both model 1 and model 2 .

IDC impact on versatile SVS SRN models' metrics

As IDC increases, traffic burstiness increases. This yields correlated traffic deepening traffic fluctuations. Since in our modeling approach we adopt a workload-aware PM mechanism, processing more bursty traffic is equivalent to serve in the same cycle greater request batch size. This is likely to be achieved by PMC with less time in idle state and more time in sleep state. Since idle state consumes much more power than sleep state, batch processing enables better performability. Fig. 19 shows, for a given λ (corresponding to AF >1), that SVS steady state availability is an increasing function of IDC and that model 2 provides better availability than model 1 . This increase begins slowly as IDC increases until reaching a certain IDC value beyond loss rate (Fig. 21) and mean firing frequency of Twakeup (Fig. 22) decrease. This decrease begins slowly as IDC increases until reaching a certain IDC value beyond which it becomes more acute especially for loaded SVS (λ=10) where batch size becomes greater and sleep period becomes larger. This explains in large part the curve shape for traffic where burstiness is enough high.

For a given mean arrival rate and as IDC increases #P wakeup (Fig. 23) decreases.This decrease starts slowly and beyond a given threshold becomes much more pronounced especially for high workload (λ=1, 10). Investigation of #P idle (Fig. 24) with respect to IDC shows two phases, an increasing phase and/or a decreasing phase. The same arguments detailed for Fig. 12 may be used here to explain this behavior. For the same reasons cited above in this subsection and beyond a given IDC value the following metrics, power consumed by PMC (P ) (Fig. 26), power utilization ratio (U) (Fig. 27), efficiency (E) (Fig. 28), decrease sharply with respect to IDC. In conclusion, we can deduce that for a fixed average request rate (workload) and for aging factor AF > 1, burstiness enables to aggregate requests in batch forms. As IDC increases, batch size increases and this improves significantly all performability SVS attributes investigated in our modeling analysis. Fig. 29 clearly illustrates how IDC increase influences on one hand PMC states' evolution and request processing vs time (for different IDC and constant λ) in the SVS and improves on other hand the performability metrics of SVS.

Conclusion

We proposed in this paper a performability modeling and analysis based on non-Markovian SRNs of versatile SVS hypervisor-based incorporating workload-aware PM mechanism and accounting for workload-dependent software aging. The considered analysis concerns two kinds of VMM rejuvenation namely Cold-VM and Migrate-VM. It relies on modular approach involving several attributes in SVS modeling and enables to capture bursty workload impact on SVS performability metrics. We have defined and investigated numerically various quantitative and qualitative metrics such as steady-state availability, mean consumed power, power utilization ratio, and efficiency. These metrics are used through numerical investigations to show how performance availability, power usage, and efficiency of SVS are impacted by workload with bursty nature for SVS either subject to Cold-VM or Migrate-VM. In this direction, the performability metrics dynamic had been investigated on one hand with respect to SVS workload and on the other hand with respect to IDC. The obtained results confirm that for SVS subject to workload-dependent aging as well as traffic becomes more bursty SVS becomes more available and more power efficient.

Figure 1 :

 1 Figure 1: System configuration including a server virtualized system

  Figure 2: SVS SRN model with Cold-VM rejuvenation (sub-model 11 )

Figure 3 :

 3 Figure 3: SVS SRN model with Migrate-VM rejuvenation(sub-model 21 )

  description for the two sub-models Transition Description T hinterval (resp. T vinterval) host (i.e. VMM) (resp.VM) inter-rejuvenation interval duration T hpolicy (resp.T vpolicy) host (resp. VM) rejuvenation trigger interval duration T hreset (resp. T vreset) immediate transitions enabled when host (resp. VM) rejuvenation duration expires to trigger T hinterval (resp. T vinterval) T hf p (resp. T vf p) host (resp. VM) fail prone duration T hf ail (T vf ail) host (resp. VM)) failure duration T hdet (resp. T vdet) host (resp. VM)) failure detection duration T hrepair (resp. T vrepair) host (resp. VM) failure recovery duration T hrejt (resp. T vrejt) immediate transitions enabled to trigger host (resp. VM) rejuvenation T hrej (resp.T vrej) host (resp. VM) rejuvenation duration T hf prejt (resp.T vf prejt) immediate transitions enabled to trigger host (resp. VM) rejuvenation T vrestart VM restart duration T vdw, T vf pdw VM shutdown duration Specific description for each model Cold-VM (sub-model 11 ) Transition Description T vpre, T vf ppre immediate transitions enabled when VM stopping process is initiated (as soon as host rejuvenation is achieved) T vsd, T vf psd VM stopping time interval duration Migrate-VM (sub-model 21 ) Transition Description T vpre, T vf ppre immediate transitions enabled when VM Migration process to remote host is initiated (as soon as host rejuvenation is achieved) T vmig, T vf pmig VM migration duration T vpost, T vf ppost immediate transitions triggering VM migration back to original host T vbac, T vf pbac duration VM migration back to original host Table 2 Transitions description of workload-aware PM SRN sub-model (Fig. 4) Transition Description T h2l time interval duration to switch MMPP traffic from high to low rate T l2h time interval duration to switch MMPP traffic from low to high rate 1/T hightraf f ic for PMC to transit from sleep to wakeup T wakeup time interval duration for PMC to transit from wakeup to idle T timeout time interval duration for PMC to transit from idle to sleep T lossjob immediate transition enabled when an arriving request is lost T rejdown1 immediate transition enabled to transit from sleep to off T rejdown2 immediate transition enabled to transit from idle to off T rejdown3 immediate transition enabled to transit from fastactive to off T rejdown4 immediate transition enabled to transit from slowactive to off T rejdown5 immediate transition enabled to transit from wakeup to offT notrejdown time duration to transit from off state to sleep state

Figure 4 :

 4 Figure 4: Workload-aware PM SRN sub-model

  == 1) (P vfp == 1) T vdet (P hup == 1) (P hfp == 1) T vrepair (P hup == 1) (P hfp == 1) T vrej (P vclock == 1) && (P hup == 1) (P hfp == 1) == 1) (P vfail == 1) (P vdet == 1) (P vrej == 1) T vinterval (P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1) Migrate-VM (sub-model 21 ) Transitions Guards T hpolicy (P vfail == 1) (P vdet == 1) (P vrej == 1) (P vmigd== 1) (P vfpmigd == 1) T vinterval (P vup == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1)

  == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1) T sleep2wakeup (P vup == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1) T wakeup (P vup == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1) T timeout (P vup == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1) T lossjob (P vup == 0) && (P vfp == 0) && (P vmigd == 0) && (P vfpmigd == 0) T rejdown1 (P vup == 0) && (P vfp == 0) && (P vmigd == 0) && (P vfpmigd == 0) T rejdown2 (P vup == 0) && (P vfp == 0) && (P vmigd == 0) && (P vfpmigd == 0) T rejdown3 (P vup == 0) && (P vfp == 0) && (P vmigd == 0) && (P vfpmigd == 0) T rejdown4 (P vup == 0) && (P vfp == 0) && (P vmigd == 0) && (P vfpmigd == 0) T rejdown5 (P vup == 0) && (P vfp == 0) && (P vmigd == 0) && (P vfpmigd == 0) T notrejdown (P vup == 1) (P vmigd == 0) && (P vfpmigd == 0)

Figure 5 :

 5 Figure 5: Illustration of PMC states' evolution and request processing vs time (for different mean arrival rates) in the SVS

  5.a) to light level (Fig. 5.b) increases F T wakeup whereas workload evolution from light level (Fig. 5.b) to loaded level (Fig. 5.c) decreases F T wakeup .

Figure 6 :Figure 7 :

 67 Figure 6: Aging factor index (AF ) vs λ

Figure 8 :

 8 Figure 8: Mean waiting time vs λ

Figure 9 :

 9 Figure 9: Mean loss rate vs λ

Figure 10 :

 10 Figure 10: F T wakeup vs λ

Figure 11 :Figure 12 :

 1112 Figure 11: #P wakeup vs λ

Figure 13 :

 13 Figure 13: #P sleep vs λ

Figure 14 :Figure 15 :

 1415 Figure 14: ACPI power states of PMC (Cold-VM)

Figure 17 :

 17 Figure 17: Power utilization ratio (U ) vs λ

Figure 18 :Figure 19 :

 1819 Figure 18: Efficiency (E) vs λ

Figure 20 :

 20 Figure 20: Mean waiting time vs IDC (λ = 0.1, 1, 10)

Figure 26 :Figure 27 :

 2627 Figure 21: F T lossjob vs IDC (λ = 0.1, 1, 10)

Figure 28 :

 28 Figure 28: Efficiency (E) vs IDC (λ = 0.1, 1, 10)

Figure 29 :

 29 Figure 29: Illustration of PMC states' evolution and request processing vs time (for different IDC and constant λ) in the SVS

Table 3

 3 Transitions with assigned guards of SVS SRN sub-models (sub-model 11 , sub-model 21 )

		Common guards for sub-model 11 and sub-model 21
	Transitions	Guards
	T hrej	P hclock == 1
	T hinterval	(P hup == 1) (P hfp == 1)

Table 4

 4 Transitions with assigned guards of workload-aware PM SRN sub-model (Cold-VM rejuvenation)

	Transitions	Guards
	T servf ast

(P vup == 1) (P vfp == 1) (P vsd == 1) (P vfpsd == 1)

Table 5

 5 Transitions and assigned guards of workload-aware PM SRN sub-model (Migrate-VM rejuvenation)

	Transitions	Guards
	T servfast

(P vup == 1) (P vfp == 1) (P vmigd == 1) (P vfpmigd == 1)

Table 6

 6 Parameters and corresponding values used of the two versatile SVS SRN models

	Symbol	Description	Value	Mean time
	λ F P v	VM aging rate	0.005952381	1 week
	λv	VM failure rate after aging	0.013888889	3 days
	δv	VM failure detection rate	12	5 mins
	µv	VM failure recovery rate	2	30 mins
	βv	VM rejuvenation rate	60	1 min
	rv	VM restart rate	120	30 secs
	σv	VM shutdown rate	120	30 secs
	ωv	VM migration rate	3600	1 sec
	τv	VM rejuvenation trigger rate	0.041666667	1 day
	λ F P h	VMM aging rate	0.001388889	1 month
	λ h	VMM failure rate after aging	0.005952381	1 week
	σ h	VMM failure detection rate	12	5 mins
	µ h	VMM failure recovery rate	1	1 hour
	β h	VMM rejuvenation rate	30	2 mins
	τ h

  Once request is fully processed, through firing of T servf ast or T servslow, PMC switches to idle state (P idle) and triggers at the same time a timer with constant duration (T timeout). If any new request arrival occurs before timer expires then transition T timeout is canceled (preempted with policy prd) and PMC comes back from idle state (P idle) to active state (P slowactive or P f astactive)

after T start firing. Therefore a new request processing begins immediately. Otherwise if this timer expires without detecting any new request arrival, then T timeout fires and the PM mechanism forces PMC to transit immediately back to sleep state (P sleep). Finally since our versatile SVS SRN models deal with performability analysis it's obvious to hold failure occurrences. Thus if at any time VM or VMM becomes unavailable due to either failure or rejuvenation, PMC power state switches to off state (P of f

Table 7

 7 Timed transitions' Values of workload-aware PM SRN sub-models

Table 8

 8 PMC power measurements

	Mode	sleep	idle	slowactive	f astactive	wakeup
	Power (watt)	2.5	60	80	95	95

  [START_REF] Escheikh | Workload-Dependent Software Aging Impact on Performance and Energy Consumption in Server Virtualized Systemsi[END_REF],[START_REF] Escheikh | Versatile workload-aware power management performability analysis of server virtualized systems[END_REF]) and[START_REF] Escheikh | Performability evaluation of server virtualized systems under bursty workload[END_REF]:• In[START_REF] Escheikh | A versatile traffic and power aware performability analysis of server virtualized system[END_REF] and[START_REF] Escheikh | Versatile workload-aware power management performability analysis of server virtualized systems[END_REF] authors proposed a versatile SVS SRN model for Cold-VM rejuvenation. Whereas in Escheikh et al. (2016) and Escheikh et al. (2018) authors had considered only Migrate-VM rejuvenation scenario. • In Escheikh et al. (2014) and Escheikh et al. (2017), VM and VMM sub-models are abstracted as a simplified and unified model with reduced state space to avoid untractable calculation. However this simplification may hide detailed specification useful to accurately describe both VMM and VM behaviors. This drawback is circumvented in this work through keeping these detailed specifications (given in previous work Machida et al. (

  It's worth noting that for light workload, PMC remains for long periods in sleep state. Instead, for heavy traffic PMC remains most of the time in active states and thereby as workload becomes higher U converges to unity.

	Migrate-VM
	Cold-VM
	P (watt)
	Figure 16: Mean consumed power (P ) vs λ

• Power utilization ratio (U) (Eq. 16): measures the probability that PMC is effectively in one of the active states while it's not off. Fig.

17

depicts U vs λ.

" from the University of Tunis El Manar. He is currently Maître de Conférences at ENIT since 2018, member of SYSCOM laboratory at ENIT since 1992 and associate researcher with VESPA Team Cedric CNAM Paris.