DBRaven
Blast Radius Analysis · API Gateway Platform

Thundering Herd (Cache Stampede)

criticalContained

capacity failure · fan out propagation

Blast Radius

5%

1/20 nodes

Time to Detect

15–60 seconds with cache miss rate monitoring and database QPS alerting. 2–10 minutes if detected only through application error rate monitors. The failure signature is a near-simultaneous cache miss rate spike followed by a database QPS spike: these two metrics together are the primary signal.

Preventive Mitigations

4

Confidence

Strong

Impacted Components

Immediate

Redis

cache · Directly connected to failure mode 'Thundering Herd (Cache Stampede)' via risk propagation path in the topology.

Failure Cascade

1

Redis

Thundering Herd (Cache Stampede) (fan out propagation) directly affects these components.

Severity at this step: critical

Detection Signals

AlertQueue DepthError Rate Spike

Recovery time estimate: 30–120 seconds once hot keys are manually repopulated and database load subsides. Without manual intervention, recovery depends on whether the database can absorb the sustained stampede load or whether it collapses into connection exhaustion requiring a longer restart sequence.

Mitigation Checklist(4 preventive, 2 reactive)

Background cache warming on deploypreventshigh

Before switching traffic to a new application instance, run a cache warm-up pass that pre-populates all known hot keys. Eliminates the cold-start stampede on deployment. Requires maintaining a list of hot keys or using a traffic-replay mechanism to identify them.

Mutex-based cache repopulation (Cache Lock)preventsmedium

On a cache miss, acquire a distributed lock (Redis SETNX with short TTL, e.g., 5 seconds) before executing the database query. Only the lock holder executes the query and populates the cache; all other concurrent misses wait and then re-check the cache after the lock is released. Reduces N simultaneous database queries to 1 per cache miss event.

Probabilistic early expiry (PER)preventsmedium

Instead of expiring a key exactly at TTL, each read recomputes expiry with a probability that increases as TTL approaches zero: should_refresh = (random() < exp((current_ttl - TTL) / beta)). A small fraction of reads trigger a background cache refresh before the key expires, eliminating simultaneous expiry. Beta = 1.0 is a standard starting point; tune based on query cost and acceptable staleness.

Serve stale while revalidatingpreventsmedium

On cache miss, immediately return the last known (potentially expired) value while triggering an asynchronous background refresh. Caller receives stale data for at most one request cycle. Requires storing the previous value alongside the TTL metadata.

Apply Redismedium

Redis distributed locks (via SET NX EX or Redlock) prevent thundering herd by ensuring only one caller repopulates a cache entry at a time, with other callers either waiting or returning a stale value until the cache is warm.

Staggered TTL with jitterlow

Add random jitter (±10–20% of TTL) to cache key expiry times to prevent multiple hot keys from expiring simultaneously. Reduces the probability of a simultaneous multi-key stampede; does not prevent single-key stampede under sustained load.

Affected Systems

Workloads

Event StreamingHigh-Throughput OLTPRead-Heavy API Backend

Technologies

Redis

Blast radius analysis is derived from structured topology and failure mode knowledge. It models structural propagation patterns, not measured production behavior. Actual incident scope depends on runtime conditions, traffic, and recovery actions in place at the time of failure.