1.3.2. Software and Configuration Failure Patterns
💡 First Principle: Software failures are harder to diagnose than hardware failures because they're invisible—there's no clicking sound or flashing LED. They manifest as behavioral changes: services that stop responding, performance that degrades gradually, or operations that fail inconsistently.
The most important software failure modes:
Memory leaks occur when an application allocates memory and never releases it. The application consumes more and more RAM over time until the system runs out, causing crashes or severe slowdowns. Symptoms: gradually increasing memory utilization, eventual service crashes. Remedy: scheduled reboots, application patches.
Buffer overruns occur when a process writes more data than a buffer can hold, overwriting adjacent memory. This causes crashes, corrupted data, and security vulnerabilities (attackers can exploit buffer overruns to inject code).
Driver incompatibility occurs when a driver doesn't properly interface with the OS kernel. Symptoms: BSODs, kernel panics, random crashes after hardware or OS updates. Always check the HCL and test updates in non-production before production deployment.
Clock skew is a subtle but critical failure: when system clocks drift out of sync, time-sensitive authentication protocols (like Kerberos) fail. Kerberos requires clocks to be within 5 minutes of each other. Symptom: users can't authenticate despite correct credentials. Remedy: NTP synchronization.
Configuration drift is the gradual divergence between documented configuration and actual state. It happens through untracked manual changes, failed automation, or undocumented emergency fixes. It makes troubleshooting unreliable because you can't trust the documentation.
⚠️ Exam Trap: Many software failures look like hardware failures to users ("the server is broken"). The key differentiator is consistency: hardware failures tend to be consistent (the drive always fails) while software failures often manifest intermittently and may correlate with specific workloads or times.
Reflection Question: A server crashes every night at 2 AM but runs fine during the day. Is this more likely hardware or software? What would you investigate first?
