[Bugfix][Frontend] Fix Issues Under High Load With zeromq Frontend

[robertgshaw2-redhat]

BUG REPO:

• On v0.5.4 due to the mp frontend, we fail under heavy load:

• server script

vllm serve meta-llama/Meta-Llama-3-8B-Instruct

• client script:

python benchmarks/benchmark_serving.py --model meta-llama/Meta-Llama-3-8B-Instruct --dataset-name sonnet --sonnet-input-len 1024 --sonnet-output-len 128 --dataset-path benchmarks/sonnet.txt --port 8000 --num-prompts 10000 --request-rate 1000

The server dies when we get ~1000 active requests in the system

SUMMARY:

• Multiprocessing OpenAI Frontend uses icp for the zeromq-based RPC connection. Each new request connects to this socket on the RPC Server side, meaning for N active requests, we will have N connections.
• zmq.MAX_SOCKETS defaults to 1023. If more than this number of sockets is opened we fail Too many open files error. This puts a hard cap on the number of active requests in vLLM and causes the bugs lists below.
• Setting zmq.MAX_SOCKETS to a high number resolves our issue. However, lsof -U | wc -l shows we are using unix sockets under the hood, the number of active requests will be limited by system ulimit. This is a bad UX and again puts a hard cap on the number of active requests running in vLLM.
• This PR introduces a proxy on the RPCClient side. The proxy creates a single ipc connection from the RPCClient to the RPCServer. Each API server thread handing a request connects to the proxy via inproc protocol and the message is forwarded over the since ipc connection with proper identity tags. This means we only ever create 1 unix socket.
• As a bonus, this architecture is more performant by ~5% E2E, since we avoid so many syscalls to open unix sockets

NOTES:

• Note: zmq has a variable called zmq.MAX_SOCKETS which applies at the Context level. This variable can be set up to a maximum of zmq.SOCKET_LIMIT=65536. This imposes a hard limit on the number of concurrent connections (see comments below for more details on this topic).

PERFORMANCE:

Serving benchmark H100 for Llama-3-8B-Instruct at QPS=10:

• server launch:

vllm serve meta-llama/Meta-Llama-3-8B-Instruct --enable-chunked-prefill --disable-log-requests

• benchmark script:

MODEL="meta-llama/Meta-Llama-3-8B-Instruct"
TOTAL_SECONDS=120
QPS_RATES=("10" "10" "10")
PORT=8000

for QPS in ${QPS_RATES[@]}; do
    NUM_PROMPTS=$((TOTAL_SECONDS * QPS))
    echo "===== RUNNING NUM_PROMPTS = $NUM_PROMPTS QPS = $QPS ====="

    python3 benchmarks/benchmark_serving.py \
        --model $MODEL \
        --dataset-name sonnet --sonnet-input-len 550 --sonnet-output-len 150 --dataset-path benchmarks/sonnet.txt \
        --num-prompts $NUM_PROMPTS --request-rate $QPS --port $PORT
done

• results:

branch	run 1	run 2	run 3	mean
main	51.7	50.7	51.8	51.4
pr	48.5	49.5	49.0	49.0
--disable-frontend-multiprocessing	72.8	71.1	72.9	72.3

FIX

• [Bug][0.5.4] Front-end server errors when overloaded with pending requests #7309
• [Bug]: "500 Internal Server Error" after upgrade to v0.5.4 #7290

UPDATE 8/20 POST OFFLINE DISCUSSION

Per discussion offline with @njhill @simon-mo and @youkaichao

After much further investigation, we ran into a separate issue with the proxy design after enabling the proxy. Specifically, we encountered a situation where under high load, zeromq can DROP MESSAGES 😢 , due to a concept called high-water mark (https://zeromq.org/socket-api/#high-water-mark), which is designed to protect servers running zeromq from slow clients. Specifically:

• DEALER sockets go mute when the HWM is reached
• ROUTER sockets drop messages when the HWM is reached

This prevents issues where a server running ZMQ can run OOM due to a slow reciever which is not able to keep up with message passing. The HWM is defaulted to 1000. Its difficult to track down exactly the sequence of events that causes the message dropping under load, but the HWM seems to be the culprit

In our case, we disable the HWM 😨 . This is generally not advisable, however:

• We are in control of both the RPCServer + RPCClient
• Either the server OR the client dying is catastrophic for vllm + the whole system should restart in this case
• Any CPU OOM that occurs in the mp design will also occur in the non-mp design (+ we measured that overall memory usage is close)

Anyways:

• added a test_load.py to simulate load on the client and try to detect errors like this.
• added a test_accuracy.py to run an lm-eval-harness with concurrent requests via the openai API, which simulates real usage and makes sure we get the correct answer out of the server

BEFORE SUBMITTING, PLEASE READ THE CHECKLIST BELOW AND FILL IN THE DESCRIPTION ABOVE

---

PR Checklist (Click to Expand)

Thank you for your contribution to vLLM! Before submitting the pull request, please ensure the PR meets the following criteria. This helps vLLM maintain the code quality and improve the efficiency of the review process.

PR Title and Classification

Only specific types of PRs will be reviewed. The PR title is prefixed appropriately to indicate the type of change. Please use one of the following:

• [Bugfix] for bug fixes.
• [CI/Build] for build or continuous integration improvements.
• [Doc] for documentation fixes and improvements.
• [Model] for adding a new model or improving an existing model. Model name should appear in the title.
• [Frontend] For changes on the vLLM frontend (e.g., OpenAI API server, LLM class, etc.)
• [Kernel] for changes affecting CUDA kernels or other compute kernels.
• [Core] for changes in the core vLLM logic (e.g., LLMEngine, AsyncLLMEngine, Scheduler, etc.)
• [Hardware][Vendor] for hardware-specific changes. Vendor name should appear in the prefix (e.g., [Hardware][AMD]).
• [Misc] for PRs that do not fit the above categories. Please use this sparingly.

Note: If the PR spans more than one category, please include all relevant prefixes.

Code Quality

The PR need to meet the following code quality standards:

• We adhere to Google Python style guide and Google C++ style guide.
• Pass all linter checks. Please use format.sh to format your code.
• The code need to be well-documented to ensure future contributors can easily understand the code.
• Include sufficient tests to ensure the project to stay correct and robust. This includes both unit tests and integration tests.
• Please add documentation to docs/source/ if the PR modifies the user-facing behaviors of vLLM. It helps vLLM user understand and utilize the new features or changes.

Notes for Large Changes

Please keep the changes as concise as possible. For major architectural changes (>500 LOC excluding kernel/data/config/test), we would expect a GitHub issue (RFC) discussing the technical design and justification. Otherwise, we will tag it with rfc-required and might not go through the PR.

What to Expect for the Reviews

The goal of the vLLM team is to be a transparent reviewing machine. We would like to make the review process transparent and efficient and make sure no contributor feel confused or frustrated. However, the vLLM team is small, so we need to prioritize some PRs over others. Here is what you can expect from the review process:

• After the PR is submitted, the PR will be assigned to a reviewer. Every reviewer will pick up the PRs based on their expertise and availability.
• After the PR is assigned, the reviewer will provide status update every 2-3 days. If the PR is not reviewed within 7 days, please feel free to ping the reviewer or the vLLM team.
• After the review, the reviewer will put an action-required label on the PR if there are changes required. The contributor should address the comments and ping the reviewer to re-review the PR.
• Please respond to all comments within a reasonable time frame. If a comment isn't clear or you disagree with a suggestion, feel free to ask for clarification or discuss the suggestion.

Thank You

Finally, thank you for taking the time to read these guidelines and for your interest in contributing to vLLM. Your contributions make vLLM a great tool for everyone!

[github-actions]

👋 Hi! Thank you for contributing to the vLLM project.
Just a reminder: PRs would not trigger full CI run by default. Instead, it would only run fastcheck CI which consists a small and essential subset of CI tests to quickly catch errors. You can run other CI tests on top of default ones by unblocking the steps in your fast-check build on Buildkite UI.

Once the PR is approved and ready to go, please make sure to run full CI as it is required to merge (or just use auto-merge).

To run full CI, you can do one of these:

• Comment /ready on the PR
• Add ready label to the PR
• Enable auto-merge.

🚀

[robertgshaw2-redhat]

After further investigation, I using zmq sockets will impose a hard limit on the number of active request.

While it is possible to change the value of ZMQ_MAX_SOCKET on a Context by Context basis, the via zmq_ctx_set, ZMQ_SOCKET_LIMIT, which puts an upper bound on this. We are unable to change the value of ZMQ_SOCKET_LIMIT (see: https://libzmq.readthedocs.io/en/latest/zmq_ctx_get.html)

We are unable to change the value:

import zmq
ctx = zmq.Context()
ctx.get(zmq.SOCKET_LIMIT)
# >>> 65535
ctx.set(zmq.SOCKET_LIMIT, 10000000)
ctx.get(zmq.SOCKET_LIMIT)
# >>> 65535

I believe this will put a hard limit on ZMQ at 65k concurrent connections.

This is obviously a lot of requests, but I am worried about an offline batch use case where someone sends 1M requests to
the server at once.

Other Options

• Set --limit-concurrency in uvicorn to explicitly prohibit too many requests from being active in the server. This will give 503s if the Server is getting too many requests. (https://www.uvicorn.org/settings/#resource-limits)
• Try to handle this in the OAI server (by buffering)

WDYT?

[youkaichao]

@robertgshaw2-neuralmagic thanks for the great work!

I think limiting the total number of pending requests make sense to me. Many web servers should have similar constraints.

As for offline batching inference, we don't need to surface this to users. We can accept arbitrary number of requests, but send part of them to the engine every time.

BTW, offline batch inference does not use this api server. So it should not be a concern there.

For the technical review, I would like to hand it over to @njhill who has better expertise here.

[robertgshaw2-redhat]

Also note --- I tried running with v0.5.3 and we seem to be dropping requests as is if we get >20k connections. I don't quite see why / what causes this without zeromq, but it means that our existing state did not support this either

[robertgshaw2-redhat]

make ./format happy

[joerunde]

Set --limit-concurrency in uvicorn to explicitly prohibit too many requests from being active in the server. This will give 503s if the Server is getting too many requests. (https://www.uvicorn.org/settings/#resource-limits)

@robertgshaw2-neuralmagic That would be great, the only issue I'd see is if the /health endpoint is used for a liveness probe, that could cause pod restarts under load. So I think we'd just want to also add a few words in the documentation recommending not to do that. (Looking at all the IBM deployment configs 😉 )

[joerunde]

For future readers it'd be nice to add a link to some zmq docs here or give this a descriptive name to say what part2 is. From context here I'm guessing this is routing information for the client-side proxy?

[robertgshaw2-redhat]

Its related to the use of ROUTER, will do

[robertgshaw2-redhat]

Set --limit-concurrency in uvicorn to explicitly prohibit too many requests from being active in the server. This will give 503s if the Server is getting too many requests. (https://www.uvicorn.org/settings/#resource-limits)

@robertgshaw2-neuralmagic That would be great, the only issue I'd see is if the /health endpoint is used for a liveness probe, that could cause pod restarts under load. So I think we'd just want to also add a few words in the documentation recommending not to do that. (Looking at all the IBM deployment configs 😉 )

hmmmm - can you explain more?

[joerunde]

Set --limit-concurrency in uvicorn to explicitly prohibit too many requests from being active in the server. This will give 503s if the Server is getting too many requests. (https://www.uvicorn.org/settings/#resource-limits)

@robertgshaw2-neuralmagic That would be great, the only issue I'd see is if the /health endpoint is used for a liveness probe, that could cause pod restarts under load. So I think we'd just want to also add a few words in the documentation recommending not to do that. (Looking at all the IBM deployment configs 😉 )

hmmmm - can you explain more?

It's probably not a huge deal since vllm itself is a library and doesn't ship k8s configs but, in general readiness probes are used to back off traffic from pods experiencing issues accepting new requests, while liveness probes are used to kill pods that have crashed or experienced some unrecoverable error. If we were to set --limit-concurrency, then the /health endpoint would also start returning 503 when the pod is busy processing the maximum number of requests. That would be great to use as a readiness probe, k8s would automatically route traffic away while the pod is busy. But, if somebody accidentally used the /health endpoint as a liveness probe, then k8s would reboot the pod when it's busy. This would then likely cause that traffic to hit other pods, causing them to reach the maximum request limit and restart, and you'd end up in a cascading failure.

I think we'd want to suggest something different to use as a liveness probe in that case, maybe something as simple as checking that the frontend and backend processes are running.

[robertgshaw2-redhat]

Set --limit-concurrency in uvicorn to explicitly prohibit too many requests from being active in the server. This will give 503s if the Server is getting too many requests. (https://www.uvicorn.org/settings/#resource-limits)

@robertgshaw2-neuralmagic That would be great, the only issue I'd see is if the /health endpoint is used for a liveness probe, that could cause pod restarts under load. So I think we'd just want to also add a few words in the documentation recommending not to do that. (Looking at all the IBM deployment configs 😉 )

hmmmm - can you explain more?

It's probably not a huge deal since vllm itself is a library and doesn't ship k8s configs but, in general readiness probes are used to back off traffic from pods experiencing issues accepting new requests, while liveness probes are used to kill pods that have crashed or experienced some unrecoverable error. If we were to set --limit-concurrency, then the /health endpoint would also start returning 503 when the pod is busy processing the maximum number of requests. That would be great to use as a readiness probe, k8s would automatically route traffic away while the pod is busy. But, if somebody accidentally used the /health endpoint as a liveness probe, then k8s would reboot the pod when it's busy. This would then likely cause that traffic to hit other pods, causing them to reach the maximum request limit and restart, and you'd end up in a cascading failure.

I think we'd want to suggest something different to use as a liveness probe in that case, maybe something as simple as checking that the frontend and backend processes are running.

Thanks - this is clear

[robertgshaw2-redhat]

need to install from source since local-completions api with support for concurrent requests is not yet in release of lm_eval

[robertgshaw2-redhat]

@njhill does this need to be explicitly canceled somewhere?

(e.g. in close())

[njhill]

@robertgshaw2-neuralmagic yes, we should cancel it there.

[robertgshaw2-redhat]

cc @simon-mo --- this test takes ~3 minutes on H100

Will likely take >10 min on L4 ... are you okay with this?

[robertgshaw2-redhat]

test_load.py is failing in the CI due to Too Many Open Files ---> It seems like this happens at the very beginning which is odd ... looking into it

[robertgshaw2-redhat]

Should be merged after: #7698

[njhill]

Thanks @robertgshaw2-neuralmagic!