A 99.9% SLA: what it really means, and what happens when we miss it

Almost every hosting and CDN provider writes «99.9% uptime» somewhere on their site. Almost none write the two things that matter: how they measure it and what you get when they miss it. Without those two, the number is decoration.

How many minutes that actually is

The percentage is not intuitive. Translated into time, over a thirty-day month:

The jump from 99% to 99.9% is enormous: seven hours against forty minutes. And the next jump, to 99.99%, costs far more than it looks, because at that point even a planned restart eats a slice of it.

The real question: down for whom?

This is where it gets slippery. «The service is available» can mean very different things:

• the server answers a ping — the bare minimum, and it tells you nothing: a server can answer pings while the site returns an error;
• the machine is powered on — that is the provider's concern, not yours;
• your site answers a real request — this is the only one you care about.

There is a third case almost no contract names: the server answers, but answers «error». It happened to us, in miniature, on the day we put our own SLA in writing: two brand-new nodes could not reach one site's origin and returned a 504. The nodes were perfectly alive, answering any probe in milliseconds — and meanwhile whoever landed on those two nodes did not see the page. A measurement based only on «does the node answer?» would have reported 100% availability, with visitors staring at an error page.

That is why, in our contract, a site counts as unavailable also when the nodes answer with an error of ours — a 502 or 504 we generate, not an error coming from the customer's own server.

Who measures, and why it cannot be the provider alone

If the provider measures itself, it is both judge and party. You cannot remove that entirely, but you can reduce it:

1. More points of view. In our network each node checks the other seven every twenty seconds, and a node counts as down only if the majority cannot reach it. That way a network problem at the watcher does not become an outage at the watched.
2. A figure you can see too. If the number lives only in our database, it is a matter of trust. So every site's availability sits in the customer's panel, with the list of outages — start time, length, nodes involved, cause — and the network's state is on a public page anyone can open.
3. Your measurement counts. If an external check of yours — UptimeRobot, Pingdom, whatever you use — says something different from ours, we look at it together. A provider who refuses to look at your measurement is telling you something.

One detail that sounds like a nicety but is not: since when you have been measuring. A status page showing ninety days of green when monitoring has been on for two weeks is not reporting ninety days of perfect service, it is reporting seventy-six days of nothing.

Penalties: the only part that costs the person writing the contract

Promising 99.9% costs nothing. What costs is what happens when you miss it. Serious penalties have four traits:

• they are tiered, not all-or-nothing: the longer you were down, the more is owed;
• they are claimed without proving a loss: the figure is enough;
• they have a reasonable window to claim, not three days;
• if the outages repeat for months, you can leave at once, with no exit penalty.

In our case: below 99.9% we credit 10% of the month's fee, below 99.5% 25%, below 99% 50%, below 95% the whole fee; claims run for thirty days, and three months running below 99% entitle you to cancel immediately with the current month refunded. The full conditions are in the terms of service.

It is worth saying what does not count, because an honest contract writes that down too: maintenance announced at least 48 hours ahead (for us, never more than two hours a month), periods when it is your own server that is not answering, and force majeure. Attacks, on the other hand, do count: if the site is unreachable because it is under attack, as far as we are concerned that is an outage like any other. It is the reason a CDN exists.

Three questions to ask before signing

If you are weighing up a provider — us or anyone else — these three questions tell you almost everything:

1. How do you measure availability, and from where? If the answer is «we have internal monitoring», ask to see it.
2. What do you give me if you miss the level? If the answer is «we'll discuss it», the answer is nothing.
3. Does a node answering with an error count as downtime? That is the question that exposes measurements made with a ping.

And if your site is unreachable right now, the SLA is the least of your problems: start with what to do while you are under attack.