Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
••
IT NachrichtenMicrosoft puts Brad Smith in charge of communications(25.09.2026 um 00:08 Uhr)
••
IT Nachrichten25. September(25.09.2026 um 00:05 Uhr)
•
IT NachrichtenCI-Solution GmbH von Crossware übernommen(25.09.2026 um 00:01 Uhr)
•
IT NachrichtenInsta360 GO Ultra erhält KI-Sprachassistenten mit Gemini(24.09.2026 um 21:30 Uhr)
••
AI & KI NachrichtenMaryland Governor Draws New Boundaries for Data Centers(25.09.2026 um 00:04 Uhr)
••••
IT NachrichtenMicrosoft puts Brad Smith in charge of communications(25.09.2026 um 00:08 Uhr)
••
IT Nachrichten25. September(25.09.2026 um 00:05 Uhr)
•
IT NachrichtenCI-Solution GmbH von Crossware übernommen(25.09.2026 um 00:01 Uhr)
•
IT NachrichtenInsta360 GO Ultra erhält KI-Sprachassistenten mit Gemini(24.09.2026 um 21:30 Uhr)
••
AI & KI NachrichtenMaryland Governor Draws New Boundaries for Data Centers(25.09.2026 um 00:04 Uhr)
••
Intelligence View
⚡ tsecurity.de Intelligence

Fleet 1.0: Finding the One Slow Rank in a 64-GPU Job From the Cluster Side

TL;DR In a distributed training job, every node can look healthy on its own dashboard while throughput across the job quietly drops. The cause is almost never visible per host, because the signal is relational: one rank is slow only…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




TL;DR



In a distributed training job, every node can look healthy on its own dashboard while throughput across the job quietly drops. The cause is almost never visible per host, because the signal is relational: one rank is slow only relative to its peers. Detecting that needs a threshold the cluster computes about itself, resistant to the straggler it is trying to find. A median-absolute-deviation threshold has a 50% breakdown point, so one slow rank, or several, cannot drag the bar far enough to hide. Fleet 1.0 ships that detection as a cluster-side OpenTelemetry Collector distribution, with a queryable event store and a contract-stable public surface.






Why per-host metrics miss it



A 64-GPU all-reduce runs at the speed of its slowest rank. If rank 41 is 80 ms behind the cohort on every collective, the other 63 ranks spend that 80 ms waiting at the barrier, and the job's throughput drops by the corresponding fraction. Open the dashboard for any single node and it reads fine: utilization high, memory in range, temperature nominal. The slowness is not a property of any one node. It is a property of the comparison between them, and a per-host view has nothing to compare against.



The manual version of this investigation is the part nobody enjoys. Collect per-rank step times, SSH into the candidates, run things by hand, hope the slow behavior reproduces while someone is watching. At 8 nodes it is tedious. At 64 it does not finish before the next checkpoint.






A threshold that survives the straggler



The detection has to come from a number the cluster computes about itself, and that number has to hold steady against the very outliers it is meant to surface. A mean-and-standard-deviation threshold fails here, because a few slow ranks pull the mean toward themselves and widen the band until they fall inside it. Median absolute deviation does not: its breakdown point is 50%, meaning up to half the ranks would have to be stragglers before the threshold is fooled. Fleet computes a per-cluster straggler threshold from each node's health score using MAD, smoothed with an exponential moving average so a single noisy sample does not trip an alert.



The threshold is then shipped back to each agent inside the OTLP push response headers. Each node classifies itself in real time against the live fleet threshold with no extra polling round trip. A node below the bar emits a straggler event; every node above it keeps running untouched. The agent's health score is built from CUDA throughput, kernel-launch efficiency, memory headroom, and CPU availability, so "slow" is grounded in what the GPU is actually doing, not in a single proxy counter.






From "which node" to "which collective on which rank"



Knowing a node is slow is the start, not the answer. The next question is which collective, on which rank, is behind. Fleet's NCCL processor works from direct uprobes on libnccl.so: every ncclAllReduce, ncclAllGather, ncclReduceScatter, ncclSend, ncclRecv, and the rest, captured with comm-id hash, rank, world size, datatype, reduce op, byte count, and wall-clock duration. From the per-rank durations it derives peer-lag per collective, with a per-cluster cap and time-bucket skew tolerance so a rank straddling a bucket boundary is not split into two under-quorum buckets. A rank 80 ms behind its cohort shows up as a number attached to a specific collective, not as a hunch.






Putting a dollar figure on the lag



Operators have had utilization graphs for years. What turns a straggler into a budget conversation is translating "rank 41 is 80 ms behind" into money. Fleet ships per-GPU-model hourly rate tables for the major clouds and on-prem, and a provider-lookup processor tags every metric with the provider it came from. Recording rules and Grafana panels turn peer-lag into a figure a finance team will read: this much GPU spend is sitting idle at the barrier right now. The signal was always in the durations; the rate table is what makes it legible to someone who does not read PromQL.






A place to land the cluster question



Per-node agents emit signal. Operators investigate clusters, not nodes. Echo is the companion service that gives the fleet a queryable place to land: it runs as a StatefulSet, ingests OTLP from Fleet, persists to embedded DuckDB, and exposes two surfaces over one bearer-authed listener.



The first is an MCP server for AI agents. The question "which nodes are stragglers in cluster-prod" comes back as a ranked answer, and an /investigate prompt walks an LLM through the cluster-level "where" before handing off to the per-node agent for the "why." The second is an HTTP+JSON API for everything that prefers curl: dashboards, CI scripts, Grafana datasources. It is described by an OpenAPI 3.1 document with per-tool input and output schemas, so a client can generate its own query forms. The query tools cover cluster summaries, outlier and straggler ranking, anomaly streams, NCCL and memcpy bandwidth rollups, memory-fragmentation hot spots, cost, and a sandboxed read-only SQL endpoint. Bearer tokens can be scoped to specific clusters, so a multi-tenant deployment shows each tenant only its own data.






Built to sit in a cluster without becoming a liability



The operational posture is the part that decides whether a tool like this survives contact with a real fleet. Fleet keeps health scores and thresholds in memory and rebuilds state from incoming pushes in about ten seconds after a restart. If it goes down, agents fall back to a cached threshold, then to local baselines: straggler detection degrades, it never blocks a workload. Agents are outbound-only, pushing to Fleet and receiving the threshold in the response, so no GPU node needs inbound network access and no firewall changes are required.



Security is bearer auth on every transport with constant-time compare, TLS required by default, zero-restart bearer rotation on a signal with a grace window, structured audit logging that records token hashes and never raw tokens, and per-bearer rate limiting. Every release is cosign-signed with keyless OIDC and ships a CycloneDX SBOM per archive, across amd64 and arm64. Both Fleet and Echo ship Helm charts with a ServiceMonitor, Ingress, PodDisruptionBudget, and a default-deny egress NetworkPolicy; Echo's chart fails the install closed if its DuckDB volume is not on an encrypted StorageClass, so audit data is never silently written to unencrypted disk.



For teams that already run a Collector, the Ingero processors and extensions drop into an existing pipeline through the OpenTelemetry Collector Builder, so adopting the detection does not require adopting a second collector.






What 1.0 changes



The capability has been landing release by release for months. What 1.0 adds is a promise about the surface: it is contract-stable under SemVer. Fixes ship as patch releases, new capabilities ship additively as minor releases, and anything that breaks the public API waits for a major bump. For an operator wiring a Grafana datasource, a CI gate, or a tenant-scoped bearer into a long-lived deployment, that promise is the difference between a tool worth building on and one worth waiting on.






A threshold the cluster computes about itself



The slow rank was always findable in principle: the per-rank durations carried the signal the whole time. What was missing was a place to compute the comparison and a number that holds up under the outliers it has to flag. A peer-relative threshold with a 50% breakdown point, computed cluster-side and shipped back to every node in the push response, is that number. Fleet 1.0 is the version where the surface around it stops moving.






Ingero - open-source eBPF agent for GPU debugging. One binary, zero deps, <2% overhead. Apache 2.0 + GPL-2.0. *GitHub ⭐** · Open an issue if you are running distributed GPU training and want to measure your actual straggler waste.*





CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Fleet 1.0: Finding the One Slow Rank in a 64-GPU Job From the Cluster Side
id: 1c4c0131-4837-4b2d-afff-f387078aa8f9
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Fleet 1.0: Finding the One Slo" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Fleet 10 Finding the One Slow Rank in a ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Fleet 10 Finding the One Slow Rank in a *"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Fleet 10 Finding the One Slow Rank in a "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Fleet 1.0: Finding the One Slow Rank in .... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Fleet 1.0: Finding the One Slow Rank in a 64-GPU Job From the Cluster Side

Thematisch verwandte Begriffe: Fleet, Finding, Slow, Rank · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-82585 | The Botslab G980H dash camera firmware transmits sensitive information o…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle