Pakkit.net
← Back to blog

Engineering Practice

When Everything Fails the Same Way, Suspect the Thing They Share

When a group of things fails in exactly the same way at the same moment, they aren't failing independently — they share a cause, so stop debugging the individual parts and go find the one thing they have in common.

  • Engineering Practice
  • Debugging
  • Troubleshooting
  • Operations

A storage controller in one of my homelab servers came up with an entire shelf of drives missing — not one, not a couple, the whole set gone at once. My first instinct was the dramatic one: how did that many disks die together? That instinct was the trap. The useful clue wasn’t any single drive. It was that all of them failed in exactly the same way, at exactly the same time. That uniformity is a fingerprint. When a group of things fails identically and simultaneously, they are almost never failing independently — they share a single cause, and the job is to find the one thing they have in common.

Independent things don’t fail in lockstep

A single drive failing is a normal, expected event. A dozen drives failing in the same second, with the same error, is not a dozen events — it’s one. That’s the whole insight, and it comes straight out of how independence works: things that fail for their own separate reasons fail at their own separate times, in their own separate ways. The moment failures line up — same symptom, same instant — independence is off the table.

A dozen identical failures at the same moment isn’t a dozen problems. It’s one problem with good reach.

So the count is misleading. It feels like a bigger disaster than a single failure, which pushes you toward bigger, scarier explanations. But a wall of identical failures is usually a single fault wearing a crowd costume, and the right reaction is to get smaller and more specific, not more alarmed.

The uniformity is the signal, not the noise

What looks alarming — the sameness, the sheer number — is exactly what makes the problem legible, if you read it instead of reacting to it. When I actually looked at the logs instead of counting casualties, every device behind that controller was failing with the identical message, at the identical layer, from the identical moment. That is not what a pile of unrelated faults looks like. Different root causes produce different-looking symptoms at different times.

Two things fall out of the pattern, and they answer different questions:

  • The number of failing units tells you the blast radius — how much is downstream of the fault.
  • The sameness tells you they’re downstream of one thing — that there’s a single shared cause upstream of all of them.

Read together, “many, and all identical” is the system telling you the cause lives in something they all route through.

Find what they share

Once you accept “one cause, many victims,” the debugging question gets much better. It’s no longer “what’s wrong with each of these?” — it’s “what do all of these depend on that could take them out at the same time?” Then you list the shared dependencies and walk the list:

  • In hardware: a common power rail or PDU, a single cable, the controller itself, the backplane or expander everything sits behind, the enclosure. (In my case the fault was in the shared path between the controller and the drives — the disks themselves were fine.)
  • In a distributed system: a shared upstream service, a common database or dependency, one host or node everything happened to land on, a shared credential or an expired certificate, a single config source, or the deploy that just went out.
  • In a network: one switch, VLAN, gateway, or DNS resolver that everything behind it depends on.

The bug is almost always sitting in that shared layer. The individual units are victims, not suspects — so don’t start by interrogating them one at a time.

The healthy parts are evidence, not a distraction

Here’s the part that trips people up: every individual component checked out. Each drive was fine. The controller was fine. Under the “how did they all die” hypothesis, that’s baffling — you go re-testing units, looking for the dead ones, and finding none. Under the “shared cause” hypothesis, healthy units are exactly what you’d expect, because the units were never the problem.

That reframes what “everything looks fine” means. Healthy individuals aren’t a dead end to explain away; they’re confirmation you’re looking at the wrong layer. Stop re-testing the parts and go up one level to the thing connecting them. (What finally cleared mine was a full cold power cycle of that shared hardware — a story with its own lesson, which I wrote up separately.)

This scales far past hardware

None of this is really about disks. It’s about correlation, so the same “identical plus simultaneous equals shared cause” pattern shows up everywhere:

  • Every request to a service starts returning 500s in the same second — that’s one dependency that fell over, not a sudden flood of bad requests.
  • Every machine in a rack drops off the network at once — suspect the shared switch or power feed, not a coincidence of dead servers.
  • Every user suddenly can’t log in — look for one auth service, one expired cert, one shared secret, not a mass outbreak of individual account problems.
  • A fleet of scheduled jobs all fail identically right after a release — the shared change is the cause, and the jobs are just where it surfaced.

In each case the tempting move is to open one instance and debug it in isolation, and in each case that’s the slow road. The fast one is to ask what all the failing things have in common and start there.

What to do when you see a wall of failures

So I’ve turned it into a reflex. When a lot of things break at once and they all look the same, I don’t start debugging any one of them. I count, and I compare. If the failures are uniform and simultaneous, I stop treating them as separate incidents and start hunting the shared dependency — power, cable, controller, upstream, config, credential, network — because a single fault big enough to do all this has to live somewhere they all touch.

It’s the same instinct as remembering that “it ran” is not “it worked” and that an error often blames the wrong thing: the pattern in front of you is data, if you read it instead of flinching at its size. It’s also one more thing the homelab teaches that a managed platform won’t — hardware fails in loud, uniform, instructive ways. If you’ve ever watched a whole shelf, rack, or service light up red at once and traced it back to one small shared thing, I’d enjoy hearing the story.