Chapter 03 — Physics for computing
Lesson map
Lesson 03 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes and connection"]
N1["3.1 Energy and heat set the budget"]
N2["3.2 Storage media"]
N3["3.3 Signals, time and measurement error"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["3.1 Energy and heat set the budget"]
N2["3.2 Storage media"]
N3["3.3 Signals, time and measurement error"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]
[Learning outcomes and connection]
|
v
[3.1 Energy and heat set the budget]
|
v
[3.2 Storage media]
|
v
[3.3 Signals, time and measurement error]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes and connection
After this chapter you can (1) relate power, heat and throttling to lost telemetry; (2) explain how storage media fail and why that matters for evidence; (3) reason about clock drift and signal timing as measurement error; and (4) turn a physical failure chain into measurable checks. It prepares Chapter 8 (architecture), Chapter 11 (time sources) and Chapter 32 (reliability).
3.1 Energy and heat set the budget
Every sensor, collector and log forwarder converts electrical energy into computation and heat. Dynamic power in CMOS logic scales roughly with $C V^2 f$ (switched capacitance, voltage squared, clock frequency). When a device cannot shed heat, firmware lowers voltage and frequency — thermal throttling — and work that assumed full speed now misses deadlines. For a log forwarder, the symptom is not a crash but a growing internal buffer, then silent drops when the buffer is full. A response engineer must therefore treat "no events received" as ambiguous: quiet host, broken network, or a device too hot to keep up.
3.2 Storage media
Evidence lives on physical media. Flash memory wears with program/erase cycles and uses wear levelling and garbage collection, so a deleted block may persist or vanish independently of the file system; magnetic disks fail mechanically and develop bad sectors. NIST SP 800-86 (2006) describes collection from storage media; its device details need re-verification against current hardware, but its central point stands: acquisition must be planned around how the medium behaves. Power loss during a write can leave partially written records — a reason for write-ahead logs and checksums (Chapter 13). Research on DRAM disturbance by Kim et al. (2014) showed that even memory cells can be flipped by access patterns: integrity cannot be assumed from the physics alone.
3.3 Signals, time and measurement error
Clocks are oscillators with drift measured in parts per million (ppm). A crystal at 50 ppm drifts up to $50 \times 10^{-6} \times 86{,}400 \approx 4.3$ s per day if left unsynchronised. Correlating events across hosts with second-level resolution therefore requires synchronisation (NTP, RFC 5905) and recording of offset when known. Every timestamp is a measurement with an error bar; a timeline that ignores it can invert cause and effect. Over the three unsynchronised days of EX006, a 40 ppm offset already exceeds ten seconds, larger than many gaps between logon and file activity.
3.4 Worked example (synthetic): the edge collector that went quiet
An HVSS branch office collector (a fan-less box in a cupboard, synthetic) normally forwards 40 events/s. On hot afternoons the CPU throttles from 1.8 GHz to 0.9 GHz; parsing capacity falls from 60 to 30 events/s; its 64 MB buffer at ~1 kB/event holds about 65,000 events, which at a deficit of 10 events/s lasts about 1.8 hours. Then events are dropped without an alarm. The physical failure chain is: ambient heat → throttling → capacity below arrival rate → buffer exhaustion → silent loss → analysts see a "quiet" host during the period that matters. Measurable checks: CPU temperature and frequency exported as telemetry; forwarder queue depth and drop counters; a heartbeat event every minute with sequence numbers so gaps are detectable at the receiver; clock offset reported with each batch.
3.5 Errors and limits
- Treating absence of events as evidence of absence of activity.
- Assuming timestamps from different hosts are directly comparable.
- Ignoring media behaviour when planning acquisition.
- Physical models give orders of magnitude; measure the actual device.
The edge collector in the worked example shows the first two errors together. After about 1.8 hours of throttled operation its buffer fills, and the receiver sees a quiet branch office exactly when events are being dropped. Without the heartbeat sequence numbers, that silence would be read as a calm afternoon. If its clock has also drifted, any events that do arrive cannot be placed against the central timeline without the reported offset.
Exercises — chapter 03
EX005 — Buffer budget. Objective: compute time to silent loss. Inputs: arrival 40 events/s, throttled capacity 30 events/s, buffer 64 MiB, mean event 1,024 bytes. Steps: compute buffer capacity in events and time to exhaustion; recompute if a filter discards 30% of events before buffering. Expected evidence: two times with working. Rubric: 3 = both correct; 2 = one; 1 = method; 0 = none.
EX006 — Clock error in a timeline. Objective: reason about timestamp uncertainty. Inputs: host A unsynchronised for 3 days at up to +40 ppm; host B synchronised (±10 ms). A logon on A is stamped 10:00:05; a file copy on B stamped 10:00:00. Steps: bound A's error; decide whether the order "logon then copy" can be excluded. Expected evidence: bound and verdict. Rubric: 3 = correct bound (±10.4 s) and verdict that order is undetermined; 2 = bound only; 1 = attempt; 0 = none.
Chapter synthesis
Physics limits what monitoring can see: heat throttles, media wear and clocks drift. Design for detectable gaps (sequence numbers, heartbeats, drop counters, clock offsets) so that silence and timing can be interpreted rather than trusted.
Continue studying — chapter 03 of 50
← Chapter 02 · Course chapter index · Chapter 04 →
Continue to the next authored lesson.