Editing Memcached

{{Short description|Open source distributed memory caching system}}
{{Infobox software
| name = Memcached
| logo = Memcached.svg
| logo size = 100px
| screenshot = 
| caption = 
| developer = Dormando
| released = {{start date|2003|5|22}}
| latest release version = {{wikidata|property|edit|reference|P348}}
| latest release date = {{start date and age|{{wikidata|qualifier|P348|P577}}}}
| operating system = [[Cross-platform]]
| programming language = [[C (programming language)|C]]
| genre = distributed memory caching system
| license = [[Revised BSD license]]<ref name="Memcached license">{{cite web | url=https://github.com/memcached/memcached/blob/master/COPYING | title=Memcached license | publisher=[[GitHub]] | access-date=2014-06-27}}</ref>
}}
'''Memcached''' (pronounced variously /mɛmkæʃˈdiː/ ''mem-cash-dee'' or /ˈmɛmkæʃt/ ''mem-cashed'') is a general-purpose distributed [[memory caching|memory-caching]] system. It is often used to speed up dynamic [[database]]-driven websites by caching data and [[Object (computer science)|objects]] in [[Random-access memory|RAM]] to reduce the number of times an external data source (such as a database or API) must be read. Memcached is [[free and open-source software]], licensed under the [[Revised BSD license]].<ref name="Memcached license" /> Memcached runs on [[Unix-like]] operating systems ([[Linux]] and [[macOS]]) and on [[Microsoft Windows]]. It depends on the [[libevent]] library.

Memcached's [[Application Programming Interface|API]]s provide a very large [[hash table]] distributed across multiple machines. When the table is full, subsequent inserts cause older data to be purged in [[least recently used]] (LRU) order.<ref>{{cite web|url=http://code.google.com/p/memcached/wiki/NewOverview |title=Google Code Archive - Long-term storage for Google Code Project Hosting |website=Code.google.com |access-date=2017-06-25}}</ref><ref>{{cite web|url=http://code.google.com/p/memcached/wiki/NewUserInternals |title=Google Code Archive - Long-term storage for Google Code Project Hosting |website=Code.google.com |access-date=2017-06-25}}</ref> Applications using Memcached typically layer requests and additions into RAM before falling back on a slower backing store, such as a database.

Memcached has no internal mechanism to track misses which may happen. However, some third party utilities provide this functionality.

Memcached was first developed by [[Brad Fitzpatrick]] for his website [[LiveJournal]], on May 22, 2003.<ref>[http://community.livejournal.com/changelog/637455.html]. Community.livejournal.com (2003-05-22). Retrieved on 2013-09-18.</ref><ref>[http://community.livejournal.com/lj_dev/539656.html]. Community.livejournal.com (2003-05-27). Retrieved on 2013-09-18.</ref> It was originally written in [[Perl]], then later rewritten in [[C (programming language)|C]] by Anatoly Vorobey, then employed by LiveJournal.<ref>{{cite web|url=http://lj-dev.livejournal.com/539656.html |archive-url=https://web.archive.org/web/20130225020652/http://lj-dev.livejournal.com/539656.html |url-status=dead |archive-date=2013-02-25 |title=lj_dev: memcached |date=2013-02-25 |access-date=2017-06-25}}</ref> Memcached is now used by many other systems, including [[YouTube]],<ref>{{cite video|people=Cuong Do Cuong (Engineering manager at YouTube/Google)|title=Seattle Conference on Scalability: YouTube Scalability|url=http://video.google.com/videoplay?docid=-6304964351441328559|medium=Online Video - 26th minute|publisher=Google Tech Talks|location=Seattle|date=June 23, 2007}}</ref> [[Reddit]],<ref>{{cite web|url=http://carsonified.com/blog/dev/steve-huffman-on-lessons-learned-at-reddit/|archive-url=https://web.archive.org/web/20100517063632/http://carsonified.com/blog/dev/steve-huffman-on-lessons-learned-at-reddit/|url-status=dead|archive-date=2010-05-17|title=Steve Huffman on Lessons Learned at Reddit &#124; Carsonified|last=Whitaker|first=Keir|date=2010-05-17|access-date=2017-06-25}}</ref> [[Facebook]],<ref>{{cite web|url=http://www.facebook.com/note.php?note_id=39391378919&ref=mf|title=Scaling memcached at Facebook|date=2008-12-12|website=Facebook.com|access-date=2017-06-25}}</ref><ref>{{cite book|url=https://www.usenix.org/conference/nsdi13/scaling-memcache-facebook|title=Scaling Memcache at Facebook|year=2002 |publisher=USENIX|isbn=9781931971003 |access-date=2017-06-25}}</ref> [[Pinterest]],<ref>{{cite news|url=https://engineering.pinterest.com/blog/building-pinterest-cloud|title=Building Pinterest in the cloud|date=2013-06-19|newspaper=Pinterest Careers|access-date=2018-03-09}}</ref><ref>{{cite web|url=https://github.com/pinterest/pymemcache|title= A comprehensive, fast, pure-Python memcached client|date=2018-01-08|website=Github.com|access-date=2018-03-09}}</ref> [[Twitter]],<ref>{{cite web|url=http://blog.twitter.com/2008/05/its-not-rocket-science-but-its-our-work.html|title=It's Not Rocket Science, But It's Our Work|date=2008-06-01|website=Blog.twitter.com|access-date=2017-06-25}}</ref> [[Wikipedia]],<ref>{{cite web|url=https://www.mediawiki.org/wiki/Memcached|title=memcached|publisher=MediaWiki|access-date=2017-06-25}}</ref> and [[Method Studios]].<ref>{{Citation|title=Rez BoF, SIGGRAPH 2019|url=https://www.youtube.com/watch?v=y5VSPeeqJbM |archive-url=https://ghostarchive.org/varchive/youtube/20211212/y5VSPeeqJbM| archive-date=2021-12-12 |url-status=live|language=en|access-date=2019-08-09}}{{cbignore}}</ref> [[Google App Engine]], [[Google Cloud Platform]], [[Microsoft Azure]], [[IBM Bluemix]] and [[Amazon Web Services]] also offer a Memcached service through an API.<ref>{{cite web|url=http://code.google.com/appengine/docs/python/memcache/usingmemcache.html|title=Memcache Examples &#124; App Engine standard environment for Python &#124; Google Cloud Platform|date=2017-03-22|website=Code.google.com|access-date=2017-06-25}}</ref><ref>{{cite web|url=http://msdn.microsoft.com/en-us/library/windowsazure/hh914161.aspx|title=About In-Role Cache for Azure Cache|date=2015-08-25|website=Msdn.microsoft.com|access-date=2017-06-25}}</ref><ref>{{cite web|url=http://www.datacenterknowledge.com/archives/2014/09/23/redis-labs-3000-paying-cloud-memory-nosql-customers/|title=Redis Labs: We Have 3,000 Paying Cloud In-Memory NoSQL Customers|last=Verge|first=Jason|date=2014-09-23|access-date=2016-09-10|work=Data Center Knowledge}}</ref><ref>{{cite web|url=http://aws.amazon.com/elasticache/|title=AWS &#124; Amazon ElastiCache – in-memory data store and cache|website=Aws.amazon.com|access-date=2017-06-25}}</ref>

==Software architecture==
{{Unreferenced section|date=June 2013}}
The system uses a [[client–server]] architecture. The servers maintain a key–value [[associative array]]; the clients populate this array and query it by key. Keys are up to 250 bytes long and values can be at most 1 [[megabyte]] in size.

Clients use client-side libraries to contact the servers which, by default, expose their service at [[Computer port (software)|port]] 11211. Both TCP and UDP are supported. Each client knows all servers; the servers do not communicate with each other. If a client wishes to set or read the value corresponding to a certain key, the client's library first computes a [[hash function|hash]] of the key to determine which server to use. This gives a simple form of [[shard (database architecture)|shard]]ing and scalable [[shared-nothing architecture]] across the servers. The server computes a second hash of the key to determine where to store or read the corresponding value. The servers keep the values in RAM (and, starting in 1.6.0, in auxiliary cache on disk using an external storage server option);<ref name=":0">{{Cite news |last=McIntosh |first=Jason |date=14 February 2025 |title=The evolution of Memcached |url=https://lwn.net/Articles/1007303/ |url-status=live |access-date=14 February 2025 |work=LWN}}</ref> if a server runs out of available memory or disk, it discards the oldest values. Therefore, clients must treat Memcached as a transitory cache; they cannot assume that data stored in Memcached is still there when they need it. Other databases, such as [[MemcacheDB]], [[Couchbase Server]], provide persistent storage while maintaining Memcached protocol compatibility.

If all client libraries use the same hashing algorithm to determine servers, then clients can read each other's cached data.

A typical deployment has several servers and many clients. However, it is possible to use Memcached on a single computer, acting simultaneously as client and server. The size of its hash table is often very large. It is limited to available memory across all the servers in the cluster of servers in a data center. Where high-volume, wide-audience Web publishing requires it, this may stretch to many gigabytes. Memcached can be equally valuable for situations where either the number of requests for content is high, or the cost of generating a particular piece of content is high. Applications with particularly high-demand caching needs can use a built-in proxy to define and configure complex client-server routes.<ref name=":0" />

===Security===
Most deployments of Memcached are within trusted networks where clients may freely connect to any server. However, sometimes Memcached is deployed in untrusted networks or where administrators want to exercise control over the clients that are connecting. For this purpose Memcached can be compiled with optional [[Simple Authentication and Security Layer|SASL]] authentication support. The SASL support requires the binary protocol.

A presentation at [[Black Hat Briefings|BlackHat USA 2010]] revealed that a number of large public websites had left Memcached open to inspection, analysis, retrieval, and modification of data.<ref>{{Cite web |url=https://www.sensepost.com/blog/2010/blackhat-write-up-go-derper-and-mining-memcaches/ |title=SensePost &#124; Blackhat write-up: Go-derper and mining memcaches |access-date=2016-09-02 |archive-url=https://web.archive.org/web/20181221184133/https://sensepost.com/blog/2010/blackhat-write-up-go-derper-and-mining-memcaches/ |archive-date=2018-12-21 |url-status=dead }}</ref>

Even within a trusted organisation, the flat trust model of memcached may have security implications. For efficient simplicity, all Memcached operations are treated equally. Clients with a valid need for access to low-security entries within the cache gain access to ''all'' entries within the cache, even when these are higher-security and that client has no justifiable need for them. If the cache key can be either predicted, guessed or found by exhaustive searching, its cache entry may be retrieved.

Some attempt to isolate setting and reading data may be made in situations such as high volume web publishing. A farm of outward-facing content servers have ''read'' access to memcached containing published pages or page components, but no write access. Where new content is published (and is not yet in memcached), a request is instead sent to content generation servers that are not publicly accessible to create the content unit and add it to memcached. The content server then retries to retrieve it and serve it outwards.

====Used as a DDoS attack vector====
In February 2018, [[CloudFlare]] reported that misconfigured memcached servers were used to launch [[Denial-of-service attack|DDoS attacks]] in large scale.<ref>{{cite web|url=https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/|title=Memcrashed - Major amplification attacks from UDP port 11211|date=27 Feb 2018|publisher=CloudFlare|access-date=3 March 2018}}</ref> The memcached protocol over UDP has a huge [[Denial-of-service attack#Amplification|amplification factor]], of more than 51000.<ref>{{cite news|url=https://www.techspot.com/news/73522-github-hit-massive-ddos-attack.html|title=GitHub falls victim to largest DDoS attack ever recorded|date=Mar 1, 2018|author=Jeffrey, Cal}}</ref> Victims of the DDoS attacks include [[GitHub]], which was flooded with 1.35&nbsp;Tbit/s peak incoming traffic.<ref>{{cite web|url=https://githubengineering.com/ddos-incident-report/|title=February 28th DDoS Incident Report|date=March 1, 2018|access-date=3 March 2018}}</ref>

This issue was mitigated in Memcached version 1.5.6, which disabled UDP protocol by default.<ref>{{cite web| url=https://github.com/memcached/memcached/wiki/ReleaseNotes156 |title=Memcached 1.5.6 Release Notes|website=[[GitHub]] |date=2018-02-27|access-date=3 March 2018}}</ref>

==Example code==
''Note that all functions described on this page are [[pseudocode]] only. Memcached calls and programming languages may vary based on the API used.''

Converting database or object creation queries to use Memcached is simple. Typically, when using straight database queries, example code would be as follows:

<syntaxhighlight lang="c">
 function get_foo(int userid)
     data = db_select("SELECT * FROM users WHERE userid = ?", userid)
     return data

</syntaxhighlight>
After conversion to Memcached, the same call might look like the following
<syntaxhighlight lang="c">
 function get_foo(int userid)
     /* first try the cache */
     data = memcached_fetch("userrow:" + userid)
     if not data
         /* not found : request database */
         data = db_select("SELECT * FROM users WHERE userid = ?", userid)
         /* then store in cache until next get */
         memcached_add("userrow:" + userid, data)
     end

     return data

</syntaxhighlight>
The client would first check whether a Memcached value with the unique key "userrow:userid" exists, where userid is some number. If the result does not exist, it would select from the database as usual, and set the unique key using the Memcached API add function call.

However, if only this API call were modified, the server would end up fetching incorrect data following any database update actions: the Memcached "view" of the data would become out of date. Therefore, in addition to creating an "add" call, an update call would also be needed using the Memcached set function.
<syntaxhighlight lang="c">
 function update_foo(int userid, string dbUpdateString)
     /* first update database */
     result = db_execute(dbUpdateString)
     if result
         /* database update successful : fetch data to be stored in cache */
         data = db_select("SELECT * FROM users WHERE userid = ?", userid)
         /* the previous line could also look like data = createDataFromDBString(dbUpdateString) */
         /* then store in cache until next get */
         memcached_set("userrow:" + userid, data)
</syntaxhighlight>
This call would update the currently cached data to match the new data in the database, assuming the database query succeeds. An alternative approach would be to invalidate the cache with the Memcached delete function, so that subsequent fetches result in a cache miss. Similar action would need to be taken when database records were deleted, to maintain either a correct or incomplete cache.

An alternate cache-invalidation strategy is to store a random number in an agreed-upon cache entry and to incorporate this number into all keys that are used to store a particular kind of entry. To invalidate all such entries at once, change the random number. Existing entries (which were stored using the old number) will no longer be referenced and so will eventually expire or be recycled.

<syntaxhighlight lang="c">
  function store_xyz_entry(int key, string value)
      /* Retrieve the random number - use zero if none exists yet.
      *  The key-name used here is arbitrary. */ 
      seed = memcached_fetch(":xyz_seed:")
      if not seed
          seed = 0
      /* Build the key used to store the entry and store it.
      *  The key-name used here is also arbitrary. Notice that the "seed" and the user's "key"
      *  are stored as separate parts of the constructed hashKey string: ":xyz_data:(seed):(key)." 
      *  This is not mandatory, but is recommended. */
      string hashKey = sprintf(":xyz_data:%d:%d", seed, key)
      memcached_set(hashKey, value)

  /* "fetch_entry," not shown, follows identical logic to the above. */

  function invalidate_xyz_cache()
      existing_seed = memcached_fetch(":xyz_seed:")
      /* Coin a different random seed */
      do
          seed = rand()
      until seed != existing_seed
      /* Now store it in the agreed-upon place. All future requests will use this number. 
      *  Therefore, all existing entries become un-referenced and will eventually expire. */
      memcached_set(":xyz_seed:", seed)
</syntaxhighlight>

==Usage==
*[[MySQL]] - directly supports the Memcached API as of version 5.6.<ref>{{cite web|url=https://www.theregister.co.uk/2013/02/06/oracle_mysql_56_vs_mariadb/ |title=Speedy MySQL 5.6 takes aim at NoSQL, MariaDB |website=Theregister.co.uk |access-date=2017-06-25}}</ref>
*[[Oracle Coherence]] - directly supports the Memcached API as of version 12.1.3.<ref>{{cite web |author=David Felcey |url=https://blogs.oracle.com/OracleCoherence/entry/getting_started_with_the_coherence |title=Getting Started With The Coherence Memcached Adaptor &#124; Oracle Coherence Blog |website=Blogs.oracle.com |date=2014-08-13 |access-date=2017-06-25 |archive-date=2017-02-23 |archive-url=https://web.archive.org/web/20170223093719/https://blogs.oracle.com/OracleCoherence/entry/getting_started_with_the_coherence |url-status=dead }}</ref>
*[[Infinispan]] - directly supports Memcached.<ref>{{cite web|url=https://infinispan.org/docs/stable/titles/memcached/memcached.html |title=Using the Memcached protocol endpoint with Infinispan |website=infinispan.org |access-date=2022-04-19}}</ref>

==See also==
{{Portal|Free and open-source software}}
* [[Amazon ElastiCache]]
* [[Aerospike (database)|Aerospike]]
*[[Couchbase Server]]
*[[Redis]]
*[[Mnesia]]
*[[MemcacheDB]]
*[[Hazelcast]]
*[[Apache Cassandra|Cassandra]]
*[[ScyllaDB]]
*[[Tarantool]]
* [[Ehcache]]
*[[Infinispan]]

==References==
{{Reflist|30em}}

==External links==
*{{Official website}}

[[Category:2003 software]]
[[Category:Cross-platform software]]
[[Category:Database caching]]
[[Category:Free memory management software]]
[[Category:Key-value databases]]
[[Category:Software using the BSD license]]
[[Category:Structured storage]]