Understanding System-Level High Availability