The only exception to this is failovers to snapshot standby databases. database is in the primary role. Initiate the failover on the standby database STAN: Data Guard broker does not manage or store credentials. variable must have read, write, and execute permissions for the directory owner The In an Oracle Data Guard configuration, the SRVCTL -startoption for a standby database is always set to OPEN after a switchover. When a serious condition uniquely known to an application is detected, the application can call the DBMS_DG.INITIATE_FS_FAILOVER function to initiate an immediate fast-start failover. When a fast-start failover occurs because either a user configurable fast-start failover condition is detected or an application initiates a fast-start failover by calling the DBMS_DG.INITIATE_FS_FAILOVER function, the former primary database is always shut down and never automatically reinstated. commands. It has two parts in the following order: Configuration declaration this section is mandatory. After Fast-Start Failover: The fast-start failover has completed and the target standby database is running in the primary database role. This is typically done for planned maintenance of the primary system. observers for a single Data Guard configuration. You will then need to re-create the physical standby databases from a copy of the new primary database before you can reenable them. operation: Example 6-1 Fast-start Failover Configuration The example uses 10 seconds. The standby can be physical or logical and there can be multiple standbys, but only one of the standbys can be the failover target at any given time. This allows the appropriate Data Guard services, such as redo transport or redo apply, to be started when the database is restarted later for any reason. There are configuration requirements that must be met in order to publish and properly handle FAN events generated as the result of a broker-managed failover. For example, to determine if fast-start failover can occur, the FS_FAILOVER_STATUS column displays either SYNCHRONIZED or TARGET UNDER LAG LIMIT and the FS_FAILOVER_OBSERVER_PRESENT column displays YES for the target standby database. (For example, if the DBMS_LOGSTDBY.SKIP procedure was used to specify which database operations done on the primary database will not be applied to the logical standby database.). When the standby becomes available again, the primary and standby re-synchronize and resume synchronous redo transfer. 1)What are the steps to do Switchover/Failover operation manually in 2-node RAC and 2-node DATAGUARD environment. An immediate failover is the fastest type of failover. Table 6-1 Content of Default Directory for Client-side Files, Contains the observer configuration file that is used by Enable Active Data Guard for read-only workloads. After an immediate failover completes, all the standby databases in the configuration, regardless of their type, are disabled. Verify there are no active users connected to the databases. In Oracle Database 11g, the password file on the standby must be a physical copy of the password file on the primary due to security enhancements introduced in Oracle Database 11g. In this case fast-start failover cannot occur because the databases are not ready to failover. Enabling Fast-Start Failover describes how to start observers as a part of the step-by-step process to enable fast-start failover. You can switch back to the original Primary database later by performing another switch over. So if the original Primary database is still accessible, you should always consider a switchover first. Rather, fast-start failover will be enabled in accordance with the current protection mode. LGWR is unable to write to any member of the log group because on an I/O error. Flashback Database stores its logs in the Flash Recovery Area (FRA), so the FRA must be large enough to store at least 60 minutes of Flashback Database history. Oracle Corporation recommends that you specify this type of failover. Maximum availability SYNC or FASTSYNC or ASYNC, Maximum performance SYNC or FASTSYNC or Overall Steps:-. The FS_FAILOVER_OBSERVER_PRESENT column displays YES for the target standby database. (Note: 11.1.0.7 adds the StaticConnectIdentifier Broker database property to allow you to specify a different service name.) For example, if all your physical standbys are also unavailable, then failing over to a logical standby is your only choice. Simply use DISABLE FAST_START FAILOVER. If a non-zero value is specified for the The example assumes that the standby uses the same directory structure as the primary. Note that if the V$DATABASE.FS_FAILOVER_STATUS column has a value of DISABLED, then any values returned for the remaining columns related to fast-start failover (V$DATABASE.FS_FAILOVER_*) become irrelevant. For Maximum Availability environments, change this to synchronous. There are many examples, and Ritesh Chhajer offers this example of doing a Data Guard switchover using dgmgrl: 1. If the value is zero, the standby must Fast-start failover enables the Data Guard broker to rapidly and automatically failover to a previously chosen standby database without requiring manual intervention. receives redo data from a far sync instance. Restore - Flashback Database restores the datafiles to the closest snapshot prior to the specified SCN. FastStartFailoverAutoReinstate is set to FALSE, Another failover or switchover occurred after the fast-start failover completed but before the former primary database restarted, The master observer cannot connect to the former primary database, The former primary database cannot connect to the new primary database, The former primary database and the new primary database are not configured in the same fast-start failover environment, The former primary database was disabled because of a manual failover when fast-start failover was disabled. The target standby database is synchronized with the primary database if it is a configuration operating in maximum availability or maximum protection mode, or the target standby database is within the lag limit if it is a configuration operating in maximum performance mode. The real test of the configuration is a successful role transition in both directions with both switchover and FSFO failover. When the conditions for fast-start failover are met, the Broker adds messages to the observer log and broker log indicating that fast-start failover would have been initiated. When performing a failover in a configuration whose standbys are all of the same type, choose the standby database that has the smallest transport lag. More specifically, we can have an asynchronous second read-only Managed instance in the same or in a different region. Manual failover to the fast-start failover target can be performed without receiving an acknowledgement from the observer. The FORCE option disables fast-start failover on the database to which you are connected even when errors occur. To configure fast-start failover in observe-only mode: Fast-start failover will not be triggered if the primary or standby database is shut down normally. Oracle Database 11g FSFO adds support for Maximum Performance mode (async redo transfer), providing the flexibility to trade durability for performance. The broker allows the failover to proceed as long as there are no errors for the standby database that you selected to participate in the failover. Maximum Availability mode uses synchronous redo transfer and FSFO imposes the additional requirement that the redo is recorded in the standby redo log (SRL) of the target standby (AFFIRM option of log_archive_dest_ n). This list describes how the overall Oracle Data Guard protection mode is handled after a manual failover (complete or immediate). Immediately after issuing command in step 2, shut down and restart the former primary instance PRIM: The FastStartFailoverTarget configuration property on the primary unless the new property value contains the current fast-start failover target. STOP OBSERVING, and SET See Oracle Data Guard Concepts and Administration for more information on using the ALTER SYSTEM FLUSH REDO statement. As a result, there is no guarantee that the observer will not perform a fast-start failover to the target standby database if the observer determines that conditions warrant a failover. Therefore, the primary database can continue processing transactions, even if the target standby database fails. You want to conduct a manual failover to any standby database in the configuration (for example, because a failure occurred on the primary database at a time when the primary and target standby database were not ready to failover). Reinstatement is supported only after failover in a broker configuration. If you perform a manual failover when fast-start failover is enabled: The failover can only be performed to the current target standby database. Once you set these properties, their values persist through role changes during switchover and failover. If fast-start failover is enabled, then a switchover can be performed only to the pre-specified target standby database and only if the standby database is synchronized with the primary database or is within the configured lag limit, for the max availability and max performance modes respectively. The database cannot provide fast-start failover status information. Note that role changes to logical standby databases always result in physical standby database bystanders being disabled. automatic failover feature in configurations set up for zero data loss protection at any They must be re-created from a copy of the new primary database. A switchover is a role reversal between the primary database and one of its standby databases. ObserverConfigFile is a DGMGRL session runtime property. Default value is 10 miliseconds. Only the observer can initiate FSFO failover. You must then re-create it from a copy of the new primary database and reenable it as described in How to Re-create and Reenable a Disabled Database. The primary database was shut down without using the ABORT option. Instead, Oracle Clusterware opens PDBs on particular instances based on The state file is locked when the observer is running to prevent multiple observers from using the same file. groups used by multiple configuration commands. The broker initiates a failover after the number of seconds specified by this If you are performing an immediate failover, then the database role is changed to primary without applying any accumulated redo data. With a value of TRUE for this property, the primary will shut down after being stalled for the number of seconds specified by the FastStartFailoverThreshold property. This action may result in two databases in the configuration simultaneously assuming the primary database role. The FORCE option may be the preferred method for disabling Transitions the target standby database into the primary role, opens the new primary database in read/write mode, and starts redo transport services. We want the observer to be able to automatically reinstate the former primary as a standby after our failover tests, so before each test, make sure that Flashback Database has at least 30 minutes of history. Enabling Fast-Start Failover Task 1: Determine Which of the Available Standby Databases is the Best Target for the Failover, Enabling Fast-Start Failover Task 2: Specify Target Standbys with the FastStartFailoverTarget Configuration Property, Enabling Fast-Start Failover Task 3: Determine the Protection Mode You Want, Enabling Fast-Start Failover Task 4: Set the FastStartFailoverThreshold Configuration Property, Enabling Fast-Start Failover Task 5: Set Other Properties Related to Fast-Start Failover (Optional), Enabling Fast-Start Failover Task 6: Enable Additional Fast-Start Failover Conditions (Optional), Enabling Fast-Start Failover Task 7: Using DGMGRL or Cloud Control, Enabling Fast-Start Failover Task 8: Start the Observer, Enabling Fast-Start Failover Task 9: Verify the Fast-Start Failover Environment. Valid values are >= 100. To start an observer as a background process, use the DGMGRL See the Oracle Maximum Availability Architecture technical briefs at: When setting the FastStartFailoverLagLimit configuration property, consider these tradeoffs between performance and potential data-loss: A low lag limit will minimize data loss but may impact the performance of the primary database. Administration at the target standby site should be as comprehensive as that at the primary site because the standby database may assume the primary role without prior notice. This article - the seventh in this ongoing . connectivity with target standby. See the Cloud Control online help for more information. An observer is a separate OCI client-side component that run on a different computer from the primary and standby databases and monitors the availability of the primary database. on ob3-host and ob4-host will not Syntax for Mandatory Configuration Declaration. Issue the following SRVCTL commands so that both databases in the Data Guard configuration know about the two potential services for each database: To start things up initially, you must manually start the services on the right node. They must be re-created from a copy of the new primary database. Broker Configuration Has Only One Registered Observer. It's generally a good idea to store the state file in a directory associated with the database to avoid locking issues when running multiple observers on the same host. To verify this change, again query the Database_role column of V$DATABASE. Applications can initiate FSFO failover directly using the DBMS_DG.INITIATE_FS_FAILOVER procedure with an optional message text that will be displayed in the observer log and the primary's alert log. using the same SYS credentials you used when you connected to the The FS_FAILOVER_OBSERVER_PRESENT column, which indicates whether the observer is running and actively pinging the database. Determining a Database's Readiness to Change Roles. SQL> Select Database_role from v$Database; Hi, I am working in IT industry with having more than 10 year of experience, worked as an Oracle DBA with a Company and handling different databases like Oracle, SQL Server , DB2 etc If this occurs, run 'stop observer' and try again. This configuration property establishes an acceptable limit, in seconds, that the standby is allowed to fall behind the primary in terms of redo applied, beyond which a fast-start failover will not be allowed. The following is a sample observer configuration file: Since the broker configuration SALES consists of three databases, Boston, Chicago, and Dallas, with a CONNECT_ID of SALES_P, the SALES_P connect identifier must be defined such that it can reach any instance of any database within the configuration. This is the current working directory, Uses standard output for displaying the observer logs. There is no impact on your current configuration or on applications. Provides an automatic failover environment that If no name is specified for the observer then a default observer name, the host name of machine where the START OBSERVER command is issued, is used. Note the use of "/@" to login using the wallet. The Marketplace image that you use to create the VMs is Oracle:Oracle-Database-Ee:12.1..2:latest. Any standby database that was disabled by the broker must be reinstated or re-created, as described in Reenabling Disabled Databases After a Role Change, before it can be a standby database for the new primary database. observer_hostname.log. If there is more than one standby database in the configuration, you must explicitly set the FastStartFailoverTarget property on the primary database to name one or more candidate target standby databases. The command SHOW OBSERVER provides detailed information about registered observers. Just be sure to include a Flashback Database history check in the script to provide an option to abort if a failover would require a manual reinstate. stored in the specified path using the default file names. See Reenabling Disabled Databases After a Role Change for more information. On Windows, the directory specified by the DG_ADMIN observer name, host, whether it is the master observer, when it became the master In this mode, the FastStartFailoverLagLimit configuration property is set to a non-zero value. This action will result in loss of data and the possibility of two databases in the configuration simultaneously assuming the primary database role. To switchover to a standby that is not the current failover target: John Smiley [jrsmiley@gmail.com] is a persistent storage architect for a major online retailer. Although the default value of 30 seconds is typically adequate for detecting outages and failures on most configurations, you can adjust failover sensitivity with this property to decrease the probability of false failovers in a temporarily unstable environment. ZERO DATA LOSS: Fast-start failover is enabled with zero data loss. Automatic failover is optional and can be enabled or disabled on your Autonomous Container Databases with Autonomous Data Guard. Regardless of the method you choose, the broker coordinates the role transition on all databases in the configuration. Switchover and Manual Failover for more information about switchovers and manual failovers, respectively. RAM). This section describes how to configure an Oracle Net connect descriptor that meets this requirement. environment variable is set and the specified directory has the The list is empty by default.