Written by authors well-known for their talent with RAC, Pro Oracle Database 11g RAC on Linux . If a single-instance primary database (either Oracle RAC or non-Oracle RAC), or if all instances of an Oracle RAC primary database fail, the observer attempts a fast-start failover. ObserverConfigFile is a DGMGRL session runtime property. alter database recover managed standby database cancel; Step:3 The below commands will help to bring up standby as primary. Subsequent changes to the same block during the same snapshot are not recorded. primary database must have network connectivity. The following example displays the contents of the fast-start failover The price for this guarantee is increased commit latency ( log file sync waits). Verifies that the primary and the target standby databases are in the following states: The primary database is enabled and is in the TRANSPORT-ON state. In the event of a The default group is all the configurations defined in the observer configuration file. PRIM> ALTER DATABASE COMMIT TO SWITCHOVER TO PHYSICAL STANDBY WITH SESSION SHUTDOWN; You can disable fast-start failover if necessary, by using the FORCE option. Note that the database will not open at this point. Use the FastStartFailoverTarget configuration property on the current primary database to specify one or more fast-start failover targets. Switching over to a logical standby database results in the snapshot and physical standby databases in the broker configuration being disabled by the broker, making these databases no longer viable as standby databases. Another good test is to simulate network failures that leave the primary up, but isolated from the failover target standby and the observer. FS_FAILOVER_OBSERVER_HOST shows the name of the computer on which the master observer is running, FS_FAILOVER_OBSERVER_PRESENT shows whether or not the master observer is connected to the local database. The observer is perfectly satisfied if all of the redo it needs to meet your durability requirements has been received by the failover target. Add the SRLs. They may be reinstated if Flashback Database is enabled on those databases. A good method to determine Flashback Database storage requirements is to enable Flashback Database and observe the amount of storage it uses during several peak loads. There may or may not be data loss depending upon whether your primary and target standby databases were synchronized at the time of the primary database failure. Instead, it allows an observer that is monitoring the configuration to initiate a fast-start failover should database conditions warrant a failover. Many customers use Oracle Database deployed on Amazon Elastic Compute Cloud (Amazon EC2) to run their Oracle E-Business Suite applications. mode when the fast-start failover target is a logical or physical standby database that If the former primary database cannot be reinstated automatically, you can manually reinstate it using either the DGMGRL REINSTATE command or Cloud Control. standby database is mounted, broker remembers this setting. You must use the Oracle wallet to store the credentials for all broker configurations to be managed. After step 3 completes, you can open the new Primary database STAN: You might, for instance, use this to allow the observer to monitor the databases using the same connect identifiers as the client applications. PRIM>STARTUP MOUNT; Disabling Fast-Start Failover Using DGMGRL. When using DGMGRL, you need to issue the SWITCHOVER command, specifying the name of the standby database that you want to change into the primary role. The Appendix provides information oncreating a simple wrapper script to start the observer as a background process. The following table summarizes which standby types are supported in which protection modes when fast-start failover is enabled. Before a Tags: Data Guard, Oracle. To see Manual Switch Over Manual SwitchOver in Oracle To see Manual Fail Over Manual Failover in Data Guard With Oracle Data Guard [] DGConnectIdentifier, "Scenario 9: Performing a Switchover Operation" for an example of using the VALIDATE DATABASE command to show a database's readiness to complete a role switchover, "Scenario 10: Performing a Manual Failover Operation" for an example of using the VALIDATE DATABASE command to show a database's readiness to complete a role failover. To maximize the benefits of FSFO, the observer should run on a different host than the primary and standby databases. Without the credentials, Broker will complete the role transition, but will leave the databases in need of a manual restart. Logical standby databases that are disabled during failover can be reinstated. The syntax for the configuration declaration is: The definition for each broker configuration is: The configuration-name can be different from the name defined in the metadata of the Data Guard Broker configuration. environment that is guaranteed to either lose no data (when the The observer is very lightweight, requiring few system resources. Choose a value high enough to avoid false disconnects from intermittent network trouble. In this case, the observer cannot perform a fast-start failover even if conditions warrant a failover. North_Sales is in the primary role. However, you can change the name or the location of the file if you start the observer using the DGMGRL START OBSERVER command and include the FILE IS qualifier. the primary role, use the PreferredObserverHosts FastStartFailoverLagLimit property. After Fast-Start Failover: The fast-start failover has completed and the target standby database is running in the primary database role. In short, the failover is the deformation of the production (primary) database and activating standby database as the primary. Immediate Failovers in Configurations Using Cascaded Standbys. During a switchover, the primary database transitions to a standby role, and the standby database transitions to the primary role. The current primary database must have its LogXptMode property set accordingly and must have standby redo logs configured. A value of TRUE helps to ensure that an isolated primary database cannot satisfy user queries. You must then re-create it from a copy of the new primary database and reenable it as described in How to Re-create and Reenable a Disabled Database. These In a Managed Instance with multiple databases in Azure we can have high availability. broker does not allow the primary database to commit transactions until it has regained If the FastStartFailoverPmyShutdown configuration property is set to TRUE, then the former primary database will have been automatically shut down and must be manually restarted before the master observer can attempt to reinstate it. However, there may be exceptions to the recommendation to choose a physical standby database as the target standby database. Once the Oracle instance is transitioned into primary database status in either switchover or failover, the life of the database as the standby ends and its service as the primary database . To stop the observer, see Stopping the Observer. The SHOW CONFIGURATION command will show you which databases can be reinstated and which databases must be re-created. See FastStartFailoverTarget for more information about this property. It has two parts in the following order: Configuration declaration this section is mandatory. Do this prior to every failover test. The primary and target standby must have connectivity for the STOP OBSERVER command to complete successfully. However, no additional data is applied on the standby database once you invoke the failover. In addition, some standby databases may be disabled by the broker during the failover if the broker detects that they have applied redo beyond where the new primary database had applied. The primary database can be opened even if there is no acknowledgement from the observer or target standby. Look for the desired data in the RAM. Run the RMAN utility and connect to the target (primary) and auxiliary (new standby). If the agent is not Worked as a Development and Database Administrator. Fast-start failover can incur data-loss within the time specified by FastStartFailoverlagLimit. The primary database was shut down without using the ABORT option. If you are not using Oracle Clusterware or Oracle Restart, then you must create static service names so that the observer can automatically restart a database as part of reinstatement. Verify there are no active users connected to the databases. The example uses 10 seconds. If no name is specified for the observer then a default observer name, the host name of machine where the START OBSERVER command is issued, is used. Oracle 12c-Step by Step Manual Data Guard Switchover, Manual Upgrading Oracle Database From 11.2.0.4 to 12.2.0.1, Automatically Terminated The Blocking Session By Setting MAX_IDLE_BLOCKER_TIME, Apply Patching On Oracle 21c Database Release Update 21.7.0.0.0, Oracle 21c Point In Time Recovery of Pdb Database, Oracle 21c Cloning a PDB Database Using Sqldeveloper Tool. Create a pre-callout script, or a post-callout script, or both. However failing over to a snapshot standby database will require more time because the broker must first convert it back to a physical standby database. Reinstatement will have to be accomplished by other means (manual or scripted Broker commands). The lowest possible value is 5 seconds. To get started, all you'll need is Oracle Database Enterprise Edition Release 10.2 or later, a database, and three hosts: two for the databases and a small host for the FSFO observer. In an Oracle Data Guard configuration, the SRVCTL -startoption for a standby database is always set to OPEN after a switchover. The following paragraphs describe the supported availability modes. The Column Value in the following table is consistent across instances in an Oracle Real Applications Clusters (Oracle RAC) environment. These conditions are described in the following table: Dictionary corruption of a critical database. WAIT option, broker waits for the amount of See Directing a Fast-Start Failover From an Application). In fact, failovers are so reliable, fast, and simple that switchovers become the exception rather than the rule. Being FSFO ready means that all conditions are met for a successful failover, including having a running observer and sufficient redo transmitted to the failover target to meet durability requirements. With increased latency comes decreased throughput; however, in some cases the difference in throughput may be made up by increasing parallelism. You can specify particular conditions for which a fast-start failover should occur using either Cloud Control or the DGMGRL ENABLE FAST_START FAILOVER CONDITION and DISABLE FAST_START FAILOVER CONDITION commands. Any standby database that was disabled by the broker must be reinstated or re-created, as described in Reenabling Disabled Databases After a Role Change, before it can be a standby database for the new primary database. Performing a Manual Failover Task 1: Determine Which of the Available Standby Databases is the Best Target for the Failover, Performing a Manual Failover Task 2: Start the Failover, Performing a Manual Failover Task 3: Reset the Protection Mode, Performing a Manual Failover Task 4: Re-establish a Disaster-Recovery Configuration. If the group name is not provided, then a new observer is started for each broker configuration defined in observer.ora. FSFO can also be used with logical standbys and an FSFO-enabled configuration may have multiple standbys with a mix of physical and logical, but only one standby can be the failover target at any given time. You can start the observer before or after you enable Configure one or more active standby databases Minimize downtime for upgrades Do not use Shared Server (formerly MTS) for Data Guard. See theFlashback Database section above for information on storage requirements. The service is then configured to be active in the PRIMARY role on the standby database SOUTH, so that it will be active on that database after a role transition. Broker is a Data Guard management utility that maintains state information about a primary and its standby databases. Some of the statistics that can be monitored are as follows: LAST_FAILOVER_TIME that shows the timestamp of last fast-start failover, LAST_FAILOVER_REASON that shows the reason for the last fast-start failover. Don't initiate failover unless at least 30 minutes of history is available. The word ALL cannot be used as a group name because it is a reserved keyword. In this case, Flashback Database cannot be used to reinstate databases. In this case, only observers on ob1-host and Each observer has its own log file. The selected standby database that will be the fast-start failover target must receive redo directly from the primary database. Reinstate or re-create standby databases in the configuration that were disabled by the broker. (Snapshot standbys are not included in the table because they are not supported as fast-start failover targets.). Oracle Data Guard 11gr2 Administration Beginner S Guide As recognized, adventure as well as experience practically lesson, amusement, . fsfocallout.ora. This is a good time to enable FSFO to make sure that all of the prerequisites have been met. Failovers become routine. times that the observer retries a failed ping before it initiates a If you cannot tolerate any loss of data, then ensure that the configuration protection mode is set to maximum availability or maximum protection. observer on ob1-host will be given priority over When you run commands that need access to the observer If the configuration contains physical, snapshot, and logical standby databases, consider choosing a physical standby database as the target standby database. If the Cloud Control agent is installed on the observer In a DataGuard environment when the Primary instance fails you need to go through the Failover and Reinstate processes in order to restore the database service, as described in the documentation: Changes a standby database to the primary role in response to a primary database failure. 8.2 Private Cloud Appliance and . The broker reinstates the database as a standby database of the same type as the former standby database of the new primary database. During an immediate failover, the broker performs the failover steps described in How the Broker Performs an Immediate Failover Operation. For a system to process an instruction involving data access, these are the certain steps involved: Fetch the block of data from the hard disk (secondary/permanent storage) to the primary memory (e.g. Stops Redo Apply or SQL Apply on the standby database immediately, without waiting until all available redo data has been applied. A switchover guarantees no data loss. For example: Fast-start failover occurs if both the observer and the target standby database lose connection to the primary database for the period of time specified by the FastStartFailoverThreshold configuration property. They must be re-created from a copy of the new primary database. Expected output is shown in blue text. Immediately after issuing command in step 2, shut down and restart the former primary instance PRIM: On Windows, the directory specified by the DG_ADMIN on ob3-host and ob4-host will not But before enabling Flashback Database, you must enable Flash Recovery Area (FRA). Standby databases not involved in the switchover (known as bystander standby databases) continue operating in the state they were in before the switchover occurred and will automatically begin applying redo data received from the new primary database. The master observer waits the number of seconds specified by the FastStartFailoverThreshold configuration property before attempting a fast-start failover when the primary database has crashed or has lost connectivity with the observer, as in the following situations: The primary database loses its connections with both the observer and target standby database. lower detection times for primary database failures. You must callout configuration file. All standbys other than the failover target are considered bystanders (v$database.fs_failover_status = 'BYSTANDER'). FB Group:https://www.facebook.com/groups/894402327369506/ Use the 'show fast_start failover' command to see which user configurable FSFO failover conditions are in effect. In this mode, the FastStartFailoverLagLimit configuration property is set to a non-zero value. The master observer uses the value specified by either the DGConnectIdentifier or ObserverConnectIdentifier database properties to connect to the primary and fast-start failover target standby databases. To install Oracle Data Guard, you need to create two Azure VMs on the same availability set: The primary VM (myVM1) has a running Oracle instance. SQL> startup ORACLE instance started. If block change tracking is enabled on the primary, and the target If reinstatement of a database fails, its status changes to ORA-16795: the standby database needs to be re-created. Oracle recommends configuring Flashback Database on every database so that if failover occurs to a physical standby database, you can more easily reinstate any disabled standby databases. See Oracle Data Guard Concepts and Administration for information about tuning the log apply rate for a physical standby database. Reenabling Disabled Databases After a Role Change describes how to restore their viability as standby databases. Alternatively, you can query the V$DATABASE view on the target standby database. Log in as a test user and make some changes that won't impact other parts of the system. It's generally a good idea to store the state file in a directory associated with the database to avoid locking issues when running multiple observers on the same host. This walkthrough assumes that all ORLs and SRLs on the primary and standby databases are the same size. For example, to determine if fast-start failover can occur, the FS_FAILOVER_STATUS column displays either SYNCHRONIZED or TARGET UNDER LAG LIMIT and the FS_FAILOVER_OBSERVER_PRESENT column displays YES for the target standby database. You can start, stop, and show observers for a group of configurations. The broker verifies the state and status of the databases to ensure that the switchover transitioned the databases to their new role correctly. file (fsfo.dat). For each broker configuration on which one or more For more information, see START OBSERVER IN BACKGROUND. The rest of this section provides examples of using DGMGRL SHOW commands to display fast-start failover information and includes sections describing the following views: The DGMGRL SHOW FAST-START FAILOVER command displays all the fast-start failover related information. However, failover is attempted if the ObserverOverride configuration property is set to TRUE. Oracle Real Application Clusters Administration and Deployment Guide for more information about configuring FAN, FCF, and ONS on an Oracle Real Application Clusters (Oracle RAC) database. Stop the observer using the DGMGRL STOP OBSERVER command. Chapter 9 of the Data Guard Broker documentation (10g and 11g) contains a description of each property. When the conditions for fast-start failover are met, the Broker adds messages to the observer log and broker log indicating that fast-start failover would have been initiated. DGMGRL> show configuration Configuration - CDB01_fraad1_CDB01_fraad3 Protection Mode: MaxAvailability Members: CDB01_fraad1 - Primary database CDB01_fraad3 - (*) Physical standby database This walkthrough uses Maximum Availability mode to achieve "zero data loss". If fast-start failover is enabled you can still perform a switchover or a manual failover as long as certain conditions are met. To protect the files, it's good practice to store them in separate filesystems. Upon detecting the break in communication, the observer attempts to reestablish a connection with the primary database for the amount of time defined by the FastStartFailoverThreshold property before initiating a fast-start failover. Errors occurring for any other configuration members will not impede the switchover. observer_hostname.log. At a minimum, you must set db_unique_name. Add the wallet location and override to sqlnet.ora. observer computer is returned to you so that you can continue to In a manual failover, you convert a standby database to a primary database because the original primary database failed and there is no possibility of recovering the primary database in a timely manner. Oracle 12c-Step by Step Manual Data Guard Failover. time, if all the sessions that are connected though the active services The The foundation of FSFO is Data Guard - a primary and at least one standby. Setting this property to 'TRUE' (the default) causes the primary to self-terminate. ZERO DATA LOSS: Fast-start failover is enabled with zero data loss. The standby database must be re-created or reinstated before it can serve as a standby for the new primary database. ConfigurationSimpleName. This action will result in loss of data and the possibility of two databases in the configuration simultaneously assuming the primary database role. In this example, there are 3 ORLs with a max group# of 3. When performing a switchover in a configuration whose standby databases are See Installing and Starting the Observer. command on the observer computer: The observer is a continuously executing process that is Disabling Fast-Start Failover Using Cloud Control. By default, the observer will initiate failover to the target standby if and only if ALL of the following are true: Oracle Database 11g Rel 1 introduced user configurable failover conditions that can trigger the observer to initiate failover immediately. If the DG_ADMIN environment variable is not defined, or the The ObserverReconnect configuration property specifies how often the observer establishes a new connection to the primary database. switch does not happen until the next time the primary contacts the target standby, For example: Using DGMGRL, you can do this by examining the output of the SHOW CONFIGURATION LAG. If fast-start failover is already enabled, the Dataguard broker is used to automate monitoring and controlling standby setups. See Setting the Protection Mode for Your Configuration. Whether or not you need the FORCE option depends mostly on if the primary and target standby database have network connectivity: If the primary and target standby database have network connectivity, and the database to which you are connected has network connectivity with the primary database, the FORCE option has no effect. This configuration property causes the primary database to shut down if fast-start failover is enabled and V$DATABASE.FS_FAILOVER_STATUS indicates the primary has been STALLED for longer than FastStartFailoverThreshold seconds. If the database is managed by Oracle Clusterware, broker does not open any of the gets enabled and then begins monitoring. A single-instance database must be registered with Oracle Restart in order to publish FAN events via ONS. post-callout script, and pre-callout success file for the broker using the same SYS credentials you used when you connected to the See the Oracle Maximum Availability Architecture technical briefs at: When setting the FastStartFailoverLagLimit configuration property, consider these tradeoffs between performance and potential data-loss: A low lag limit will minimize data loss but may impact the performance of the primary database. Use Cloud Control or DGMGRL to perform either a complete (recommended) or an immediate failover. Getting the Oracle Net configuration right is one of the key factors in a successful FSFO deployment. As a result, there is no guarantee that the observer will not perform a fast-start failover to the target standby database if the observer determines that conditions warrant a failover. If there is only one standby database in the configuration, you can skip this step and continue with Task 3. So if the original Primary database is still accessible, you should always consider a switchover first. To enable fast-start failover, both the primary and target standby databases must be running and have connectivity, and satisfy all of the prerequisite conditions listed in Prerequisites for Enabling Fast-Start Failover. This document only talks about switchover involving physical standby database. Table 6-3 FS_FAILOVER_OBSERVER_PRESENT Column of the V$DATABASE View, The master observer is currently connected to the local database, The master observer is not connected to the local database. A fast-start failover to the target standby database fails. The syntax for the optional definition of a broker configuration group is: The group definition section is optional. Overview of Switchover and Failover in a Broker Environment. SUSPENDED is cleared when connectivity with the primary database is restored. time specified in the WAIT option. It is also possible to initiate failover using the dgmgrl failover command. In addition, the database to be reinstated and the new Displays only on the target standby database when either the primary or target standby database was shut down in a controlled fashion (using the NORMAL, IMMEDIATE, or TRANSACTIONAL, options, but not the ABORT option). If fast-start failover is Displays if the standby database's redo applied point lags the primary database's redo generation point by more than the number of seconds specified by the FastStartFailoverLagLimit configuration property and the configuration is operating in maximum performance mode. The primary database can be reinstated if it had flashback database enabled. FB Page:https://www.facebook.com/dbahariprasath/? In these sample commands, the ellipse () signifies any other add service options you wish to supply. Using Cloud Control, you can view the value of the ApplyLag column for each standby database in the Standby Databases section of the Oracle Data Guard Overview page. orapwd file=$ORACLE_HOME/dbs/orapw$ORACLE_SID. Contains the observer runtime data file for the broker An observer is a separate OCI client-side component that run on a different computer from the primary and standby databases and monitors the availability of the primary database. SWITCHOVER command, and the databases are managed by Oracle
1810 Cedar Street Forest Hills, Durham,
Articles D