RMAN also copies the spfile and password files and you can change the values for individual parameters. If an application has called this function and it has received a status of SUCCESS, then the master observer attempts a fast-start failover. The connect descriptor must contain the SERVICE_NAME parameter in either case. Whenever possible, you should switch over to a physical standby database: If the switchover transitions a physical standby database to the primary role, then: The original primary database will be switched to a physical standby role. See Troubleshooting Problems During a Switchover Operation for more information. If the WAIT option is included in the required permissions, DGMGRL reports an error. Tasks that must be performed before and after a fast-start failover Then, on the Failover Confirmation page, click Yes to invoke the default Complete failover option. Stopping the observer does not disable fast-start failover. On the Oracle Data Guard Overview page in Cloud Control, select the standby database that you want to change to the primary role and click Failover. 1,000,000 block changes on a small set of blocks generates less Flashback Database history than 1,000,000 changes on a larger set of blocks. This list contains some recommendations to obtain better performance when using fast-start failover. Each database in a Data Guard configuration must have a unique name. The connect-identifier is a TNS alias defined in tnsnames.ora through which all instances of all databases in this Data Guard broker configuration can be reached. If fast-start failover is initiated, the master observer verifies the target standby database is ready to fail over to the primary database role. If the primary and target standby databases do not have network connectivity or if the database to which you are connected does not have network connectivity with the primary database, consider using DISABLE FAST_START FAILOVER with the FORCE option. See Oracle Data Guard Concepts and Administration for information about tuning the log apply rate for a physical standby database. Without the credentials, Broker will complete the role transition, but will leave the databases in need of a manual restart. alter database recover managed standby database finish; alter database activate standby database; Managed recovery process has been stopped between primary and standby database and standby becomes primary database. If it reconnects to the primary database before the standby agrees to fail over, then the master observer will stop attempting to initiate a fast-start failover. A manual failover is already in progress. Observers continuously monitor the fast-start failover environment to ensure the primary database is available (described in When Fast-Start Failover Is Enabled and the Observer Is Running). Setting this property to 'TRUE' (the default) causes the primary to self-terminate. This list describes how the overall Oracle Data Guard protection mode is handled after a manual failover (complete or immediate). Choosing the standby database with the smallest transport lag can minimize the amount of data loss and in some cases, incur no data loss at all. Create a pre-callout script, or a post-callout script, or both. This section describes how to configure an Oracle Net connect descriptor that meets this requirement. Step-B: Copy control file to temporary location on primary database. To help you select an appropriate switchover or failover target, use the following DGMGRL commands which perform checks on the database to determine its readiness to complete a role change. Then, click Continue to proceed to the next page. FastStartFailoverLagLimit configuration property. The subdirectories that DGMGRL creates under this directory will also have the If you expect the network to be disconnected for a long time and The mode can have one of the following values: DISABLED: Fast-start failover is disabled. We'll leave the other properties at their default values for the walkthrough, but you should become familiar with all of the Broker config and database properties. This can be compared to performing an RMAN restore of the datafiles from a backup taken prior to the specified SCN, but is much faster. exit. For Fast Connection Failover (FCF) to occur, a client must be able to locate the new primary database after a failover. observer name, host, whether it is the master observer, when it became the master This feature increases the availability of your database in the event of a disaster by reducing the need for you to perform a failover operation manually. Managed recovery process has been stopped between primary and standby database and standby becomes primary database. Use Cloud Control or DGMGRL to perform either a complete (recommended) or an immediate failover. LGWR is unable to write to any member of the log group because on an I/O error. Any broker configuration name that is referred to must exist in the configuration declaration section. milliseconds. Transitions the target standby database into the primary role, opens the new primary database in read/write mode, and starts redo transport services. Complete Failovers in Configurations Using Far Sync Instances. See "Database Service Configuration Requirements" for additional information about how the broker interacts with Oracle Restart. A single-instance database must be registered with Oracle Restart in order to publish FAN events via ONS. This lets you take advantage of the broker's Add the wallet location and override to sqlnet.ora. November 20, 2009. A number of prerequisites must be met on the primary in order to use Fast-Start Failover. The default group is all the configurations defined in the observer configuration file. Standby databases that are disabled during switchover, manual failover, or fast-start failover will not be automatically reinstated. In such a case, no attempt is made to transmit any unsent redo from the cascader to the terminal standby. You can enable fast-start failover from any site while connected to any database in the broker configuration. 11.2 rac servicefailover 2020-01-28 ORACLE ORACLE RAC/ASM RAC112. Using Shared Server (MTS) or connection pooling can result in unpredictable behavior. The name of the callout configuration file is fsfocallout.ora. lower detection times for primary database failures, you must Monitoring flashback database history and reacting when it drops below 30 minutes will save you time and improve availability. You can register up to four observers to monitor a single Data Guard broker configuration. In case of primary database failure, you will need to perform failover to transition the standby database to the primary role. If provided, then each group needs to have at least one broker configuration declared in the second part. This list describes restrictions when fast-start failover is enabled. To reenable broker management of these databases, you must reinstate or re-create the databases using one of the following procedures: If a database can be reinstated, the database will show the following status: Reinstate the database using the DGMGRL REINSTATE DATABASE command or the reinstate option in Cloud Control, as described in How to Reinstate a Database. Data guard Configuration details:- Login in to Standby Server:- Step:1 Check the database role and open_mode Select name,open_mode,database_role from v$database; In a Managed Instance with multiple databases in Azure we can have high availability. A switchover is a role reversal between the primary database and one of its standby databases. If local_listener is already in use, add the Data Guard listener to the list. You need to consider all of the options at the time you are building your Oracle Data Guard configuration, including factors such as the characteristics of physical standbys versus logical standbys versus snapshot standbys, the network latency to your standby database sites, the computing capabilities at a future primary database site, and so on. At this point, you can either: Disable fast-start failover (described in Disabling Fast-Start Failover) and attempt to open the former primary database, Manually reinstate the former primary database, as described in Reenabling Disabled Databases After a Role Change. through these services to exit or for the specified wait time Databases that have been disabled after a role transition are not removed from the broker configuration, but they are no longer managed by the broker. If you initiated a complete failover and it fails, you might need to use immediate failover. Use the SHOW CONFIGURATION BystandersFollowRoleChange command to see the value of this property. Verify there are no active users connected to the databases. VALIDATE Issue the following commands on Primary database and Standby database to find out: SQL> ALTER DATABASE COMMIT TO SWITCHOVER TO PRIMARY; Another standby database that does not have connectivity with the primary database, fast-start failover is disabled for this database. This allows for redundancy in your Data Guard observer setup as well. STOP OBSERVING [cfg_group_name] stops LOCAL observers running on this host (where this DGMGRL is running) for all broker configurations in a specified group. It is then configured to be active in the PHYSICAL_STANDBY role on the physical standby database SOUTH. times that the observer retries a failed ping before it initiates a Set the FastStartFailoverThreshold property to specify the number of seconds you want the observer and target standby database to wait (after detecting the primary database is unavailable) before initiating a failover. Read-Only Standby and Active Data Guard Disable fast-start failover using the DGMGRL DISABLE FAST_START FAILOVER command. Verify the primary database instance is open. Each observer has its own log file. FSFO can also be used with logical standbys and an FSFO-enabled configuration may have multiple standbys with a mix of physical and logical, but only one standby can be the failover target at any given time. This section describes how to configure and verify each prerequisite. In a separate terminal session, verify the configuration. If the A normal shutdown uses SHUTDOWN NORMAL, SHUTDOWN IMMEDIATE, or SHUTDOWN TRANSACTIONAL. While Oracle 11g's Data Guard definitely protects a database when the entire production site is lost via its failover capabilities, it's still necessary for an Oracle DBA to intervene to complete the failover process. See Disabling Fast-Start Failover. fsfocallout.ora. The primary database, it attempts to disable fast-start failover on as many databases in the configuration with which it has a network connection. This is because the -role qualifier is taken into account only by Data Guard broker, and at database startup. They must be re-created before they can serve as standby to the new primary database. Were sorry. FastStartFailoverLagLimit property. In the restore stage, Flashback Database restores the database to a point prior to the standby_became_primary_scn using the before-image blocks in the Flashback Database logs. Then, on the Fast-Start Failover Configure page, select the standby database that should be the target of a failover. 1 second. By default, both files are stored in $ORACLE_HOME/dbs. They must be re-created from a copy of the new primary database. In order to fully automate switchover, Broker needs SYSDBA credentials in order to restart one or both databases. Data Guard broker does not manage or store credentials. Prepare the primary database in advance for its possible future role as a standby database in the context of the overall protection mode (see Managing Data Protection Modes). Click Failover. ensure that it has the required permissions. After a complete failover finishes, any bystander standby database that is not viable as a standby for the new primary database will be disabled by the broker. There can be up to four It could optionally also be removed from the primary database if there is no intention to ever run this service on the current primary database. The Oracle Database 11g observer can make use of specific credentials, allowing the same wallet to be used for multiple observers with different SYS passwords. In this case, Flashback Database cannot be used to reinstate databases. required permissions, the admin folder is created On Linux/Unix, the directory specified by the DG_ADMIN environment To maintain a viable disaster-recovery solution in the event of another disaster, you may need to perform additional steps. Alternatively, you can query the V$DATABASE view on the target standby database. If that metadata is pushed out, Oracle can no longer find a fuzzy snapshot so it will not be able to flash back. By default, a fast-start failover is done when both the observer and the standby cannot reach the primary after the configured time threshold (FastStartFailoverThreshold) has passed. If no value is specified for the This method will disable fast-start failover on all databases in the broker configuration. In Oracle Database 11g, the password file on the standby must be a physical copy of the password file on the primary due to security enhancements introduced in Oracle Database 11g. If you re-create the old primary database, it must be created as the standby type of the old standby database. To stop the observer, see Stopping the Observer. from another DGMGRL session. Startup can fail with "ORA-16647: could not start more than one observer" even when no observer is actually running if the previous observer process terminated without deregistering itself and the new observer isn't using the previous fsfo.dat file. You can use Cloud Control or DGMGRL, to perform either a complete (recommended) or an immediate failover. RMAN will copy the spfile from the primary, so this init.ora file is only needed during the first phase of the duplication. The syntax for the configuration declaration is: The definition for each broker configuration is: The configuration-name can be different from the name defined in the metadata of the Data Guard Broker configuration. Broker will set the primary to use asynchronous log transport by default. After the conversion, the broker will start Redo Apply to apply accumulated redo data, before failing the database over to the primary role. The target standby database is synchronized with the primary database if it is a configuration operating in maximum availability or maximum protection mode, or the target standby database is within the lag limit if it is a configuration operating in maximum performance mode. You can also reinstate bystander standby databases that were disabled during a failover operation. (See Disabling Fast-Start Failover for important considerations when using the FORCE option.). When both databases have been restarted, you may restart the observer. SQL Apply on all other bystander standby databases automatically begin applying redo data received from the new primary database. Relationship Between Primary, Target Standby, and Observer During Fast-start Failover. The string "NONAME" cannot be used as an observer name. connectivity with target standby. ERROR: Unable to verify the graphical display setup. stored in the specified path using the default file names. You must provide a connect identifier, through which one or more databases in a specific broker configuration can be reached. flashback logs on that database. All Data Guard environments should enable force logging at the database level in order to guard against nologging tablespaces from being added. The new ConfigurationWideServiceName configuration property can be used to simplify setting up this connect identifier. Fast-start failover is enabled, but this standby database is not the target of the fast-start failover. You might, for instance, use this to allow the observer to monitor the databases using the same connect identifiers as the client applications. occurred to the target standby database prior to disabling fast-start To specify which observer can be a master observer when a database is in Failover automation ensures a seamless transition from the primary database to a synchronized standby database in cases of failure, while ensuring database availability by replaying uncommitted in-flight transactions. You can use the maximum protection, maximum availability, or maximum observers are registered, a directory named You must re-create the database manually from a copy of the current primary database and then reenable the database in the broker configuration. In order to maintain separation of Broker and non-Broker activity, a second static service is recommended. If you have not used the SET ObserverConfigFile command after starting the current DGMGRL client, then the result will always be: ObserverConfigFile=observer.ora. When running the START 2. 3. An observer is an OCI The target standby database when it does not have connectivity with the primary database, fast-start failover is disabled only on the target standby database. When this property is set to NONE, the broker will disable all bystander standby databases without checking whether they have applied more redo data than the new primary database. Oracle Data Guard Concepts and Administration provides information about setting up the databases in preparation of a switchover. An observer is a separate OCI client-side component that run on a different computer from the primary and standby databases and monitors the availability of the primary database. The following conditions apply when multiple observers are registered for one configuration: When fast-start failover is enabled, one of the observers is the master observer. The observe-only mode for fast-start failover enables you to test how fast-start failover will work in your environment. directory specified by this variable does not exist, or the directory does not have the This results in the observer establishing a new connection to the primary database every 30 seconds. If a failure occurs once a reinstatement operation (automatic or manual) is underway, the broker logs the appropriate information in the broker configuration files and broker log files. The old Primary must have been running in flashback mode before the failover. issue commands and interact with the broker configuration. SQL>select sequence#, applied from v$archived_log; environment variable is set and the specified directory has the Observers should be installed and run on a computer system that is separate from the primary and standby systems. You can query the V$DATABASE view to verify that the observer is started and the configuration is ready for fast-start failover. If fast-start failover is Instead, when broker notifies the Oracle However failing over to a snapshot standby database will require more time because the broker must first convert it back to a physical standby database. The general approach seems to be CDB level failover to standby , so the failover takes place at CDB to CDB , in an event where a single PDB is experiencing an issue , we will have to failover the whole instance ..this will impact all PDB's on the CDB. Use the 'show fast_start failover' command to see which user configurable FSFO failover conditions are in effect. It automatically sets Data Guard related database initialization parameters on instance start and role transitions, starts apply services for standbys, and automates many of the administrative tasks associated with maintaining a Data Guard configuration. Otherwise, the DUPLICATE TARGET DATABASE command will fail with "RMAN-20208: UNTIL CHANGE is before RESETLOGS change". To verify the readiness of the fast-start failover configuration, issue the DGMGRL SHOW CONFIGURATION VERBOSE command or the SHOW FAST_START FAILOVER command on the primary database. There are normally two situations when this operation will be performed: a planned outage for maintenance of the primary database or disaster recovery. For example, if the limit specified is 30 seconds (the default), FSFO guarantees that all transactions that committed prior to 30 seconds ago are preserved during failover. If fast-start failover is enabled, then a switchover can be performed only to the pre-specified target standby database and only if the standby database is synchronized with the primary database or is within the configured lag limit, for the max availability and max performance modes respectively. Broker stores it configuration information in a mirrored set of files outside the database. All standbys other than the failover target are considered bystanders (v$database.fs_failover_status = 'BYSTANDER'). If you don't already have a Flash Recovery Area (FRA), you will need to create one for Flashback Database. It's secondary job is to automatically reinstate a failed primary as a standby if that feature is enabled (the default). Before enabling fast-start failover in data guard broker, the only required precondition is enabling Flashback Database. 1. At a minimum, you must set db_unique_name. A complete failover also attempts to avoid disabling any standby databases that were not the target of the failover, so that they may continue serving as standby databases to the new primary database.