Change the primary/standby protection mode

By default, OceanBase Database V4.x uses the maximum performance protection mode for primary/standby tenants. To enhance the strong consistency capability of OceanBase Database primary/standby tenants (RPO = 0), OCP supports changing the protection mode for primary and standby tenants. You can refer to this section to change the protection mode for a primary tenant.

What is the primary/standby protection mode?

The primary/standby protection mode is a preset strategy that balances "data security" and "business availability." It determines the speed at which the standby database takes over and the level of data assurance when the primary database fails.

Different protection modes correspond to different levels of protection. A protection level indicates the level of assurance provided by the primary and standby systems for data security and availability in terms of data synchronization and disaster recovery. A higher level means more secure stored data, but may limit performance and business continuity; a lower level results in smoother system operation, but increases the risk of data loss.

Currently, OCP supports the following three protection modes:

• Maximum Performance: The lowest level of data protection, offering the best performance but risking loss of the latest data in case of a failure. In this mode, transactions can be committed without waiting for redo logs to be successfully persisted on both the primary and strongly synchronized standby databases. If the standby database is unavailable, the primary database does not stop writing services.
• Maximum Availability: A medium-level data protection that provides the highest level of data protection without sacrificing tenant availability. In this mode, transactions can be committed only after redo logs are successfully persisted on both the primary and strongly synchronized standby databases. When a failure is detected in the strongly synchronized standby database, the primary database stops waiting for strong log synchronization and prioritizes restoring its own service first, ensuring cluster availability. Once the strongly synchronized standby database resumes service, the primary database automatically reverts to strong synchronization mode to provide the highest level of data protection.
• Maximum Protection: The highest level of data protection, ensuring no data loss even if the primary database fails. In this mode, transactions can be committed only after redo logs are successfully persisted on both the primary and strongly synchronized standby databases. If the standby database is unavailable, the primary database stops writing services.

Prerequisites

• Ensure the current OCP user has the following permissions:

  • Cluster Maintenance or Tenant Maintenance resource permissions.
  • Permission to access the Overview menu for the tenant.

• Ensure the current tenant is a running primary tenant, and the cluster version of the primary tenant is [V4.4.2.1, V4.5.0.0) or [V4.6.2.0, ~).

• Ensure the primary and standby tenants are not in the same OceanBase cluster, and the synchronization method between them is Network Synchronization.

Considerations

• Before switching the primary/standby protection mode from a low level to a high level, ensure the synchronization latency between the primary and standby databases does not exceed 5 seconds. This limit can be configured using the system parameter ocp.standby.tenant.delay_threshold.
• Switching the primary/standby protection mode from a high level to a low level will cause a brief interruption in the primary tenant's service. It is recommended to perform this operation during off-peak hours and ensure all relevant parties have prepared contingency plans.
• In the one-primary-multiple-standby tenant mode, you can only change the protection mode for the standby tenants under the primary tenant. To change the protection mode for cascaded standby tenants, modify their synchronization configuration first.
• The system only supports setting the protection mode for the primary tenant with a network standby database to Maximum Availability or Maximum Protection.

Procedure

1. Log in to OCP.

2. In the left navigation bar, select Tenant. The system enters the Tenants tab by default.

3. On the Tenants page, find the target tenant and click its name to go to the tenant Overview page.

4. In the Primary/Standby Tenant Relationship section, click Change Primary/Standby Protection Mode.

5. In the dialog box that appears, select the standby tenant (only required in the one-primary-multiple-standby mode), choose the desired primary/standby protection mode, and click Save.