Lossless failover

This topic describes how to perform a lossless failover.

Procedure

1. Ensure that the primary cluster is unavailable, that is, all OBServers in the primary cluster are down.

   To ensure security, only one primary cluster can be deployed in the primary/standby cluster configuration. If the primary cluster is available, an error will be generated when you run the failover command on a standby cluster. Therefore, to ensure the successful execution of the failover command, you need to ensure that the primary cluster is unavailable before the failover.

2. Query the protection mode and protection level of each standby cluster, and select the target standby cluster to be switched to the primary role.

   obclient> SELECT PROTECTION_MODE, PROTECTION_LEVEL FROM V$OB_CLUSTER;
   +---------------------------+----------------------------+
   | PROTECTION_MODE        | PROTECTION_LEVEL         |
   +---------------------------+----------------------------+
   | MAXIMUM PROTECTION | MAXIMUM PROTECTION |
   +--------------------+--------------------+
   1 row in set
   

   Note

   • Only a standby cluster whose PROTECTION_MODE and PROTECTION_LEVEL are both MAXIMUM PROTECTION or MAXIMUM AVAILABILITY can be switched to the primary role. Otherwise, an error will be generated when you run the failover command.

   • If data in all partitions of the standby cluster is complete and consistent, you can add the FORCE keyword to the failover command to skip the protection mode and protection level check. For example, the failover command can be ALTER SYSTEM FAILOVER TO 'obcluster' CLUSTER_ID=2 FORCE;.

3. Run the following command to switch the standby cluster to the primary role without data loss.

   obclient> ALTER SYSTEM FAILOVER TO 'obcluster' CLUSTER_ID=2;
   

   By default, after the failover command is executed, the new primary cluster enters the maximum performance mode, and the original primary cluster and other standby clusters are in the DISABLED state and must be connected.

   • View the protection mode of the new primary cluster

     obclient> SELECT CLUSTER_ID, CLUSTER_ROLE, CLUSTER_STATUS, PROTECTION_MODE, PROTECTION_LEVEL FROM V$OB_CLUSTER;
     +------------+--------------+----------------+---------------------+---------------------+
     | CLUSTER_ID | CLUSTER_ROLE | CLUSTER_STATUS | PROTECTION_MODE            | PROTECTION_LEVEL             |
     +------------+--------------+----------------+---------------------+---------------------+
     |          2         | PRIMARY           | VALID                    | MAXIMUM PERFORMANCE | MAXIMUM PERFORMANCE |
     +------------+--------------+----------------+---------------------+---------------------+
     1 row in set
     

   • View the status of the original primary cluster and other standby clusters

     obclient> SELECT CLUSTER_ID, CLUSTER_ROLE, CLUSTER_STATUS FROM V$OB_STANDBY_STATUS;
     +------------+------------------+----------------+
     | CLUSTER_ID | CLUSTER_ROLE          | CLUSTER_STATUS |
     +------------+------------------+----------------+
     |          1          | PHYSICAL STANDBY  | DISABLED             |
     +------------+------------------+----------------+
     1 row in set
     

4. Trigger a major compaction. This step is optional.

   After a lossless failover is executed, we recommend that you trigger a major compaction for a cluster whose compaction version is 1, and add a new standby cluster after the major compaction is completed. Otherwise, the newly added standby cluster may malfunction, for example, fail to support switchover operations.