Re: Best Practice
Date: Thu, 19 Jan 2012 17:29:21 +0200
Message-ID: <OF7A11128B.702DAABD-ONC225798A.004F6C04-C225798A.005514A3_at_seb.lt>
>I think I will put the OBSERVER in one of application servers in the DC - A ( Data Center A) where the primary database is running in another host 1 in the DC - A. Another OBSERVER stopped in the DC - B.
we did it opposite: we assume that if primary DC(whole data center) dies
then another DC must take up.
I.e. according to our assumptions the observer runs on standby DC which IS
accessible to user requests. If primary functions then all is well. If
primary fails then standby takes over.
If observer would be on primary DC and primary DC fails then who's going to
fail over ?
But as I already mentioned: in our case observer may force a completely
healthy primary DB to shutdown if standby DC looses all network connections
to the outside world.
Even more: the observer will failover to standby which is cut from the
outside world. Then even if Human Observer knows the primary site is ok and
well still you can not start primary because you risk a split brain.
That's why oracle asks you to install observer on "a computer system that is separate from the primary and standby systems". Note the wording: a computer SYSTEM.
The Observer must observer "from above :) " which DC is available and then
attempt a failover if primary has problems and standby is still accesible.
If only Observer's site goes down then you lose only FSF. Then you rush and
fix it. Something like that :)
If any DC loses connection to the outside world (from which Observer
observes you :) ) then observer is capable of making the correct decision:
it will not fail over to standby if standby is cut off from the outside
world. It will not go down together with primary and disable FSF
alltogether.
Now where in the network topology is the "Outside World" you put your
Observer into ?)
IMHO, in the same world as your most important end users are reaching you
DC's from.?)
Hope my logic is logical enough...
Brgds, Laimis N
Please consider the environment before printing this e-mail:
|------------>
| From: |
|------------>
>---------------------------------------------------------------------------------------------------------------------------------------------| |mek s <sidi.bouzid.meknessy_at_gmail.com> | >---------------------------------------------------------------------------------------------------------------------------------------------|
|------------>
| To: |
|------------>
>---------------------------------------------------------------------------------------------------------------------------------------------| |Marcin Przepiorowski <pioro1_at_gmail.com>, Laimutis.Nedzinskas_at_seb.lt | >---------------------------------------------------------------------------------------------------------------------------------------------|
|------------>
| Date: |
|------------>
>---------------------------------------------------------------------------------------------------------------------------------------------| |2012.01.19 15:14 | >---------------------------------------------------------------------------------------------------------------------------------------------|
|------------>
| Subject: |
|------------>
>---------------------------------------------------------------------------------------------------------------------------------------------| |Re: Best Practice | >---------------------------------------------------------------------------------------------------------------------------------------------|
Interesting point; running the OBSERVER where are your end users.
I think I will put the OBSERVER in one of application servers in the DC - A ( Data Center A) where the primary database is running in another host 1 in the DC - A. Another OBSERVER stopped in the DC - B.
When there is a fail over, the Standby database running in DC - B will be the primary and automatically the OBSERVER running in the DC -A will be stopped and the OBSERVER in the DC - B will be started. What do you think? Is it possible to do it?
- Forwarded message ---------- From: Marcin Przepiorowski <pioro1_at_gmail.com> Date: Thu, Jan 19, 2012 at 12:10 PM Subject: Re: Best Practice To: Laimutis.Nedzinskas_at_seb.lt Cc: ORACLE-L <oracle-l_at_freelists.org>
On Thu, Jan 19, 2012 at 10:08 AM, <Laimutis.Nedzinskas_at_seb.lt>
wrote:
> We had an interesting case: a network failure between our DC's
(data
> centers - one is used as primary and the other as standby as far as
> databases are concerned)
>
>
> In our case observer runs on standby DC. It decided to failover of
course.
> The decision happened to be the correct one at least from admins
point of
> view: the failover DC was still accessible to us, we could connect
and
> restart what failed to failover, etc. End users could connect too.
It makes sens - if you use FSFO and primary database will loose
connection to standby database and to observer it will shutdown
automatically preventing environment from split brain when primary DC
will be available again.
>
> You see: you need to consider what end customer functionality needs
HA most
> and start from that. What's the purpose to have a failover if the
DC is not
> accesible to the end users?
>
> If only isolated db/db server failure is concerned then you can run
your
> observer on just a standby server. It will do the job: primary goes
down,
> observer is running on standby, standby fails ower.
>
Is is possible to run observer in same place where are your end users
? It that case observer will see exactly same situation
like your users.
regards,
--
Marcin Przepiorowski
http://oracleprof.blogspot.com.
--
http://www.freelists.org/webpage/oracle-l
-- http://www.freelists.org/webpage/oracle-lReceived on Thu Jan 19 2012 - 09:29:21 CST