4 Managing the Members of a Broker Configuration

4.2.1 Database State Transitions

You can use the DGMGRL EDIT DATABASE command to explicitly change the state of a database. For example, the EDIT DATABASE command in the following example changes the state of the North_Sales database to TRANSPORT-OFF.

DGMGRL> EDIT DATABASE 'North_Sales' SET STATE='TRANSPORT-OFF';
Succeeded.

The following sections describe in more detail the possible state transitions for primary and standby databases.

Primary database state transitions

When transitioning the primary database to the TRANSPORT-ON state, the broker sets up redo transport services using the redo transport-related properties of the configuration members and the RedoRoutes property at the primary database. (See Section 4.4 for the list of redo transport-related properties and Section 4.4.3 for a description of the RedoRoutes property.) Redo transport services setup is done by setting the LOG_ARCHIVE_DEST_n and LOG_ARCHIVE_DEST_STATE_n initialization parameters on the primary database, and the LOG_ARCHIVE_CONFIG initialization parameter on all databases (primary or standby) and far sync instances. If necessary, the broker also sets up the data protection mode of the database to match the protection mode recorded in the broker configuration file. Finally, if the database is open, the broker switches a log for each thread to initiate redo transport services.

When transitioning the primary database to the TRANSPORT-OFF state, the broker turns off redo transport services to all broker-managed standbys by resetting the LOG_ARCHIVE_DEST_STATE_n initialization parameter. Transmission of redo data to all broker-managed standbys is stopped. Log files continue to be archived at the primary database.

If the primary database is an Oracle RAC database, the broker configures redo transport services on all primary instances with the exact same settings.

Physical standby database state transitions

When transitioning a physical standby database to the APPLY-ON state, the broker starts Redo Apply with options specified by the Redo Apply-related properties (see Section 4.5 for the property list). If the standby is an Oracle RAC database, the broker starts Redo Apply on one standby instance, called the apply instance.

If a license for the Oracle Active Data Guard option has been purchased, a physical standby database can be open while Redo Apply is active. This capability is known as real-time query. See Oracle Data Guard Concepts and Administration for more details.

When transitioning to the APPLY-OFF state, the broker stops Redo Apply.

Logical standby database state transitions

When transitioning a logical standby database to the APPLY-ON state, the broker will wait until the database is open, and then enable the database guard to prevent modifications to tables in the logical standby database, and start SQL Apply with options specified by the log apply-related properties. If the logical standby database is an Oracle RAC database, the broker starts SQL Apply on one standby instance, the apply instance.

When transitioning to the APPLY-OFF state, the broker stops SQL Apply.

4.3.1 Monitorable (Read-Only) Properties

Monitorable properties allow you to view information related to a configuration member, but you cannot change the values of these properties. These properties can be very helpful when you are trying to diagnose problems in the broker configuration. For example, you can view the InconsistentLogXptProps monitorable property to determine where there is a discrepancy in redo transport services properties between the broker configuration file and the actual value currently used by the database.

You can list all monitorable properties using the DGMGRL SHOW DATABASE VERBOSE command. Use the SHOW DATABASE command to obtain more details about a particular property. For example, the following shows the InconsistentLogXptProps property:

DGMGRL> SHOW DATABASE 'North_Sales' 'InconsistentLogXptProps';

INCONSISTENT LOG TRANSPORT PROPERTIES

 INSTANCE_NAME     STANDBY_NAME  PROPERTY_NAME  MEMORY_VALUE  BROKER_VALUE 
  south_sales1      South_Sales     ReopenSecs           600           300

Cloud Control displays the information obtained from these properties on the Edit Properties page.

4.3.2 Configurable (Changeable) Properties

Configurable properties affect the operation or configuration of a database or far sync instance. When you use DGMGRL or Cloud Control to create a primary database and import existing standby databases and far sync instances into a new broker configuration, the property values are initially imported from the database or far sync instance settings.

You can update many property values when a configuration member is either disabled or enabled. When a new member is added into the configuration, the broker connects to that member and imports initial values for the member's properties from the current member settings. For example:

DGMGRL> SHOW DATABASE 'North_Sales' 'ArchiveLagTarget';
  ArchiveLagTarget = '0'

DGMGRL> EDIT DATABASE 'North_Sales' SET PROPERTY 'ArchiveLagTarget'=1200;
  Property "ArchiveLagTarget" updated

DGMGRL> SHOW DATABASE 'North_Sales' 'ArchiveLagTarget';
  ArchiveLagTarget = '1200'

When the configuration is enabled, the broker keeps member property values in the broker configuration file consistent with the values being used by the member. For those that are related to initialization parameter properties, the broker maintains consistency among the value in the broker configuration file, the current value, and the initialization parameter value in the server parameter file, as follows:

• For dynamic parameters, the broker keeps the value of the parameter consistent in the system global area (SGA) for the instance, in the broker configuration file, and in the server parameter file.

• For static parameters and properties, the parameter value in the system global area (SGA) for the instances may temporarily differ from what is in the broker configuration file and in the server parameter file. Typically, the in-memory value becomes the same as the server parameter file value and the broker configuration file value the next time the instance is stopped and restarted.

Even when the configuration is disabled, you can update property values through the broker. The broker retains the property settings (without validating the values) and updates the initialization parameters in the server parameter file and the settings in memory the next time you enable the broker configuration.

4.4.1 Setting Up For Redo Transport

Redo data is transported to a standby database using Oracle Net. An Oracle Net service name is specified with the SERVICE attribute of the LOG_ARCHIVE_DEST_n initialization parameter and is used to transmit redo data to the standby database. The Oracle Net service name is translated into a connect descriptor that contains the information necessary for connecting to the standby database.

The SERVICE attribute can be set or changed by using the DGConnectIdentifier database property. The DGConnectIdentifier property is set when a database is first added to the configuration. Its initial value is the connect identifier that is specified in the optional CONNECT IDENTIFIER IS clause of the ADD DATABASE command.

The DGConnectIdentifier property value is also used to set up the FAL_SERVER initialization parameter. If the DGConnectIdentifier property for any database is changed, the SERVICE attribute of the corresponding LOG_ARCHIVE_DEST_n initialization parameter will also be changed. In addition, the FAL_SERVER initialization parameter will also be updated on every enabled standby database in the configuration.

4.4.2 Managing Redo Transport Services for Data Protection Modes

Section 4.6 describes how the broker handles data protection modes. As a part of the overall configuration protection mode, you must ensure that redo transport services are also properly set up for the data protection mode that you choose.

You use the LogXptMode or RedoRoutes database properties to set the SYNC, ASYNC, or FASTSYNC mode for redo transport services. See Table 4-2 for additional information about protection modes and redo transport services.

The following redo transport modes are supported:

SYNC

Configures redo transport services for this standby database using the SYNC and AFFIRM attributes of the LOG_ARCHIVE_DEST_n initialization parameter. This mode, along with standby redo log files, is required for configurations operating in either maximum protection mode or maximum availability mode. This redo transport service enables the highest grade of data protection to the primary database, but also can incur a higher performance impact.

ASYNC

Configures redo transport services for this standby database using the ASYNC and NOAFFIRM attributes of the LOG_ARCHIVE_DEST_n initialization parameter. This mode, along with standby redo log files, enables a moderate grade of protection to the primary database, and lower performance impact.

FASTSYNC

Configures redo transport services for this standby database using the SYNC and NOAFFIRM attributes of the LOG_ARCHIVE_DEST_n initialization parameter. This mode is only available in maximum availability protection mode.

4.4.3 Advanced Redo Transport Settings

By default, a primary database sends its redo to every possible redo transport destination in the configuration. You can use the RedoRoutes property to create a more complex redo transport topology, such as one in which a physical standby or a far sync instance forwards redo received from the primary database to one or more destinations, or one in which the redo transport mode used for a given destination is dependent on which database is in the primary role.

The RedoRoutes property is set to a character string that contains one or more redo routing rules, each contained within a set of parentheses, as follows:

(redo_routing_rule_1) [(redo_routing_rule_n)]

A redo routing rule contains a redo source field and a redo destination field separated by a colon:

(redo source : redo destination)

The redo source field must contain the keyword LOCAL or ANY, or a comma-separated list of DB_UNIQUE_NAME values, as follows:

{LOCAL | ANY | db_unique_name_1,[,db_unique_name_n]}

• The LOCAL keyword is an alias for the local database name. This keyword cannot be used at a far sync instance.

• The ANY keyword is an alias for any database in the configuration.

• A database cannot be specified as a redo source in more than one redo routing rule defined at a given database, either explicitly or implicitly through use of the LOCAL keyword.

The redo destination field must contain the keyword ALL or a comma-separated list of database names, each of which can be followed by an optional redo transport attribute:

{ALL [attribute] | db_unique_name_1 [attribute] [,db_unique_name_n [attribute]]}

• The ALL keyword is an alias for all possible destinations in the configuration.

The optional redo transport attribute specifies the redo transport mode to be used to send redo to the associated destination. It can have one of three values:

[ASYNC | SYNC | FASTSYNC]

If the redo transport attribute is not specified, then the transport mode used will be the one specified by the LogXptMode property for the redo destination.

The optional ALT keyword is used to specify the DB_UNIQUE_NAME of an alternate redo destination that is to receive redo if redo transport to the non-alternate destination is not possible:

[ALT=(alternate db_unique_name [ASYNC | SYNC | FASTSYNC] [FALLBACK])]

The optional FALLBACK keyword is used to specify that redo transport to the non-alternate member should be resumed if it becomes available. Oracle recommends that you use the FALLBACK keyword. If you omit it and the ALTERNATE redo destination subsequently fails, no redo will be shipped to the terminal standby databases serviced by the alternate destination.

The following usage notes apply regarding advanced redo transport settings:

• The RedoRoutes property has a default value of NULL, which is treated as (LOCAL : ALL) at a primary database.

• A redo routing rule is active if its redo source field specifies the current primary database. If a rule is active, primary database redo is sent by the database at which the rule is defined to each destination specified in the redo destination field of that rule.

• The ASYNC redo transport attribute must be explicitly specified for a cascaded destination to enable real-time cascading to that destination.

• The RedoRoutes property cannot be set on a logical or snapshot standby database.

• The RedoRoutes property can be set for a logical standby database only if the redo destination field is set to LOCAL.

• The non-alternate member must have a non-zero value for its MaxFailure configurable property in order for an alternate to be specified.

DGMGRL> EDIT DATABASE 'North_Sales' SET PROPERTY 'RedoRoutes' = '(LOCAL : Local_Sales SYNC)';
DGMGRL> EDIT DATABASE 'Local_Sales' SET PROPERTY 'RedoRoutes' = '(North_Sales : Remote_Sales ASYNC)';

DGMGRL> SHOW CONFIGURATION;
 
Configuration - Sales_Configuration
 
  Protection Mode: MaxAvailability
  Databases:
  North_Sales  - Primary database
    Local_Sales  - Physical standby database
      Remote_Sales  - Physical standby database (receiving current redo)
 
Fast-Start Failover: DISABLED
 
Configuration Status:
SUCCESS

DGMGRL> EDIT DATABASE 'Local_Sales' SET PROPERTY 'RedoRoutes' = '(North_Sales : Remote_Sales)';

DGMGRL> EDIT DATABASE 'Local_Sales' SET PROPERTY 'MaxFailure' = 1;
Property "MaxFailure" updated
 
DGMGRL> EDIT DATABASE 'North_Sales' SET PROPERTY 'RedoRoutes' = 
'(LOCAL : Local_Sales ASYNC ALT=(Remote_Sales ASYNC FALLBACK))';
Property "RedoRoutes" updated
 
DGMGRL> EDIT DATABASE 'Local_Sales' SET PROPERTY 'RedoRoutes' = 
'(North_Sales : Remote_Sales ASYNC)';
Property "RedoRoutes" updated

DGMGRL> SHOW CONFIGURATION;
 
Configuration - Sales_Configuration
 
  Protection Mode: MaxPerformance
  Databases:
  North_Sales    - Primary database
    Local_Sales  - Physical standby database
      Remote_Sales - Physical standby database
Fast-Start Failover: DISABLED
 
Configuration Status:
SUCCESS

DGMGRL> SHOW CONFIGURATION VERBOSE;
 
Configuration - Sales_Configuration
 
  Protection Mode: MaxPerformance
  Members:
    North_Sales - Primary database
      Local_Sales - Physical standby database
        Remote_Sales - Physical standby database
      Remote_Sales - Physical standby database (alternate of Local_Sales)
 
  Properties:
    FastStartFailoverThreshold     = '30'
    OperationTimeout               = '30'
    TraceLevel                     = 'USER'
    FastStartFailoverLagLimit      = '30'
    CommunicationTimeout           = '180'
    ObserverReconnect              = '0'
    FastStartFailoverAutoReinstate = 'TRUE'
    FastStartFailoverPmyShutdown   = 'TRUE'
    BystandersFollowRoleChange     = 'ALL'
    ObserverOverride               = 'FALSE'
    ExternalDestination1           = ''
    ExternalDestination2           = ''
    PrimaryLostWriteAction         = 'CONTINUE'
 
Fast-Start Failover: DISABLED
 
Configuration Status:
SUCCESS

4.4.4 Turning Redo Transport Services On and Off

Turn redo transport services on and off by setting the state of the primary database. Setting the primary database state to TRANSPORT-ON starts redo transport services at the primary database, and setting the primary database state to TRANSPORT-OFF stops redo transport services at the primary database.

Turn redo transport services on and off to an individual standby database using the LogShipping database property on the standby database. The LogShipping property accepts values ON and OFF. If you set the LogShipping property to OFF for a standby database, redo transport services to this standby database are turned off, while redo transport services to other databases are not affected. You can set LogShipping to ON to turn back on redo transport services to the standby database.

The relationship between setting the primary database state and setting the LogShipping property is as follows:

• If the primary database state is set to TRANSPORT-OFF, redo transport services to all the standby databases are stopped regardless of the LogShipping property values of the individual standby databases.

• If the primary database state is set to TRANSPORT-ON, redo transport services to each standby database are determined by the LogShipping property of that database.

Example 4-4 and Example 4-5 show how to turn off redo transport services in two different scenarios.

DGMGRL> EDIT DATABASE 'North_Sales' SET STATE='TRANSPORT-OFF';
DGMGRL> SHOW DATABASE 'North_Sales';
 
Database - North_Sales
 
  Role:            PRIMARY
  Intended State:  TRANSPORT-OFF
  Instance(s):
    north_sales1
 
Database Status:
SUCCESS

DGMGRL> EDIT DATABASE 'South_Sales' SET PROPERTY 'LogShipping'='OFF';
Property "LogShipping" updated

DGMGRL> SHOW DATABASE 'South_Sales' 'LogShipping';
  LogShipping = 'OFF'

4.4.5 Specifying Locations for Archived Redo Log Files

You can set up locations on the standby database to store the archived redo log files to be used by log apply services on the standby database. This is done by setting the StandbyArchiveLocation and AlternateLocation database properties on the standby database.

StandbyArchiveLocation specifies a standby location where the archived redo log files will be stored. The broker only uses the location to store archived redo log files received from the primary database. For archived redo log files generated locally when the database is either the primary database or a logical standby database, you need to set up local destinations directly through the LOG_ARCHIVE_DEST_n initialization parameter. The broker allows the value of StandbyArchiveLocation to be the same as the location you set up for locally generated logs, in which case the broker sets up the VALID_FOR attribute of the destination appropriately so that it can be used for both the archived redo log files received from the primary database and archived redo log files generated locally.

You can also set up an alternate location to store archived redo log files on the standby using the AlternateLocation property on the standby database. This is useful for avoiding disk capacity problems or disk errors when archiving primary redo at the standby database. AlternateLocation specifies a standby location where the archived redo log files will be stored if the location specified by the StandbyArchiveLocation fails. The broker sets up the alternate location properly using the ALTERNATE attribute of the LOG_ARCHIVE_DEST_n initialization parameter.

4.4.6 Other Redo Transport Settings

You can use the Binding, MaxFailure, MaxConnections, NetTimeout, RedoCompression, and ReopenSecs database properties to tune the performance of redo transport services and to set up redo transport services failure policies. These properties correspond to attributes on the LOG_ARCHIVE_DEST_n initialization parameter.

4.4.7 Redo Transport Services in an Oracle RAC Database Environment

If the primary database is an Oracle RAC database, the broker ensures that redo transport services are set up identically on each of the primary database instances. Each instance has the same remote destinations, and for each remote destination, all instances are set up the same in terms of redo transport service, performance related settings, and so on. If an instance has different settings, the broker raises a health check warning on that particular instance

Settings relative to redo transport services are saved in the broker configuration file as properties. When you update a redo transport-related property on a standby database, the corresponding change is also made automatically by the broker to the LOG_ARCHIVE_DEST_n initialization parameter on all of the primary database instances. If a new instance comes up on the primary database, the broker sets up redo transport services for the new instance using the redo transport-related properties of all the standby databases currently being managed by the broker. After the new instance is opened for activity, all archived redo log files generated on this instance will begin to transmit to the standby databases.

4.4.8 Transport Lag

Transport lag is a measure of the degree to which the transport of redo to the standby database lags behind the generation of redo on the primary database.

If there are one or more redo gaps on the standby database, the transport lag is calculated as if no redo has been received after the beginning of the earliest redo gap.

Both Cloud Control and the DGMGRL client display the redo transport lag for each managed standby database. Cloud Control displays the transport lag on the Oracle Data Guard home page. The DGMGRL client displays the transport lag in the SHOW DATABASE output for a standby database. There is no transport lag displayed for a primary database. For example:

DGMGRL> show database 'South_Sales';
 
Database - South_Sales
 
  Role:            PHYSICAL STANDBY
  Intended State:  APPLY-ON
  Transport Lag:   0 seconds (computed 0 seconds ago)
  Apply Lag:       0 seconds (computed 0 seconds ago)
  Apply Rate:      255.00 KByte/s
  Real Time Query: OFF
  Instance(s):
    south_sales1
 
Database Status:
SUCCESS

The transport lag can help you identify any problems that may exist with the redo transport services.

You can set the TransportLagThreshold database configurable property to generate a health check warning when the transport of redo data to the standby database lags behind the generation of redo data on the primary database.

The following command sets the TransportLagThreshold property to 15 seconds:

DGMGRL> EDIT DATABASE 'South_Sales' SET PROPERTY 'TransportLagThreshold'=15;
Property TransportLagThreshold updated

Additionally, you can set the TransportDisconnectedThreshold database configurable property to generate a health check warning if the standby finds that it has not had any redo transport-related communication with the primary database. The property has a default value of 30 seconds.

The following command sets the TransportDisconnectedThreshold property to 15 seconds:

DGMGRL> EDIT DATABASE 'South_Sales' SET PROPERTY 'TransportDisconnectedThreshold'=15;
Property TransportDisconnectedThreshold updated

4.5.1 Managing Delayed Apply

You can set up Apply Services so that the application of redo to the standby database is delayed. This allows the standby database to lag behind the primary database, and if a user error (for example, dropping a table) occurs during this window of time, the standby database will still contain the correct data that can be transmitted back to the primary database to repair the data.

By default, no delay is configured and the redo data is applied on a standby database as soon as possible. If the standby database has standby redo logs configured, the broker will enable real-time apply. When Redo Apply and SQL Apply apply redo in real time, the redo data is recovered directly from the standby redo log files as they are being filled. This means that the standby database does not have to wait for the log files to be archived before applying redo data from the archived redo log files. This minimizes the transactional lag between the primary and the standby.

Use the DelayMins database property to specify the number of minutes that log apply services must wait before applying redo data to the standby database. Note that only log apply services on the standby database are delayed. Redo transport services on the primary database are not delayed, thus the primary database data is still well protected by the standby database.

4.5.2 Managing Parallel Apply with Redo Apply

For Redo Apply, you can configure whether multiple parallel processes are used to apply redo data received from the primary database by using the ApplyParallel database property. Parallelism is enabled by default, which means Redo Apply automatically chooses the optimal number of parallel processes based on the number of CPUs in the system. (This is equivalent to setting the ApplyParallel property to AUTO.) You can disable parallelism by setting the ApplyParallel property to NO.

4.5.3 Allocating Resources to SQL Apply

You can control how much SGA memory is available for SQL Apply. This can be set using the LsbyMaxSga database property.

To control the number of parallel query servers used by SQL Apply, you can use the LsbyMaxServers database property.

You can control the trade off between SQL Apply performance and the commit order of transactions. The LsbyPreserveCommitOrder database property controls whether transactions are committed on the logical standby database in the exact same order in which they were committed on the primary database. Preserving commit order may affect performance.

4.5.4 Managing the DBA_LOGSTDBY_EVENTS Table

The DBA_LOGSTDBY_EVENTS table records important events that affect SQL Apply. Because every logical standby database might have a different interest in the set of events to be recorded in this table, Oracle Data Guard provides a means to control the event recording. From the Oracle Data Guard broker, you can use the LsbyRecord* database properties (for example, LsbyRecordSkipDdl or LsbyRecordSkipErrors) to control recording of a particular set of events. The value of these properties are either TRUE or FALSE, indicating the turning on or off of the event recording.

4.5.5 Apply Services in an Oracle RAC Database Environment

If a standby database is an Oracle RAC database, only one instance of the Oracle RAC database can have log apply services running at any time. This instance is called the apply instance. If the apply instance fails, the broker automatically moves log apply services to a different instance; this is called apply instance failover.

4.5.6 Apply Lag

Apply lag is a measure of the degree to which the data in a standby database lags behind the data in the primary database, due to delays in propagating and applying redo to the standby database.

Both Cloud Control and the DGMGRL client display the apply lag for each managed standby database. Cloud Control displays the apply lag on the Oracle Data Guard home page. The DGMGRL client displays the apply lag in the SHOW DATABASE output for a standby database. There is no apply lag displayed for a primary database. For example:

show database 'South_Sales';
Database - South_Sales
 
  Role:            PHYSICAL STANDBY
  Intended State:  APPLY-ON
  Transport Lag:   0 seconds (computed 0 seconds ago)
  Apply Lag:       0 seconds (computed 0 seconds ago)
  Apply Rate:      255.00 KByte/s
  Real Time Query: OFF
  Instance(s):
    south_sales1
 
Database Status:
SUCCESS

The apply lag can help you identify any problems that may exist with both the redo transport services and the log apply services.

You can set the ApplyLagThreshold database configurable property to generate a health check warning when a standby database lags behind the data in the primary database.

The following command sets the ApplyLagThreshold property to 15 seconds:

DGMGRL> EDIT DATABASE 'South_Sales' SET PROPERTY 'ApplyLagThreshold'=15;
Property ApplyLagThreshold updated

4.6.1 Setting the Protection Mode for Your Configuration

To set the protection mode, perform the following steps:

Step 1   Determine which data protection mode you want to use.

Each data protection mode provides a different balance of data protection, data availability, and database performance. To select the data protection mode that meets the needs of your business, carefully consider your data protection requirements and the performance expectations of your users.

Maximum Availability This protection mode provides the highest level of data protection that is possible without compromising the availability of a primary database. Transactions do not commit until all redo data needed to recover those transactions has been written to the online redo log and to the standby redo log on at least one synchronized standby database. If the primary database cannot write its redo stream to at least one synchronized standby database, it operates as if it were in maximum performance mode to preserve primary database availability until it is again able to write its redo stream to a synchronized standby database.

This mode ensures that no data loss will occur if the primary database fails, but only if a second fault does not prevent a complete set of redo data from being sent from the primary database to at least one standby database.

You can enable fast-start failover if the protection mode is maximum availability.

Maximum Performance This protection mode provides the highest level of data protection that is possible without affecting the performance of a primary database. This is accomplished by allowing transactions to commit as soon as all redo data generated by those transactions has been written to the online log. Redo data is also written to one or more standby databases, but this is done asynchronously with respect to transaction commitment, so primary database performance is unaffected by delays in writing redo data to the standby database(s).

This protection mode offers slightly less data protection than maximum availability mode and has minimal impact on primary database performance.

This is the default protection mode.

You can enable fast-start failover if the protection mode is maximum performance.

Maximum Protection This protection mode ensures that no data loss will occur if the primary database fails. To provide this level of protection, the redo data needed to recover a transaction must be written to both the online redo log and to the standby redo log on at least one synchronized standby database before the transaction commits. To ensure that data loss cannot occur, the primary database will shut down, rather than continue processing transactions, if it cannot write its redo stream to at least one synchronized standby database.

Transactions on the primary are considered protected as soon as Oracle Data Guard has written the redo data to persistent storage in a standby redo log file. Once that is done, acknowledgment is quickly made back to the primary database so that it can proceed to the next transaction. This minimizes the impact of synchronous transport on primary database throughput and response time. To fully benefit from complete Oracle Data Guard validation at the standby database, be sure to operate in real-time apply mode so that redo changes are applied to the standby database as fast as they are received. Oracle Data Guard signals any corruptions that are detected so that immediate corrective action can be taken.

Because this data protection mode prioritizes data protection over primary database availability, Oracle recommends that a minimum of two standby databases be used to protect a primary database that runs in maximum protection mode to prevent a single standby database failure from causing the primary database to shut down. If only one standby database is supporting maximum protection mode, Oracle Data Guard broker will disallow the shutdown of the apply instance. This prevents the primary database from shutting down.

You cannot enable fast-start failover if the protection mode is maximum protection.

Step 2   Set up standby redo log files.

You must add standby redo log files on all standby databases, regardless of the protection mode you are using. Also, Oracle requires that you add standby redo log files on the primary database in preparation for a future switchover or failover. Standby redo log files are required on the primary database if you want to enable fast-start failover.

Cloud Control automatically prompts you to select one or more standby databases in the configuration and sets up standby redo log (SRL) files on them and on the primary database in preparation for a future role change.

See Also:

If you are using the DGMGRL command-line interface, follow the instructions in Oracle Data Guard Concepts and Administration to configure standby redo log files.

Step 3   Set the redo transport mode.

If the data protection mode requires that you change the redo transport mode used by any of the standby databases, then either change the LogXptMode database property on each standby database, or set the RedoRoutes property on the primary database or on the far sync instance that is directly connected to the standby database. See Section 4.4 for more information about setting the redo transport service. Table 4-2 shows the protection modes and the corresponding redo transport service.

Cloud Control automatically specifies the correct redo transport service on the primary database in preparation for a future switchover.

Table 4-2 Oracle Data Guard Protection Modes and Requirements

Protection Mode	Redo Transport	Standby Redo Log Files Needed?	Usable with Fast-Start Failover?
MAXPROTECTION	SYNC	Yes	No
MAXAVAILABILITY	SYNC, FASTSYNC	Yes	YesFoot 1
MAXPERFORMANCE	ASYNC	Yes	Yes

^Footnote 1 Because FASTSYNC transport mode uses the NOAFFIRM attribute of the LOG_ARCHIVE_DEST_n parameter, data loss is possible. This means that a fast-start failover cannot be initiated when FASTSYNC is used and the standby is missing redo data.

Step 4   Set the protection mode.

Set the protection mode using DGMGRL commands or Cloud Control.

With DGMGRL:

1. Use the EDIT DATABASE (property) command and specify the standby database whose redo transport service should be changed to correspond to the protection mode you plan to set. For example, if you plan to set the overall Oracle Data Guard configuration to operate in maximum availability mode, you must use the EDIT DATABASE command to set the SYNC mode for redo transport services. For example:

   DGMGRL> EDIT DATABASE 'South_Sales' SET PROPERTY LogXptMode='SYNC';
   

   Do this also for the primary database or another standby database in the configuration to ensure that it can support the chosen protection mode after a switchover.

   You could also use the RedoRoutes property, as follows:

   EDIT DATABASE 'North_Sales' SET PROPERTY RedoRoutes = '(LOCAL : South_Sales SYNC)';
   

2. Use the EDIT CONFIGURATION SET PROTECTION MODE AS protection-mode command to set the overall configuration protection mode. For example:

   DGMGRL> EDIT CONFIGURATION SET PROTECTION MODE AS MAXAVAILABILITY;
   

See Section 6.5 for a DGMGRL scenario showing how to set the protection mode.

With Cloud Control:

1. On the Oracle Data Guard overview page, click the link to the right of the Protection Mode label.

2. Select Maximum Protection, Maximum Availability, or Maximum Performance and click Continue.

3. If prompted, log in to the database with SYSDG or SYSDBA privileges and click Login.

4. Select one or more standby databases to support the protection mode that you selected. If standby redo log files are needed, verify the names of the log files. Click OK.

5. On the Confirmation page, click Yes.

After upgrading the protection mode from maximum performance mode to maximum protection mode using either DGMGRL or Cloud Control, the primary database will be restarted automatically if you are upgrading to maximum protection mode. The primary database need not be restarted following a downgrade of the protection mode.

No restart is required when upgrading the protection mode from maximum performance to maximum availability or from maximum availability to maximum protection.

Note:

You can avoid a restart of the primary database when upgrading from maximum performance mode to maximum protection mode by first upgrading to maximum availability. Once in maximum availability mode, then upgrade to maximum protection.

Note:

Online database relocation with Oracle RAC One Node cannot be performed on the only physical standby database that supports maximum protection mode.

If online database relocation must be performed, then you must first downgrade the protection mode to maximum availability. After the online database relocation of the physical standby database is performed, you can upgrade the protection mode back to maximum protection. A restart of the primary database is not required.

4.6.2 How the Protection Modes Influence Broker Operations

This section describes how operations such as switchover, failover, disabling, or enabling the Oracle Data Guard configuration can have an effect on the configuration's protection mode and redo transport services. This section contains the following sections:

• Upgrading or Downgrading the Current Protection Mode

• Switchover Operations

• Failover Operations

• Disable and Enable Operations

• Requirements For Removing a Database from the Configuration

• Requirements On Other Operations

4.8.1 Configure Properties to Tune Fast-Start Failover

The configurable properties for fast-start failover include:

• FastStartFailoverThreshold

  Set the FastStartFailoverThreshold configuration property to specify the number of seconds you want the observer and target standby database to wait (after detecting the primary database is unavailable) before initiating a failover. See Section 5.5.2, "Enabling Fast-Start Failover" for more information and an example.

• FastStartFailoverPmyShutdown

  The FastStartFailoverPmyShutdown configuration property controls whether the primary database will shut down if redo generation has been stalled (FS_FAILOVER_STATUS column of V$DATABASE contains a value of STALLED) and the primary database has lost connectivity with the observer and target standby database for longer than the number of seconds specified by the FastStartFailoverThreshold configuration property. The default value for FastStartFailoverPmyShutdown is TRUE.

  Note:

  The primary database is always shut down if a user configurable fast-start failover condition is detected or if an application initiated a fast-start failover by calling the DBMS_DG.INITIATE_FS_FAILOVER function.

• FastStartFailoverLagLimit

  The fast-start failover feature can be configured on databases operating in maximum performance mode. Destinations that receive redo in ASYNC mode will be acceptable fast-start failover target standby databases, and these destinations can lag the primary in terms of redo received and applied. A configurable time-based limit can be specified through the FastStartFailoverLagLimit configuration property. If the standby database's applied redo point is within this many seconds of the primary's redo generation point, a fast-start failover will be allowed. If its applied point lags beyond this limit, a fast-start failover is not allowed. The FastStartFailoverLagLimit configuration property is not used if fast-start failover is enabled when the configuration is operating in maximum availability mode.An ASYNC destination is only a valid fast-start failover target in a configuration operating in maximum performance mode. If you want to change protection mode or change the destination to sync, you must first disable fast-start failover. Likewise, changing the protection mode from MAXAVAILABILITY to MAXPERFORMANCE will require first disabling fast-start failover and changing the redo transport mode used to send redo to the primary and target standby to ASYNC.Reinstatement of an old primary will be possible after a fast-start failover to an ASYNC target standby. If the observer rediscovers the old primary, it will automatically reinstate the old primary and any redo generated within the specified lag will be lost.

  See Also:

  Chapter 8, "Oracle Data Guard Broker Properties" for more information

• FastStartFailoverAutoReinstate

  The FastStartFailoverAutoReinstate configuration property controls whether the former primary database is automatically reinstated if a fast-start failover occurred because the primary database crashed or was stalled for longer than FastStartFailoverThreshold seconds. The default value for FastStartFailoverAutoReinstate is TRUE.

  If you want to perform diagnostic or repair work after failover has completed, you can avoid an automatic reinstatement by setting the FastStartFailoverAutoReinstate configuration property to FALSE.

  Note:

  The former primary database is never automatically reinstated if a fast-start failover occurred because a user configurable fast-start failover condition was detected or because an application initiated a fast-start failover by calling the DBMS_DG.INITIATE_FS_FAILOVER function.

• FastStartFailoverTarget

  The FastStartFailoverTarget configuration property specifies the DB_UNIQUE_NAME of the database that will be the target of a fast-start failover when this database is the primary database.

• ObserverReconnect

  The ObserverReconnect configuration property specifies how often the observer establishes a new connection to the primary database. When this property is set to the default value of 0, it prevents the observer from periodically establishing a new connection with the primary database. While this eliminates the processing overhead associated with periodically establishing a new observer connection to the primary database, it also prevents the observer from detecting that it is not possible to create new connections to the primary database. Oracle recommends that this property be set to a value that is small enough to allow timely detection of faults at the primary database, but large enough to limit the overhead associated with periodic observer connections to an acceptable level.

• ObserverOverride

  The ObserverOverride configuration property, when set to TRUE, allows an automatic failover to occur when the observer has lost connectivity to the primary, even if the standby has a healthy connection to the primary.

4.8.2 Configure Conditions for Fast-start Failover

By default, a fast-start failover is done when neither the observer nor the standby can reach the primary after the configured time threshold (FastStartFailoverThreshold) has passed. There are also other conditions under which you might want a fast-start failover to occur.

The configurable conditions fall into two classes: those detected through the database health-check mechanism and those detected through errors raised by the Oracle server (such as ORA errors). When a specified condition occurs, the observer will initiate a fast-start failover without waiting for FastStartFailoverThreshold to expire, assuming the standby is in a valid state to accept a failover.

Each condition may be enabled or disabled individually. The Oracle Data Guard configuration persists all user specified configurable fast-start failover conditions in the broker configuration file.

The observer will detect when the primary database has signaled any of the enabled health-check conditions and will immediately initiate a fast-start failover, assuming the standby is in a valid fast-start failover state (observed and either synchronized or within lag limits) to accept a failover.

For specified Oracle ORA-Error conditions, the primary database will notify the observer if the error is signaled and the observer will immediately initiate a fast-start failover, assuming the standby is in a valid fast-start failover state (observed and either synchronized or within lag limits) to accept a failover.

4.8.3 Application Initiated Fast-Start Failover

You can use the DBMS_DG PL/SQL package to allow an application to direct a fast-start failover when it encounters specific conditions. See "Directing a Fast-Start Failover From an Application".

4.10.1 Querying Database Status

The following monitorable properties can be used to query the database status:

• LogXptStatus

• InconsistentProperties

• InconsistentLogXptProps

  Note:

  These properties are directly accessed through the DGMGRL command-line interface. Cloud Control rearranges the values of these properties for presentation in the GUI.

You can use the SHOW DATABASE <db_unique_name> command to get a brief description of the database (name, role, and so on), database status, and information about any health check problems. For example, the output of the following SHOW DATABASE command shows two problems: some redo transport services errors and an inconsistent redo transport-related property

DGMGRL> SHOW DATABASE 'North_Sales';
 
Database - North_Sales
  Role: PRIMARY
  Intended State: TRANSPORT-OFF
  Instance(s):
    north_sales1
      Error: ORA-16737: the redo transport service for standby
        database "South_Sales" has an error
 
    north_sales2
      Error: ORA-16737: the redo transport service for standby
        database "South_Sales" has an error
      Warning: ORA-16715: redo transport-related property
        ReopenSecs of standby "South_Sales" is inconsistent
Database Status:
ERROR

To further check the details about the database status, you can use the LogXptStatus, InconsistentProperties, and InconsistentLogXptProps monitorable properties. LogXptStatus lists all log transport errors detected on all instances of the primary database. InconsistentProperties lists all properties that have inconsistent values between the broker configuration file and the database settings. InconsistentLogXptProps lists all redo transport-related properties of standby databases that have inconsistent values between the broker configuration file and the redo transport settings.

Issue the following SHOW DATABASE commands to obtain further details about the problems.

DGMGRL> SHOW DATABASE 'North_Sales' 'LogXptStatus';
LOG TRANSPORT STATUS
PRIMARY_INSTANCE_NAME  STANDBY_DATABASE_NAME  STATUS 
         north_sales1            South_Sales  ORA-12541: TNS:no listener
         north_sales2            South_Sales  ORA-12541: TNS:no listener
 
DGMGRL> SHOW DATABASE 'North_Sales' 'InconsistentLogXptProps';
INCONSISTENT LOG TRANSPORT PROPERTIES
 INSTANCE_NAME  STANDBY_NAME  PROPERTY_NAME  MEMORY_VALUE  BROKER_VALUE 
  north_sales2   South_Sales     ReopenSecs           600           300

4.10.2 Validating a Database Before a Role Change

You can use the VALIDATE DATABASE command to perform a comprehensive set of database checks prior to performing a role change. The command checks the following items:

• Whether there is missing redo data on a standby database

• Whether flashback is enabled

• The number of temporary tablespace files configured

• Whether an online data file move is in progress

• Whether online redo logs are cleared for a physical standby database

• Whether standby redo logs are cleared for a primary database

• The online log file configuration

• The standby log file configuration

• Apply-related property settings

• Transport-related property settings

• Whether there are any errors in the Automatic Diagnostic Repository (for example, control file corruptions, system data file problems, user data file problems)