About Standby Databases

When you enable Autonomous Data Guard the system creates a standby database that is continuously updated with the changes from the primary database. You can enable Autonomous Data Guard with a standby in the current region, a local standby, or with a standby in a different region, a cross-region standby. You can also enable Autonomous Data Guard with both a local standby and a cross-region standby.

Note:

Standby databases incur additional costs. Refer to the relevant Cloud Service Descriptions to learn more:

Autonomous Data Guard with Local Standby

When you enable Autonomous Data Guard with a standby database in the current region, Autonomous Database monitors the primary database and if the primary database goes down, the standby instance automatically assumes the role of the primary instance.

With Autonomous Data Guard enabled with a local standby database, Autonomous Database provides an identical standby database that allows the following, depending on the state of the primary database:

  • If your primary database goes down, Autonomous Data Guard converts the standby database to the primary database with minimal interruption. After failover completes, Autonomous Data Guard creates a new standby database for you.

  • You can perform a switchover operation, where the primary database becomes the standby database, and the standby database becomes the primary database.

Autonomous Database does not provide access to a standby database in the current region. You perform all operations, such as scaling up the OCPU Count and enabling Auto Scaling on the primary database and Autonomous Data Guard then performs the same actions on the local standby database. Likewise, you only perform actions such as stopping or restarting the database on the primary database.

A local standby database is created in the same region as the primary database (current region). For better resilience, the standby database is provisioned as follows:

  • In regions with more than one availability domain, a local standby database is provisioned automatically in a different availability domain than the primary database.

  • In regions with a single availability domain, a local standby database is provisioned automatically on a different physical machine than the primary database.

All Autonomous Database features from the primary database are available when the local standby instance becomes the primary after the system fails over or after you perform a switchover operation, including the following:

  • Database Options: The OCPU Count, Storage, Display Name, Database Name, Auto Scaling, Tags, and Licensing options have the same values after a failover to the standby database or after you perform a switchover.

  • OML Notebooks: Notebooks and users created in the primary database are available in the standby.

  • APEX Data and Metadata: APEX information created in the primary database is copied to the standby.

  • ACLs: The Access Control List (ACL) of the primary database is duplicated for the standby.

  • Private Endpoint: The private endpoint from the primary database applies to the standby.

  • APIs or Scripts: Any APIs or scripts you use to manage the Autonomous Database continue to work without any changes after a failover operation or after you perform a switchover.

  • Client Application Connections: Client applications do not need to change their connection strings to connect to the database after a failover to the standby database or after you perform a switchover.

  • Wallet Based Connections: You can continue using your existing wallets to connect to the database after a failover to the standby database or after you perform a switchover.

Autonomous Data Guard with Cross-Region Standby

When you enable Autonomous Data Guard with a standby database in a different region, if the primary instance goes down, Autonomous Data Guard provides a standby instance that is available to assume the role of the primary instance. The standby database is a replica of the primary database and may be used for recovery in case of failure or when the primary is not available. Enabling Autonomous Data Guard with a cross-region standby provides a solution for disaster recovery in the event an entire region is not available or when the primary database is down for any reason.

Autonomous Data Guard paired regions are remote regions where you can create a cross-region standby database. Autonomous Data Guard allows you to create one remote standby database. See Autonomous Data Guard Paired Regions for more information on paired regions.

After you enable Autonomous Data Guard with a remote standby, Autonomous Database provides access to the remote standby database from the Oracle Cloud Infrastructure Console. You perform almost all operations, such as scaling up the OCPU Count and enabling Auto Scaling on the primary database and Autonomous Data Guard then performs the same actions on the cross-region standby database. Autonomous Database provides access to the cross-region standby so that you can perform some operations independently on the remote standby, such as configuring networks and VCNs for private endpoints and tagging to define keys and values that are not replicated between the primary database and the remote standby.

Autonomous Data Guard does not perform automatic failover for a cross-region standby. If the primary database is unavailable and a local standby is unavailable, you can perform a manual failover to make the remote region standby database assume the primary role.

You cannot connect to a remote standby and a remote standby database is not available for read-only operations. You can connect to the remote region database when it assumes the primary role after a switchover or a manual failover.

The following areas have differences for failover and switchover when you failover or switchover from the primary in the primary region to the standby in the remote region, when compared to failover or switchover to a local standby:

  • Display Name: The display name has a "_Remote" extension.

  • OML Notebooks: After a cross-region switchover or failover, OML notebooks from the primary region are not present in remote region. New OML notebooks can be created in the remote region.

  • Private Endpoint: You can independently configure and update private endpoints on the remote standby database before failover or switchover. Thus, after a failover or a switchover, the a private endpoint may be configured differently. Autonomous Database does not keep the networking configuration synchronized from the primary to the standby in the remote region.

    VCN Peering and domain forwarding are required for wallets to work across regions, with Autonomous Databases with a private endpoint with Autonomous Data Guard enabled where the primary and the remote database are in different VCNs. See Remote VCN Peering using an RPC and DNS in Your Virtual Cloud Network for information on VCN peering and domain forwarding.

  • APIs or Scripts: Any APIs or scripts you use to manage the Autonomous Database need to be updated to call the APIs on the remote region's database after a failover operation or after you perform a switchover.

    For best performance and quickest connection time, Oracle recommends that you download a wallet from the remote region database when you use the remote region database as the primary database, after a failover or a switchover.

  • Client Applications: Client applications may use the single instance wallet containing both primary and standby's connection strings, and do not need to change their wallet to connect to the database, after a failover or switchover to the standby database.

    For best performance and quickest connection time, Oracle recommends that you download a wallet from the remote region database when you use the remote region database as the primary database, after a failover or a switchover.

  • Wallet Based Connections: You can continue using your existing instance wallets to connect to the database after a failover to the standby database or after you perform a switchover.

    For best performance and quickest connection time, Oracle recommends that you download a wallet from the remote region database when you use the remote region database as the primary database, after a failover or a switchover.

  • Autonomous Database Tools: The tools have different URLs in the remote region after switchover or failover to the cross-region standby (the tools URLs do not change for a switchover or failover to a local standby):

    • Database Actions

    • Oracle APEX (APEX)

    • Oracle REST Data Services (ORDS)

    • Graph Studio

    • Oracle Machine Learning Notebooks

    • Oracle Machine Learning User Management

  • Oracle Cloud Infrastructure Object Storage Usage: After you failover or switchover from the primary in the primary region to the standby in the remote region, the credentials and the URLs that provide access to Object Storage in the primary region continue to work as they did before the failover or the switchover, providing access to the following:

    • Manual backups

    • External tables

    • External partitioned tables

    • External hybrid partitioned tables

    Note:

    This applies when the primary region's Object Storage is available. For rare scenarios when the Object Storage in the primary region is not available, Oracle recommends having Object Storage backups or replication to a different region. If the primary region's Object Storage is not available, you may update your user credentials and parameters that set URLs for Object Storage so that the parameters specify values to access the available region's Object Storage. See Using Replication for more information.

Autonomous Data Guard Database Region and Role

After you enable Autonomous Data Guard with a cross-region standby database, Autonomous Data Guard specifies each database based on its region as the primary region database and the remote region database and each database has a designated role: primary or standby.

The Autonomous Database Information page shows the region in the Region field. The Region field shows one of two values, Primary or Remote, based on the database's role when you enable Autonomous Data Guard, and this value does not change.

The role specifies the current state of a database, primary or standby, and this value changes after you perform a switchover or a manual failover. You can view the Autonomous Database role in the icon that shows next to the display name on the Autonomous Database Information page:

Description of adb_adg_primary.png follows
Description of the illustration adb_adg_primary.png

Description of adb_adg_standby.png follows
Description of the illustration adb_adg_standby.png

The Autonomous Database Information page also shows the role in Autonomous Data Guard area in the Role field.

Thus, after you enable Autonomous Data Guard with a cross-region standby, the Region field for the database shows Primary and the Role field also Primary. After a switchover, the same database shows the Region as Primary and the Role as Standby.

Note:

Oracle recommends using the primary region when available. The remote region is available for testing and for disaster recovery as required. If disaster recovery is required, you can use the remote region to continue operations and return to using the primary region when it is available.

You can see the peer Autonomous Database details for both the local and the remote peer database. To see this information, on the Autonomous Database Information page under Resources, select Autonomous Data Guard. For a local standby database, the database has the same display name in the Peer Autonomous Database column. For a remote standby database, the database has the same display name with a "_Remote" extension and provides a link to access the remote database. The Peer Role column shows the role for the peer database, either Primary or Standby.

Description of adb_data_guard_resources.png follows
Description of the illustration adb_data_guard_resources.png

Autonomous Data Guard Failover and Switchover with Cross-Region Standby and No Local Standby

With Autonomous Data Guard enabled with a cross-region standby without a local standby, you have the following options:

  • If your primary database goes down, you can manually failover to the remote standby database.

  • You can perform a switchover operation, where the primary region database becomes the standby database, and the remote region standby database becomes the remote region primary database.

Autonomous Data Guard Failover and Switchover with Local Standby and Cross-Region Standby

With Autonomous Data Guard enabled with a local standby database and a cross-region standby database, Autonomous Database provides a local standby database and a cross-region standby database.

With both a current region and a remote region standby database, depending on the state of the primary region database, you have the following options:

  • If your primary database goes down and the local standby database is available, Autonomous Data Guard automatically performs failover to convert the local standby database to the primary database with minimal interruption. After failover completes, Autonomous Data Guard creates a new local standby database for you. If automatic failover is not possible, you have the option to perform a manual failover.

    Autonomous Data Guard continues to use the same cross-region standby.

  • If your primary database goes down and the local standby database is not available, you can perform a manual failover to the cross-region standby database.

    In this case, the remote standby database becomes the primary database. After failover completes, Autonomous Data Guard does not create a new local standby database for you. In this case, the remote region assumes the primary role but does not have a local standby.

  • You can perform a switchover operation, where the primary database becomes the local standby database, and the local standby database becomes the primary database.

    Autonomous Data Guard continues to use the same cross-region standby.

    This option is not available if you are using the remote region database as your primary database (that is Region is Remote and Role is Primary). For example, after you perform a switchover or a failover to the remote region.

  • You can perform a switchover operation, where the remote region standby database becomes the remote region primary database and the primary region primary database becomes the primary region standby database.

    A switchover changes the primary region database to the Standby role. If you perform a switchover two times, the primary region database returns to the Primary role.

Note:

When you enable Autonomous Data Guard with both a local and a cross-region standby, Autonomous Data Guard does not provide a local standby while the remote region instance operates in the Primary role. Using the remote region in the Primary role is intended for use while the primary region is unavailable or for testing (a temporary scenario). After the primary region database returns to the Primary role, the local Standby will be available.

Autonomous Data Guard Database Cross Region Backup and Restore

After you enable Autonomous Data Guard with a cross-region standby database, backup and restore from backup is handled as follows:

  • If the primary database is restored from a backup, a new remote region standby instance is created from the restored instance.

  • Automatic Backups and Manual backups are only taken on the primary database (the database showing Role: Primary). For example, after a switchover or failover to the remote region, the database in the remote region assumes the primary role and starts to perform automatic backups. The primary region database with role Standby no longer takes backups. If you switch back so the primary region's database role becomes Primary, then the database in the primary region starts taking backups again.

  • You cannot restore or clone from a backup when either the primary region database or the remote region database is in the Standby role. Backups are only taken on the database in the Primary role, and the restore operation is not available from the Oracle Cloud Infrastructure Console on the Standby database.

Autonomous Data Guard and Primary Region Wallets

After you enable Autonomous Data Guard with a remote standby, on the primary database download a new instance wallet. The instance wallet file you download from the primary database contains connection strings for both the primary region and the remote region database.

The order of the connection strings in the instance wallet file impacts the database connection time. For best performance, use the wallet file downloaded from the region in which the current Primary instance resides.

When you download a regional wallet, the wallet only contains the connection strings for the primary or standby database that lies in that same region as the downloaded regional wallet. Regional wallets do not contain the connection strings for remote databases.

See Download Client Credentials (Wallets) for more information.

Autonomous Data Guard Recovery Time Objective (RTO) and Recovery Point Objective (RPO)

Autonomous Data Guard monitors the primary database and if the instance goes down, then the local standby instance assumes the role of the primary instance according to the Recovery Time Objective (RTO) and Recovery Point Objective (RPO). If the local standby instance is not available and you have enabled a cross-region standby, you can manually failover to a cross-region standby.

The RTO is the maximum amount of time required to restore database connectivity to a standby database after a manual or automatic failover is initiated. The RPO is the maximum duration of potential data loss, in minutes, on the primary database.

When Autonomous Data Guard is enabled with a local standby database, the RTO and RPO numbers are as follows:

  • Automatic Failover or Switchover: the RTO is two (2) minutes and RPO is zero (0).

  • Manual Failover: the RTO is two (2) minutes and RPO is up to one (1) minute.

When Autonomous Data Guard is enabled with a cross-region standby database, the RTO and RPO numbers for failover to the cross-region standby are as follows:

  • Switchover: the RTO is fifteen (15) minutes and RPO is zero (0).

  • Automatic Failover: Not available

  • Manual Failover: the RTO is fifteen (15) minutes and RPO is up to one (1) minute.

See Perform a Switchover for details on switchover.

See Automatic Failover with a Standby Database for details on automatic failover.

See Manual Failover with a Standby Database for details on manual failover.

Autonomous Data Guard Operations

Autonomous Database provides the following operations with Autonomous Data Guard:

  • Enable: If Autonomous Data Guard is disabled, you can enable Autonomous Data Guard.

    See Enable a Standby Database for details.

  • Add Standby Database: After you enable Autonomous Data Guard with either a local (current region) standby or a cross-region standby database (remote), you can add a second standby database. If the standby database you enable first is a remote database, you can add a local (current region) standby database. If the standby database you enable first is a current region standby database, you can add a cross-region standby database.

    See Add a Standby Database for details.

  • Disable: If Autonomous Data Guard is enabled, you can disable Autonomous Data Guard. Disabling Autonomous Data Guard terminates the standby database. If you have both a local standby database (current region), and a cross-region standby database (remote), you disable each standby individually.

    See Disable a Standby Database for details.

  • Switchover: When Autonomous Data Guard is enabled, switchover changes the roles of the primary and the standby, the standby database becomes the primary, and the primary database becomes the standby. If you have both a local standby database (current region), and a cross-region standby database (remote), you can choose to switchover either the local standby or the remote standby.

    See Perform a Switchover for details.

  • Manual Failover: If the primary database is not available, you can perform a manual failover to change roles to make a standby database the primary database:

    • If a local standby is available, you can manually failover to the local standby (you do not have the option to failover to a remote region standby if a local standby is available).
    • If a local standby is not enabled or was enabled with Autonomous Data Guard and is not available, you have the option to manually failover to a remote standby.

    See Manual Failover with a Standby Database for details.

  • Terminate: If you want to terminate the primary instance, select More Actions and Terminate. Terminating the primary instance also terminates the standby database. If you have both a local standby database (current region), and a cross-region standby database (remote), this terminates both the local standby and the remote standby.

Autonomous Database Standby Database State

Autonomous Database provides information about Autonomous Data Guard state on the Autonomous Database Details page.

The Status field shows the Autonomous Data Guard status information, as follows:

  • Enabled indicates Autonomous Data Guard is enabled.

  • Disabled indicates Autonomous Data Guard is not enabled.

The Role field shows the role of the current database, as follows:

  • When using Autonomous Data Guard with a local standby, the Oracle Cloud Infrastructure Console shows the Role field value Primary. Autonomous Database does not provide access to a local standby database.

  • When using Autonomous Data Guard with a cross-region standby, the Oracle Cloud Infrastructure Console shows the Role field value Primary if you are viewing the primary database and shows Standby if you are viewing the details for the standby database.

  • Switchover: Provides a link so that you can perform a switchover operation.

  • Failover: When the primary database is not available and you have a local standby and automatic failover was not successful, the failover link allows you initiate a manual failover.

    When the primary database is not available and you have a cross-region standby and failover to a local standby is not possible, the failover link allows you initiate a manual failover to the remote standby database.

To view the peer Autonomous Database information, under Resources click Autonomous Data Guard. This area lists the peer autonomous database information. The State column shows the state of a standby database, as follows:

  • Provisioning
    • This state shows when you enable Autonomous Data Guard and indicates that a standby database is provisioning (until the standby database state changes to Standby).

    • This state shows after a failover to a local standby when a local standby database is being recreated.

    • This state shows if a restore from backup operation is performed on the primary database, the local standby is recreated and the State column shows Provisioning.

  • Standby: Indicates that a standby is available and ready for either a switchover or a failover operation.

    Note:

    When the standby database is stopped, the standby state shows Standby. A standby database never shows the Stopped state.
  • Role Change in Progress: Indicates a failover or switchover operation started.

Autonomous Data Guard Events with Autonomous Database

You can use Oracle Cloud Infrastructure events to respond when Autonomous Database changes its state due to an Autonomous Data Guard related event such as a failover or switchover operation.

Autonomous Database events include the following:

  • Begin disable Autonomous Data Guard
  • Begin enable Autonomous Data Guard
  • Begin failover
  • Begin switchover
  • End disable Autonomous Data Guard
  • End enable Autonomous Data Guard
  • End failover with failover result of success or failure.
  • End switchover with switchover result of success or failure.

Based on events you can perform actions or send notifications. See Events and Notifications for a Standby Database for more information on using events and producing notifications.