Automatic Failover with a Standby Database

After you add a local Autonomous Data Guard standby database, the system monitors the primary instance and automatically fails over to a local standby database in certain scenarios.

If automatic failover is not possible, you have the option to perform a manual failover. Automatic failover does not apply to a cross region standby.

Autonomous AI Database automatically fails over to a local standby database as follows:

• When the primary database becomes unavailable and users are not able to connect, Autonomous Data Guard automatically fails over to a local Autonomous Data Guard standby database if a local standby database is available, based on the Recovery Time Objective (RTO) and when Autonomous Data Guard determines that the automatic failover data loss limit will not be exceeded.

• Autonomous Data Guard performs automatic failover to a local standby database when a local standby database is available and the system can guarantee either the default zero data loss or up to the data loss limit you specified a data loss limit when you enabled Autonomous Data Guard. You can specify an automatic failover data loss limit between 0 and 3600 seconds. If this target cannot be met then automatic failover does not occur and you have the option to perform a manual failover.

  See Enable Autonomous Data Guard for information on setting the automatic failover data loss limit.

• After automatic failover to a local standby database completes, Autonomous AI Database creates a new local standby database for you.

  Autonomous Data Guard for a particular standby, either local or remote, is not enabled while the system is provisioning the new standby database. After Autonomous Data Guard completes the provisioning step for the standby database and it becomes available, you then have a new standby database with Autonomous Data Guard enabled on it.

• After the failover completes, Autonomous AI Database reports the time of the last failover in the Role field on the Autonomous AI Database Details page under Disaster recovery.

• After an automatic Autonomous Data Guard failover, if there was a regional failure, when the region comes back online the standby database is automatically reconnected or if required re-provisioned.

If the primary database has failed or is unreachable and the conditions for Autonomous Data Guard automatic failover have not been met, then Oracle Cloud Infrastructure console shows a banner indicating that automatic failover did not succeed, provides a reason, such as possible data loss above the default 0 RPO or above the limit you set for the automatic failover data loss limit, and provides a link for you to initiate manual failover. See Perform Manual Failover to a Local Standby Database for more information.

Note: Autonomous Data Guard automatic failover is disabled when the Lifecycle state is either: Restore in Progress or Upgrading.

See Autonomous Data Guard Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for more information.