How the Protection Modes Influence Broker Operations

This section describes how operations such as switchover, failover, disabling, or enabling the Data Guard configuration can have an effect on the configuration’s protection mode and redo transport services. This section contains the following sections:

■ Upgrading or Downgrading the Current Protection Mode

■ Switchover Operations

■ Failover Operations

■ Disable and Enable Operations

■ Requirements For Removing a Database from the Configuration

■ Requirements On Other Operations

4.6.2.1 Upgrading or Downgrading the Current Protection Mode

When you upgrade the current Data Guard protection mode (for example, to upgrade from the maximum performance mode to the maximum availability mode), the broker shuts down and restarts the primary database. When you downgrade the current Data Guard protection mode, the database does not need to be restarted. Follow these recommendations when upgrading or downgrading the Data Guard protection mode:

■ When upgrading the protection mode, upgrade the redo transport service before

Managing Data Protection Modes

See Section 6.5.3 for information.) At the time when you change the protection mode or reset the redo transport service of a standby database, the broker verifies that there is at least one standby database in the configuration that can support the requested grade of protection. If not, then the broker does not change the

protection mode and returns an error.

■ When downgrading the protection mode, downgrade the protection mode first and then change the redo transport service (if necessary). The broker will not allow changing the redo transport service if doing so invalidates the current overall protection mode.

If you upgrade the protection mode from the maximum performance mode, the broker ensures that there is at least one standby database using standby redo log files, and whose redo transport service is set to SYNC. Additionally, for upgrades to

MAXPROTECTION, the broker ensures there are no gaps in log files on the standby database. If there are no standby databases in the configuration that meet these requirements, the request to upgrade the protection mode is rejected with an error.

The protection mode cannot be changed if fast-start failover is enabled.

4.6.2.2 Switchover Operations

A switchover does not change the overall Data Guard protection mode. The protection mode remains the same as it was before the switchover.

This requires that there be a standby database that is properly configured to support the current protection mode once the switchover completes. This can be either another standby database in the configuration or the current primary database that will become a standby database after the switchover completes.

Before you invoke a switchover, if necessary, you can add standby redo log files and set the redo transport service on the current primary database, or on another standby database in the configuration, to the SYNC, ASYNC, or ARCH mode that is required to support the Data Guard protection mode. Then, when the switchover begins:

■ The broker verifies the presence of standby redo log files and the redo transport service setting on each standby database and on the current primary database.

■ The broker verifies there are no gaps if the protection mode is set to MAXPROTECTION.

If the verification is successful, the switchover continues; otherwise, the switchover fails, and the database roles and the broker configuration files remain unchanged.

4.6.2.3 Failover Operations

After you perform a manual failover, the Data Guard protection mode is downgraded to maximum performance mode if the protection mode was at maximum protection.

You can upgrade the protection mode later, if necessary. If the protection mode was at WARNING: The primary database will be shut down and restarted

if you upgrade the protection mode.

WARNING: The broker will shut down and restart the primary database if the target of the switchover is a physical standby database.

See Also: Section 5.3 for more information about switchovers

Managing Data Protection Modes

maximum availability, it remains at maximum availability. The redo transport services of the standby databases remain unchanged.

If fast-start failover occurs, the broker preserves the protection mode at the same maximum availability level in which it was operating before the failover.

4.6.2.4 Disable and Enable Operations

When you disable broker management of a standby database, the broker checks to see if the overall protection mode can still be satisfied by any of the remaining standby databases. If not, the broker rejects the disable operation. Otherwise, the broker allows the disable operation to proceed as long as fast-start failover is not enabled. If it is enabled, the broker allows the disable operation to proceed only if the standby database is not the target standby database for fast-start failovers.

After a standby database is successfully disabled, you can change the redo transport service for that database and the broker will record the change in the broker

configuration file. The change will not affect the overall protection mode because it is guaranteed that at least one of the enabled standby databases already satisfies the overall protection mode requirement.

As long as fast-start failover is not enabled, you can disable the entire configuration regardless of the protection mode. This is because you may want to use the broker only to set up a Data Guard configuration, and then disable it from the broker’s control and use other interfaces (for example, using SQL*Plus and SQL statements) for management. You cannot disable the configuration if fast-start failover is enabled. See Section 5.5.2.2, "Restrictions When Fast-Start Failover is Enabled" for more

information.

If the entire configuration is disabled, you can change any broker settings, including the redo transport services of the standby databases and the protection mode of the configuration. The broker saves the changes in the broker configuration file, but the changes will not be made to the database itself.

When enabling broker management of the entire configuration, the broker first checks to see if the protection mode will be satisfied by the redo transport services of the standby databases that will be enabled. If not, the enable operation fails and the configuration remains disabled. Otherwise, the enable operation successfully enables the configuration, and the broker enables the database using the settings saved in the broker configuration file.

4.6.2.5 Requirements For Removing a Database from the Configuration

When removing a standby database from the broker configuration, the broker checks to see if the protection mode will still be satisfied. The broker quits the operation if:

■ Removing the database compromises the protection mode

Fast-start failover is enabled and you try to remove the standby database that is See Also: Section 5.4 and Section 5.5 for more information about

manual failover and fast-start failover, respectively

Caution: If you disable broker management of a standby database in the broker configuration, that standby database cannot be used by the broker as a failover target in the event of loss of the primary database.

Database Status

If you want to remove the entire configuration, the broker always allows the operation.

4.6.2.6 Requirements On Other Operations

Some operations that take place in a broker configuration, especially operations related to redo transport services, can affect the overall protection mode. These operations include:

■ Setting the standby database to the offline state

■ Stopping redo transport services on the primary database

■ Stopping redo transport services to individual standby databases

Before any of these operations can proceed, the broker checks to see if the protection mode will be supported by the redo transport service settings on the standby databases after the operation completes. If not, the broker quits the operation and returns an error.