Database Cluster Switchover and Recovery for GBase 8s

Published on 2026-06-18

GBase 8s database switchovers are divided into three methods: automatic switchover, CM-controlled switchover based on FOC rules, and manual switchover. This article systematically outlines the core mechanisms, configuration parameters, and recovery strategies for each switchover method, helping DBAs make informed decisions in actual operations and maintenance.

1. Automatic Switchover (Dedicated to Two-Node HAC)

This mode applies only to an  HAC  environment consisting of two nodes. The two instances continuously probe each other's status and, upon detecting an exception, perform a predefined action based on the DRAUTO parameter value.

Prerequisite: Set DRAUTO to 1 or 2.

1.1 DRAUTO = 2

1.2 DRAUTO = 1

Split-brain commonality: Whether DRAUTO is set to 1 or 2, if a switchover is triggered by a network timeout while the original primary is still running, dual primaries will result after communication is restored. The new primary will then forcibly shut down the old primary. The old primary cannot rejoin through a simple restart and the entire HAC must be rebuilt.

Common constraint: The prerequisite for the original primary node to recover by being started directly is that the logical logs on the primary node have not overwritten the logical logs at the time of the original primary node failure, meaning no log wraparound has occurred.

2. CM-Controlled Switchover (Applicable to Multiple Cluster Combinations)

CM is applicable to standalone or hybrid deployments of  SSC, HAC, RHAC . CM maintains communication with all nodes and determines the takeover order according to the priority of the HA_FOC_ORDER list.

Prerequisite: Set DRAUTO to 3.

2.1 Primary Node Failure Scenario

CM promotes the available node with the highest priority to primary according to the order specified by HA_FOC_ORDER. The recovery path for the original primary node depends on the cluster type relationship between the original primary and the new primary:

  • SSC relationship: It can rejoin by starting normally with oninit -vy.

  • HAC / RHAC relationship: Physical recovery oninit -PHY must be performed, and the cluster relationship must be reassigned.

2.2 Network Timeout Scenario

CM likewise elects a new primary according to priority. If the cluster is SSC and disk heartbeat is configured, CM can forcibly shut down the original primary through the disk channel to prevent split-brain. After the network is restored, the recovery path for the original primary node likewise depends on the cluster type relationship between the original primary and the new primary:

  • SSC relationship: Start the original primary normally with oninit -vy.

  • HAC/RHAC relationship: The original primary must perform physical recovery (ontape -p) using the level-0 backup from the new primary, then re-establish the primary-secondary relationship.

3. Manual Switchover (Used with OS High-Availability Clusters)

Cluster switchover is controlled manually, and GBase 8s itself does not automatically trigger any action. This scenario is generally used with an operating system high-availability cluster, handing switchover decision-making authority to the OS-layer high-availability cluster.

Prerequisite: Set DRAUTO to 0.

3.1 Primary Node Failure

All nodes in the cluster retain their current status. The administrator manually forces promotion on the target server:

onmode -d make primary <服务名> [force]

Original primary node recovery method:

  • SSC relationship: Start normally with oninit -vy.

  • HAC / RHAC relationship: Perform physical recovery with oninit -PHY and reassign the cluster relationship.

3.2 Network Timeout

All nodes in the cluster retain their current status. Manually run    onmode -d make primary on the server that needs to become the primary to force promotion. After the network is restored, the original primary automatically shuts down.
Original primary node recovery method:

  • SSC:oninit -vy.

  • HAC/RHAC: After the new primary performs a level-0 backup, the original primary performs physical recovery and reassigns the cluster relationship.

4. Comparison of the Three Modes

Note: The preceding conclusions are based on typical scenarios; uncovered edge cases may exist in production environments.

5. Operations and Maintenance Recommendations

Select DRAUTO as Needed

  • Simple two-node high availability → Automatic switchover（1/2）

  • Complex multi-cluster combinations → CM control（3）

  • Existing OS cluster orchestration → Manual switchover（0）

Monitor Logical LogsAfter HAC automatic switchover, the prerequisite for directly starting the original primary is that no log wraparound has occurred. It is recommended to monitor logs to avoid recovery failures.

Prevent Network PartitioningSplit-brain is mostly triggered by network timeouts. Disk heartbeat is recommended for SSC scenarios; redundant network links are recommended for HAC/RHAC scenarios. In addition, deploying the supporting hac_alline and cluster_alline components can effectively prevent split-brain.

Remember the Differences Between Recovery CommandsThe recovery paths for SSC and HAC/RHAC are completely different. HAC/RHAC almost always requires physical recovery, so a recovery window must be reserved.