You cannot guarantee a lossless datacenter failover simply by redirecting traffic. The database or other stateful system must have a sufficiently current recovery copy, the former writer must be prevented from accepting writes, and the application must be made ready before traffic is sent to it. Start by setting a recovery point objective (RPO) and recovery time objective (RTO) for each workload, then design and test the replication, promotion, fencing, and routing steps needed to meet them.
Set the data-loss and downtime limits first
RPO is the maximum age of the most recent recoverable data point your business can accept. RTO is the maximum time the workload can be unavailable while service is restored. They are business requirements, not settings that a replication product can choose for you. Set them per workload: an internal reporting service and a payment system may have very different tolerances.
As an Amazon Associate I earn from qualifying purchases.
Define what counts as a lost write and as restored service. For example, decide whether an acknowledged transaction must survive, which application functions must be usable before declaring recovery complete, and whether degraded capacity is acceptable. These definitions determine what you need to replicate, what must be checked during recovery, and whether the design can meet its targets.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesIf the requirement is that every acknowledged write survive a site loss, an asynchronous copy alone is insufficient: writes acknowledged by the primary may not yet have reached the recovery site. Synchronous replication can improve durability by waiting for standby confirmation, but adds response time and may make commits wait when the required standby is unavailable. The achievable guarantee depends on the system’s configuration and failure assumptions.
#1 Best Overall
Choose an architecture that can meet those objectives
Faster recovery generally means keeping more of the recovery environment provisioned and ready. The ranges below are AWS Well-Architected guidance for strategy categories, not guarantees or benchmarks for a particular application; actual RPO and RTO depend on configuration, workload, network, and recovery procedure. AWS does not state a publication date on the current guidance page.
| Approach | Illustrative recovery profile | Trade-off |
|---|---|---|
| Backup and restore | AWS describes RPO in hours and RTO of 24 hours or less; point-in-time recovery can reduce RPO in some configurations. | Lowest ongoing standby footprint, but recovery takes longer and requires restoration work. |
| Pilot light | AWS describes RPO in minutes and RTO in tens of minutes. | Core infrastructure and data replication are kept ready; application capacity must be started or expanded. |
| Warm standby | AWS describes RPO in seconds and RTO in minutes. | A functional but scaled-down environment runs continuously and must be scaled during recovery. |
| Multi-site active-active | AWS describes RPO as near zero and RTO as potentially zero. | Highest cost and operational complexity. Writes to the same records in multiple replicas require explicit conflict handling. |
These categories are useful for comparing cost, recovery capacity, write consistency, and operational complexity—not for assuming that a design will meet a target without testing. Active-active does not remove the need to decide how conflicting writes are handled. Nor is replication a substitute for backups: accidental deletion or corruption can replicate to another site. Keep an independent backup or point-in-time recovery path for those cases. AWS Well-Architected Framework: recovery strategies
Rank #2
Understand what replication guarantees—and what it does not
Asynchronous replication can leave a gap
PostgreSQL’s official documentation says streaming replication is asynchronous by default. If the primary fails, committed transactions that have not reached the standby can be lost; the amount depends on replication delay at the time of failure. Monitor lag and decide what maximum lag is acceptable before promoting a standby. A low-lag reading is useful, but it does not turn asynchronous replication into a guarantee that every acknowledged transaction has arrived. PostgreSQL 18: Log-Shipping Standby Servers
Synchronous replication trades latency for durability
With synchronous replication, commits can wait for confirmation from designated standby servers. This can improve protection against loss of acknowledged writes, at the cost of extra transaction response time and dependence on standby availability. In PostgreSQL, the precise behavior depends on settings including synchronous_commit and how many synchronous standbys are required and selected. Confirm the actual commit semantics in your configuration rather than treating the label “synchronous” as a universal guarantee. PostgreSQL 18: Log-Shipping Standby Servers
Quorum systems behave differently from ordinary replicas
In etcd, a majority remains authoritative through a network partition; the minority side is unavailable and steps down if it holds the leader. Writes pause during leader election, and etcd’s documentation states that committed writes are not lost on leader failure. Those properties describe etcd’s consensus mechanism and should not be generalized to databases or applications that do not use the same quorum protocol. etcd v3.7: Failure modes
Use a runbook that makes promotion safe
The sequence below is a framework, not a universal command list. Exact thresholds, automation, and promotion steps depend on the database, topology, traffic manager, and recovery objectives.
- Set workload-specific RPO and RTO. Record what data may be lost, what service interruption is acceptable, and what checks define a recovered workload.
- Assess the failure and recovery copy. Monitor replication lag or confirmed-commit state as well as recovery-site health. Use a defined failure policy rather than declaring an outage from one ambiguous network symptom. If the primary is reachable only from part of the system, determine which side is authoritative before taking action.
- Fence the former writer. Before promotion, make the old primary unable to accept writes—for example, by powering it off, isolating it, or using another dependable fencing mechanism. In a quorum design, verify that the surviving side retains the required majority. PostgreSQL documentation describes STONITH (“Shoot The Other Node In The Head”) as a way to ensure the old primary is informed it is no longer primary; without exclusion, two sites can accept writes and diverge. PostgreSQL 16: Failover
- Choose and promote an acceptable copy. Establish the candidate’s data state against the RPO. With asynchronous replication, inspect the lag and account for acknowledged writes that may not have arrived. If the state cannot meet the business-defined loss limit, follow the organization’s decision process rather than describing the promotion as lossless.
- Validate the recovery site before routing users. Check that the application and its dependencies are healthy and that the promoted data store accepts writes. Confirm that application configuration points to the intended writer.
- Switch traffic and verify clients. Use health-checked routing to direct traffic to the recovered deployment, then check actual client behavior and routing convergence. The time needed to detect failure and switch traffic counts toward the RTO.
- Keep one writer during recovery. Preserve the recovery site as the sole writer. Rebuild or resynchronize the former primary, reconcile data according to policy, and schedule a controlled failback. Rehearse the full procedure, including database promotion and traffic routing together.
Keep traffic routing separate from data promotion
A router can send users to another deployment, but it does not promote a database, establish replication completeness, or prevent the former primary from writing. Treat traffic switching as a distinct stage after the data and application are ready. Health checks should reflect application readiness rather than merely whether a host responds, and drills should test resolver and client behavior as well as the routing control plane.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Microsoft identifies Azure Front Door and Azure Traffic Manager as options for automated failover of incoming traffic between deployments, while noting that detection and switching take time that must fit the workload’s RTO. AWS Elastic Disaster Recovery guidance states that traffic redirection is handled outside that service. These are implementation examples; the relevant routing mechanism depends on the deployment. Microsoft Learn: Business Continuity, High Availability, and Disaster Recovery · AWS Elastic Disaster Recovery: Core concepts
Plan failback around the writes made after failover
Failback is not simply reversing a DNS or traffic-management change. The recovery site may have accepted newer writes while the original site was unavailable. Decide how those writes will be preserved, how the old site will be brought up to date, when it can safely rejoin, and what condition must be met before promoting it back. Keep the recovery site as the only writer until resynchronization and the planned role change are complete. Microsoft explicitly notes that data may be written after failover begins and that its treatment requires a business decision. Microsoft Learn: Business Continuity, High Availability, and Disaster Recovery
Test the complete recovery, not just the network switch
A routing drill alone cannot show whether a standby has the right data or whether split-brain is prevented. Periodically exercise the whole sequence in realistic failure conditions: identify the outage, evaluate replication state, fence the old writer, promote the recovery copy, validate application writes, redirect traffic, and restore the original site under a controlled failback plan. Record observed recovery time and data state against the objectives, then revise thresholds and procedures where the drill exposes a gap.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
