3.2 DR Plans: Switchover, Failover, Prechecks & Plan Execution
Key Takeaways
Full Stack DR supports four plan types: Switchover, Failover, Start Drill, and Stop Drill.
Plan groups in a DR plan run sequentially, while all steps inside a single plan group run in parallel.
A switchover shuts down the application stack in the primary region before starting it in the standby region, so both regions must be available.
A failover brings up the application in the standby region without trying to shut down the primary, so it only needs the standby region to be available.
During an execution, operators can pause, resume, cancel, retry a failed step or group, or skip a step or group.
The Four Plan Types
All plans are created in the standby DR protection group, and all plan executions are launched from it.
| Plan type | When it is used | What it does |
|---|---|---|
| Switchover | Planned events: maintenance, DR audits, avoiding an approaching hazard | Performs an orderly transition: shuts down the application stack in the primary region, then brings it up in the standby region. Requires both regions to be available. |
| Failover | Unplanned outages that affect the primary region | Immediately brings up the application stack in the standby region without trying to shut down the primary. Requires only the standby region. |
| Start Drill | DR testing | Creates a replica of the application stack in the standby region without disrupting production. |
| Stop Drill | After testing | Terminates the replica stack created by Start Drill and cleans up. |
Data loss depends on the replication technology behind each member, not on Full Stack DR itself. A switchover performs graceful role changes, such as a Data Guard switchover, so no committed data is lost. A failover accepts whatever the replication lag was at the moment of failure; for example, a cross-region Autonomous Data Guard standby has an RPO of up to one minute.
How a Plan Is Structured
A DR plan is a sequence of plan groups, and each group contains plan steps:
- Plan groups execute sequentially. Group 2 starts only after group 1 finishes.
- All steps within a plan group execute in parallel. If ten moving instances must be launched, they launch at the same time inside one group.
- Built-in groups and steps are generated automatically from the members. For a moving instance in a switchover plan, for example, Oracle generates groups such as Compute Instances - Stop (primary), Compute Instances - Launch (standby), Compute Instances - Terminate (disabled by default), and Compute Instances - Remove from DR Protection Group to prepare for switchback. Database members get groups such as Switchover Databases; volume groups get groups that reverse or restore replication.
- User-defined groups and steps are added after the plan is created. They can run a script stored in Object Storage, run a local script on an instance (through the Oracle Cloud Agent Run Command plugin), or invoke an OCI Function. You can also add a user-defined precheck and a pause group that stops the plan until an operator resumes it.
Each step has settings such as a timeout and an error mode. STOP_ON_ERROR halts the plan when the step fails so someone can fix the problem; CONTINUE_ON_ERROR records the failure and lets the plan continue, which suits optional tasks such as notifications.
If you move groups around manually or make large membership changes, the generated order can become wrong. Oracle documents a default order of DR plan groups and recommends checking it after edits, and refreshing plans when protection group members change.
Prechecks
A precheck validates that a plan still matches the members and configuration of the protection groups. Oracle positions prechecks as ongoing DR readiness checks that keep the workflow aligned with the topology it protects. You run them from the standby DRPG with Run Prechecks, and optionally choose Ignore Warnings:
- With Ignore Warnings disabled, steps with warnings are marked Partially Succeeded.
- With Ignore Warnings enabled, steps with warnings are marked Succeeded.
Examples of what Full Stack DR verifies include:
| Member | Example prechecks |
|---|---|
| Moving compute | Volume group replication (or backups with cross-region copy) is configured; a replica or backup exists in the standby region; all boot and block volumes of the instance are in the volume group, and nothing else is |
| Volume groups | Group and replica are Available; for intra-region DR, the replica is not in the same AD; destination encryption keys are valid and enabled |
| Base DB / Exadata databases | Data Guard is enabled, the two databases are Data Guard peers with the correct roles, and the password secret in Vault can be read |
| Autonomous AI Database Serverless | A remote (cross-region) standby exists, it belongs to the peer DRPG, and the primary is Available |
| Object Storage | The source bucket and its replication policy exist in the peer region |
Prechecks validate configuration. They do not reserve capacity, so a shape that is in short supply in the standby AD can still fail at launch time. For critical moving instances, compute capacity reservations in the standby region reduce that risk.
Running and Controlling an Execution
When an execution runs, the Console shows the progress of each group and step, with logs written to the Object Storage log location you configured for operation logs. Operators can:
- Pause a running execution and Resume it later.
- Cancel an execution.
- Retry a failed step or a failed group after fixing the cause.
- Skip a step or a group when it is safe to continue without it.
Full Stack DR can also be set up for automatic DR plan execution, with custom Audit events recorded for automatic runs. Most organizations still keep a human approval step for failover decisions.
Exam Patterns to Recognize
- "Planned maintenance, both regions healthy, zero data loss, reverse roles afterward" points to a Switchover plan.
- "Primary region unreachable" points to a Failover plan.
- "Prove DR readiness without affecting production" points to Start Drill, followed by Stop Drill.
- "Plans keep failing after members were added" points to refreshing the plan and rerunning prechecks.
A company must move production from Frankfurt to its standby region for a scheduled electrical shutdown. Both regions are healthy, no committed data may be lost, and the roles must be reversible after the work ends. Which Full Stack DR plan type should run?
A Failover plan, which starts the standby stack without contacting the primary
A Start Drill plan, which runs a copy of the stack beside production in the standby region
A Stop Drill plan, which terminates primary resources and promotes the standby
A Switchover plan, which stops the stack in Frankfurt before starting it in the standby
A DR plan contains one plan group that launches eight moving compute instances, followed by a group that runs a user-defined script. How does Full Stack DR execute this plan?
It launches the eight instances one at a time in the order listed, then runs the script
It runs the script and the instance launches at the same time, because all groups run in parallel
It launches the instances in parallel, then runs the script group after that group finishes
It launches the instances in parallel and runs the script on whichever one finishes first
An operator runs prechecks on a failover plan with Ignore Warnings disabled. One step returns a warning but no errors. How is that step reported?
Partially Succeeded, because warnings count when Ignore Warnings is off
Succeeded, because warnings never affect the result of a precheck run
Failed, and the plan stays locked until the warning has been cleared
Canceled, and the precheck must restart from the first plan group
Sections you finish are checked off in the contents.