Objective.
Power off the server running a PostgreSQL primary and measure the failover to its synchronous standby.
Scenario.
The server under the primary was powered off at the provider while a client wrote once a second.
Expected behaviour.
- Promote the synchronous standby.
- Accept writes again within 3 minutes.
- Lose no acknowledged write.
Measured recovery.
- Recovery time RTO
- 1 min 21 s
- Target 3 min · met
- Recovery point RPO
- 0 s
- Every committed write kept.
- Database consistency
- Pass
Customer impact.
- Application availability
- Writes back after 80.9 s
- Data integrity
- Verified
- Committed data
- Fully preserved
What happened.
- Server powered off.
- Standby promoted; writes accepted again. 155 of 155 acknowledged writes present.
- Server back and rejoined.
Correctness checks.
- Committed data
- Fully preserved
What we learned.
- Every acknowledged write was present after the failover.
What we changed.
- Controller leases lengthened to 60 seconds and renewed within 40 seconds.
- Coordination timing tuned for a server loss.
Scope of this drill.
Measured with one database writing once a second.