Glossary

Failover

Failover is the automatic or manual switch of a workload from a failed component to a standby that takes over, so the service keeps running. It happens at every level, from a single disk or network path to a server, a cluster or an entire data center.

How a cluster decides to fail over

Nodes in a pair or cluster exchange heartbeats, short messages sent every second or so. When enough are missed, the standby concludes its partner has failed and takes over. The danger is a false conclusion: if only the link between them broke, both sides may act as primary and accept writes that later conflict, a condition called split-brain. A quorum vote, often with a third witness node, decides which side holds authority, and a side that cannot reach a majority stops serving.

Three reasons a failover still fails

Detection is rarely the problem. The standby notices and starts, and users still see errors, for reasons that repeat:

  1. Capacity. A standby sized for light use cannot carry the full load of the failed primary.
  2. DNS and caches. Clients keep the old address until the record expires, so a long time-to-live turns a quick switch into many minutes of misdirected traffic.
  3. Replication lag. With asynchronous replication, recent writes may not have reached the standby, which sets the recovery point in practice.

All three appear under real load and real network conditions, not in a quiet lab.

Designs that avoid the switch

In an active-passive pair, one side serves and the other waits, which is simple but leaves capacity idle and puts the switch on the critical path. In active-active designs every side serves, so a failure reduces capacity instead of triggering a takeover. Inside a storage system, erasure coding across many servers keeps data readable when a drive or server fails, with no failover at all.

Frequently asked questions

What is the difference between failover and failback?

Failover moves service to the standby when the primary fails, usually under time pressure. Failback is the planned return to the original side once it is repaired.