What are the Disaster Recovery conditions; is the switchover automatic or manual?

Short answer

The switchover condition is selected per record in the Disaster Recovery Condition field of the record form: with the default Automatic (when no healthy primary records left) option, the answers pass to the DR DC when no healthy address remains in the Main DC; if a health scenario is selected from the list, they are given from the DR DC as long as the scenario is active. Disaster Recovery on No Healthy Records (on by default), which appears while a scenario is selected, also ensures the switchover when the Main DC becomes empty. Switchover and return are automatic by default; there is no separate button that starts the switchover manually. Manual control is done through the condition: a record for which the predefined Always scenario is selected answers continuously from the DR DC; if the Deactivation setting of the scenario is set to With Trigger, the return to the Main DC is tied to a verification condition, and if it is set to Off, there is no return until the Deactivation setting is changed.

How Does It Work?

Disaster Recovery Condition	Disaster Recovery on No Healthy Records	Answers are given from the DR DC
Automatic (when no healthy primary records left)	Not visible	While there is no healthy address in the Main DC
User scenario	On (default)	While the scenario is active or while there is no healthy address in the Main DC
User scenario	Off	Only while the scenario is active; if the Main DC becomes empty and the scenario is passive, Fail-Safe Records are returned, and if there are none, no address is returned
Always	-	Always
Never	On	Only while there is no healthy address in the Main DC

The decision of the scenario is managed with the Activation and Deactivation settings (evaluation mechanism):

• Automatic: The scenario follows the health check condition in it; when the condition is no longer met (e.g. when the Main DC becomes healthy again), it returns to passive and the answers pass to the Main DC.
• With Trigger: At the transition, Trigger Actions run and the decision waits until a separate Deactivation Check (at activation, Activation check) condition is met.
• Off: Exists only in Deactivation. After the scenario becomes active once, it does not return to passive on its own; for the return to the Main DC, the Deactivation setting of the scenario is changed.

If the health checks the scenario relies on have not produced a result yet, the scenario keeps its previous decision; missing information alone does not start a switchover.

Managing the Switchover in TR7

Need	Configuration
Automatic switchover when the primary data center goes down completely	The default Automatic (when no healthy primary records left).
Switchover by a custom criterion (e.g. loss of access to the data center)	A scenario that uses the automatic health checks of the remote data center (e.g. Access to <name> is successful).
Manual switchover for planned maintenance	Maintenance Mode is turned on on the device in the primary data center; the scenario that contains the <name> is under maintenance health check is selected as the condition. Alternatively, the condition is temporarily set to Always.
Manually approved return	The Deactivation setting of the scenario set to With Trigger or Off.

For several records to switch at the same time, the same scenario is selected as the condition of these records; the scenario is managed from a single place. Switchovers are monitored on the GTM Logs screen as <name>/<type>: DR is on and <name>/<type>: DR ended.

Common Misconceptions

• "Once a scenario is selected, the Main DC becoming empty no longer causes a switchover." Disaster Recovery on No Healthy Records is on by default; when the Main DC becomes empty, the switchover is made even if the scenario is passive.
• "A scenario with Off selected never switches to DR." Off exists only in Deactivation and stops the return; the switchover still happens.
• "When maintenance mode is turned on, traffic switches to the backup on its own." Maintenance Mode only activates a health check; for the switchover, this health check is used in a scenario, and the scenario is selected in the Disaster Recovery Condition field of the record.
• "When the condition is changed, clients go to the backup immediately." The new answer is given within a few seconds; the old answer in the cache is used until the TTL expires.

How it is done in the documentation

• Records · Disaster Recovery Condition
• Records · Disaster Recovery on No Healthy Records
• Health Scenarios · The Automatic Health Scenario Records
• Health Scenarios · Deactivation

Related questions

• How does the switchover between the primary and backup data centers work in Disaster Recovery mode?
• What is a health scenario; how does it combine several checks?
• What is a Trigger Action; what does it do in which situations?
• What is a Remote Device; how does GTM monitor a remote data center?