Skip to main content
Redundancy & Failoverlesson 4 of 4 · 2 min read

Failover Drills

Paths that rot quietly

Failover paths rot quietly.

The standby sized correctly last year is now two machine generations behind your primary. Your runbook mentions a host decommissioned in March. Your promotion script needs a credential that expired, or one that lives in the head of an engineer currently on a beach.

Notice why none of that surfaces. Normal operation never takes the path. It surfaces at 3am during the real incident, the most expensive possible moment to learn it.

Rehearsal

Rehearse, which is the entire cure. Schedule an exercise where you deliberately fail a component, in staging first and then in production, and run the actual recovery with the actual on-call people.

Measure two things: whether your automation works, and how long your humans take. Write down the timestamps. If your architecture claims a five-minute failover, the drill is what turns that claim into a number you can say out loud.

Go further with continuous failure if you want. One large streaming company has been killing random production machines during business hours since 2011. The theory is that a failure you meet weekly is a failure you have already engineered away.

Start small rather than copying their tooling. Kill one instance of one service while the owning team watches, with a written prediction of what should happen and a stop button in case it does not. Widen the blast radius only as your confidence grows.

Drill the organisational path too. Who declares the incident, who can approve evacuating a region, who talks to your customers? A failover that works technically and then stalls for 40 minutes waiting on a decision maker still blows your recovery target.

Worked example

Lena schedules her team's first game day: unplug the primary database in staging and follow the runbook, target 10 minutes. It takes 96. The promotion script fails immediately because it authenticates with a service account whose key was rotated in January. The one person who knows the new key location is on leave, so they page him anyway, which is its own lesson. Then the promoted replica buckles under write load because it was a cheaper instance type, provisioned back when it only served reads. Nothing in the 96 minutes was exotic, just drift accumulated over 14 months. The team fixes the credential store, upsizes the replica, and repeats the drill monthly. By the third run they hit 6 minutes, and when a real failover happens that autumn it takes 7.

Redundancy & Failover: wrapping up

In the real world

  • 01Netflix's Chaos Monkey has terminated random production instances during business hours since 2011, and Chaos Kong drills evacuate an entire AWS region to prove their active-active setup can lose one.
  • 02GitHub's October 2018 outage started with a 43-second network partition, after which two data centers had both accepted MySQL writes; reconciling the split-brain data kept the site degraded for more than 24 hours.
  • 03Amazon RDS Multi-AZ keeps a synchronous standby in a second Availability Zone and fails over via DNS update, typically completing in 60 to 120 seconds.
  • 04Facebook's October 2021 outage lasted about six hours after a BGP configuration change withdrew the routes to its own DNS servers, a single point of failure in the control plane rather than the data plane.
  • 05Cloudflare serves from 300+ cities on anycast IPs, so losing an entire data center reroutes traffic to neighboring locations without any failover orchestration.

Questions people ask

Isn't the load balancer that does my failover itself a single point of failure?

Yes, if it is one box. Production setups run load balancers in pairs with a floating IP between them, use DNS to spread across several, or use anycast. Managed cloud load balancers like AWS ALB look like one endpoint but are redundant fleets internally, which is a strong reason to use them instead of running your own.

Should I always prefer active-active over active-passive?

No. Active-active is close to free for stateless services and worth doing there. For databases it means multiple writers, which brings conflict resolution and consistency problems that are much harder than a 60-second failover. Most teams are better served by an active-passive database with a well-drilled promotion than by a multi-writer setup they don't fully understand.

How often should failover actually be tested?

Quarterly is a reasonable floor for a full drill, monthly if the system is important, and continuously via chaos tooling once you have the maturity. The honest rule: if you cannot remember the last time the failover path ran, assume it is broken, because configuration drift accumulates whether or not you look at it.

Quick review

Single Point of Failure (SPOF):
any component whose failure takes down the system. Find and eliminate all of them
Active-Passive:
standby node mirrors primary. Health check triggers failover (DNS update or VIP reassignment)
Warm standby:
replica is caught up and ready but not serving traffic. Failover in seconds
Hot standby:
replica serves read traffic. Failover instantaneous (no promotion needed)
Active-Active:
all nodes serve traffic. Failed node's load redistributed by load balancer automatically
Multi-AZ deployment:
AWS recommends deploying across at least 3 Availability Zones for regional resilience
Chaos engineering (Netflix Chaos Monkey):
deliberately kill random instances in production to verify failover works
the trade-off

You pay for capacity that does nothing most of the time, and hot standbys cost the most. The harder part is that failover is itself a failure mode: flapping health checks cause promotions nobody wanted, and a partition can promote two primaries at once unless a quorum decides.

in the room

Any production system with availability requirements. The baseline is 3 replicas (primary + 2) for any stateful service.