This topic answers frequently asked questions about active zone-redundancy.
- If I have a primary/secondary database and a dual-zone ECS deployment, is that considered active zone-redundancy?
- What are the differences and advantages compared to the zone affinity feature for EDAS and MSE cluster traffic?
- Is message high availability based on a shutdown mechanism?
- For databases, should I deploy a primary/secondary pair in each of the two data centers, or one primary/secondary pair in the primary data center and a single secondary node in the secondary data center?
- What are the details of primary/secondary disaster recovery for messages?
- What business value does MSHA provide?
If I have a primary/secondary database and a dual-zone ECS deployment, is that considered active zone-redundancy?
No, it is not. This solution only achieves active-active for resources. Service traffic includes north-south HTTP traffic and east-west traffic, such as RPC, messages, and distributed tasks. With active-active resources, if a service node fails, north-south traffic is redirected. However, east-west traffic continues to flow to the failed zone, which prevents the service from recovering. Therefore, this setup does not achieve active zone-redundancy for services.
What are the differences and advantages compared to the zone affinity feature for EDAS and MSE cluster traffic?
| Category | MSHA | EDAS and MSE |
| Microservice scenarios | Addresses response time (RT) issues at the zone level. | Addresses response time (RT) issues at the zone level. |
| Basic concept | Logical cluster concept | Zone concept |
| Priority for multiple logical clusters in the same zone | Supported | Not supported |
| RPC traffic shifting in failure scenarios | Supported | Not supported |
| Supported services |
| Microservices |
Is messaging's active-active feature based on a shutdown mechanism?
No, it is not. This approach would require services to be restarted for recovery. If every disaster recovery drill requires all services to coordinate machine restarts and control the startup sequence, the process would be unacceptable for users.
For databases, should I deploy a primary/secondary pair in each of the two data centers, or one primary/secondary pair in the primary data center and a single secondary node in the secondary data center?
We recommend deploying a primary/secondary pair. You can add more secondary nodes if the cost is manageable.
What are the details of primary/secondary disaster recovery for messages?
The core disaster recovery strategy for brokers involves data synchronization, write protection, and primary node failover.
What business value does MSHA provide?
MSHA provides value in the "0", "5", and "10" stages of the "0-1-5-10" model (Prevention, 1-minute detection, 5-minute decision, and 10-minute recovery). The details are as follows:
- "0" (Prevention): Use the logical zone isolation feature of MSHA to first deploy business code and configuration changes in one zone. Then, direct a small percentage of production traffic to this zone for validation. If an issue occurs, you can quickly shift the traffic to recover the service. This prevents widespread failures caused by code or configuration issues.
- "5" (Decision): Use the traffic containment feature of MSHA. When a service fails, business monitoring metrics for Zone A drop while metrics for Zone B remain normal. This lets you quickly decide to shift traffic from Zone A to Zone B. This reduces the time spent on problem diagnosis and decision-making.
- "10" (Recovery): Use MSHA's top-down traffic rule management and integrated database synchronization to complete a disaster recovery switchover and restore services in minutes.