All Products
Search
Document Center

PolarDB:Disaster recovery drill

Last Updated:Sep 18, 2026

This topic describes how to perform a disaster recovery drill on a PolarDB for MySQL cluster.

Overview

You can use the Disaster Recovery Drill feature to simulate failures on a PolarDB for MySQL cluster. A Disaster Recovery Drill supports two dimensions: the node dimension and the zone dimension. In a node-dimension drill, you can test only one node at a time. During the drill, once the system injects a fault, the specified node becomes unavailable, and the PolarDB for MySQL cluster recovers based on a fixed strategy. For more information about the recovery strategy, see Recovery phase.

Note

This feature is in canary release. To use it, contact us to be added to the allowlist and enable the feature.

Prerequisites

Your PolarDB for MySQL cluster must meet the following requirements:

  • Edition: Enterprise Edition.

  • Database engine:

    • MySQL 5.6, with a revision version of 5.6.1.0.42 or later.

    • MySQL 5.7, with a revision version of 5.7.1.0.26 or later.

    • MySQL 8.0.1, with a revision version of 8.0.1.1.30.2 or later.

    • MySQL 8.0.2, with a revision version of 8.0.2.2.19 or later.

Usage notes

A disaster recovery drill carries risks, such as transient connection interruptions and data loss. To avoid impacting your business, we strongly recommend running drills on a cloned cluster. You can also use Intelligent Stress Testing to simulate production workloads during a drill.

Note

Risk of data loss:

  • For a zone-dimension drill, there is a risk of data loss if the Recovery Point Objective (RPO) is less than 60 seconds.

  • For a node-dimension drill, if a Read-only Node (Standby) or a Read-only Node exists, the RPO is 0 and there is no risk of data loss.

Procedure

  1. Log on to the PolarDB console. In the left-side navigation pane, click Clusters, select the region where the cluster resides, and then click the ID of the target cluster to go to the cluster details page.

  2. In the left-side navigation pane, click Service availability, and then click the Disaster Recovery Drill tab.

  3. On the Disaster Recovery Drill page, select the zone or node for the drill. Then, click Start Drill.

    Note
  4. In the Fault Injection Method dialog box, select Fault Injection By Node. Click OK.

  5. On the Disaster Recovery Drill page, you can view the status and phases of the current drill task in the Drills section at the bottom of the page.

    • Node-dimension schematic:

      • The drill list table contains columns such as Task ID, Drill Mode, Fault Injection Method, Start Time, End Time, Drill Status, and Node Information.

      • When you expand a task, you can view the Disaster Recovery Drill Phase Display, which contains three phases: Fault Injection (fault injection on the primary node), Recovery Phase (the primary node is restored and available), and Post-processing Phase. After each phase is completed, a green check mark is displayed.

    • Zone-dimension schematic:

      • The drill list table contains columns such as Task ID, Drill Mode, Fault Injection Method, Start Time, End Time, Drill Status, and Node Information.

      • When you expand a task, you can view the Disaster Recovery Drill Phase Display, which contains three phases: Fault Injection (fault injection on the read-only node and on the primary node), Recovery Phase (the primary node is restored and available), and Post-processing Phase (standby rebuild). After each phase is completed, a green check mark is displayed.

Drill phases

Fault injection

A fault is injected based on the selected Drill Nodes and Fault Injection Method.

Recovery phase

Node dimension

  • If you select the Primary Node for the drill and a Read-only Node (Standby) exists, the Primary Node fails over to the Read-only Node (Standby).

  • If you select the Primary Node for the drill, and no Read-only Node (Standby) exists but a Read-only Node does, the Primary Node fails over to the Read-only Node.

  • If you select the Primary Node for the drill and no Read-only Node (Standby) or Read-only Node exists, the system performs a Zone dimension drill.

  • If you select a Read-only Node for the drill, the system starts a new read-only node for the failover.

Zone dimension

If you select a zone for the drill, the drill runs on all nodes in that zone. The primary node and other nodes fail over to the secondary zone. The following figures show the architecture in each scenario:

Before the drill

image

Fault drill on all nodes in the zone

image

Primary node restored

image

Resource replenishment

The system determines whether to replenish resources based on the resource availability in the new primary zone (Zone 2 in this example). If the system replenishes resources, the following figure shows the architecture.

image

Post-drill phase

This phase is triggered only for a Zone dimension drill. The time required for this phase varies based on the data volume and network latency. This phase does not affect your business.

Resource replenishment

  • Rebuild Backup Database

    image

  • Primary Node Switchback

    image

No resource replenishment

  • Rebuild Backup Database

    image

  • Primary Node Switchback

    image