Overview
Greenplum keeps a mirror of every primary segment on another host and promotes it when the primary fails. The promotion is silent: queries keep working, so a failover that nobody recovers can sit unnoticed until the next host event.
Challenge
A segment host in a twelve-host Greenplum 6 cluster failed. The fault tolerance service promoted the mirrors on its partner host, which then ran two sets of primary segments. Monitoring only checked that the coordinator accepted connections, so nothing alerted. Queries that touch every segment ran noticeably longer for seven weeks, and the team put it down to data growth. During routine operating system patching the partner host was rebooted, and with no in-sync copy of those segments the cluster stopped serving queries.
Environment
Greenplum 6 on twelve on-premises Linux segment hosts with group mirroring, a coordinator and a standby coordinator, feeding customer usage reporting and billing reconciliation.
Approach
AceMQ restored service first, then fixed the conditions that let the failure stay hidden. After the repaired host was back, we ran full segment recovery from the surviving copies, throttled so it fitted the overnight load window, and rebalanced roles. We then redesigned the mirror layout and put the cluster state under alerting.
Solution
- Read gp_segment_configuration and gpstate to confirm which segment pairs ran on a single copy and which mirrors were out of sync
- Brought the cluster back with the partner host's surviving data, then ran full gprecoverseg recovery of the failed host's segments in batches sized to the load window
- Rebalanced primary and mirror roles with gprecoverseg -r once every pair was in sync
- Moved from group mirroring to spread mirroring, so one host failure spreads its extra work across several hosts
- Added alerts on segments down, mirrors out of sync and change tracking state, with a runbook for the first failover
- Scheduled a gpbackup restore test and a rehearsal of standby coordinator activation
Outcome
Every segment pair was back in sync within two nights, and the nightly load returned to its earlier duration after the rebalance. A failed segment now pages the on-call DBA within minutes, and the team has a rehearsed recovery runbook.