Fail-Over

At 2 a.m. Hop's only server loses its power supply. Every short link on every website in the world now leads to an error page until someone wakes up. The cure for "only one" is "two, and a way to switch". That switch is fail-over.

The rule

Keep a second one ready; switch when the heartbeat stops.

Machines send each other a small "I'm alive" message every second or so: a heartbeat. When the heartbeats stop, the survivor takes over. There are two layouts:

Active-passive (also called master-slave fail-over): one machine serves; a standby waits. When the active's heartbeat stops, the standby takes over its IP address or DNS name and starts serving.

• Hot standby: already running and in sync — switch in seconds.
• Cold standby: must boot and load data first — switch in minutes.

Active-active (master-master): both machines serve all the time, usually behind a load balancer. If one dies, the other carries all the traffic.

Fail-over is not free:

• You pay for extra hardware — in active-passive, a machine that mostly waits.
• The switching logic itself can fail, so it must be tested.
• If the active machine held data not yet copied to the standby, that data is lost.

The shortcut

Ask: "Does the machine hold state that is hard to share?" No → active-active, so nothing sits idle. Yes → active-passive is simpler, because only one machine writes at a time.

The trap is a standby that shares the failure: same power supply, same rack, same data centre. A backup that dies with the original was never a backup.

Drills

Answer fast — trust the rule.

Remember

• Keep a second one ready; switch when the heartbeat stops.
• Shortcut: stateless → active-active; hard-to-share state → active-passive.
• Trap: a standby that shares the same power, rack or site as the original.