How Oracle Data Guard’s Maximum Protection Mode Handles Failures and Recovery

The article explains Oracle Data Guard’s Maximum Protection mode, the highest protection level that requires synchronized redo log transmission and confirmation. It can be enabled with the ALTER DATABASE SET STANDBY DATABASE TO MAXIMIZE PROTECTION command.

Verification on Primary and Standby

After enabling the mode, the primary database shows the new protection status:

SQL> SELECT name, open_mode, database_role, protection_mode FROM v$database;
NAME   OPEN_MODE   DATABASE_ROLE   PROTECTION_MODE
-----  ----------  --------------  -----------------
VLIFE  READ WRITE  PRIMARY          MAXIMUM PROTECTION

The standby database reflects the same mode:

SQL> SELECT name, open_mode, database_role, protection_mode FROM v$database;
NAME   OPEN_MODE                     DATABASE_ROLE   PROTECTION_MODE
-----  ----------------------------  --------------  -----------------
VLIFE  READ ONLY WITH APPLY PHYSICAL STANDBY  MAXIMUM PROTECTION

Stopping Standby Log Transport

When the standby’s log transport is cancelled ( ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL), the primary can still execute transactions, but the changes are not applied to the standby because the connection is broken.

SQL> DELETE FROM t_m;
9 rows deleted
SQL> COMMIT;
Commit complete

SQL> SELECT COUNT(*) FROM t_m;
COUNT(*)
----------
9

The primary logs an error indicating the listener on the standby is down (TNS‑12541). Attempting to shut down the standby results in ORA‑01154: database busy because the primary is still alive.

Forced Shutdown of Primary

When the primary forces a log switch ( ALTER SYSTEM SWITCH LOGFILE) while the standby is unreachable, Oracle detects the failure and shuts down the primary to protect data integrity, emitting messages such as:

ORA-03113: end‑of‑file on communication channel
WARNING: All standby database destinations have failed
WARNING: Instance shutdown required to protect primary

Recovering the Standby

The standby can be recovered using the current logfile and disconnecting the session:

ALTER DATABASE RECOVER MANAGED STANDBY DATABASE USING CURRENT LOGFILE DISCONNECT FROM SESSION;

This starts the Managed Standby Recovery process, archives pending logs, and resumes real‑time apply.

Resuming Primary Operations

After the standby is recovered, the primary can be started again. The first startup attempt fails due to the same listener error, but once the standby listener is started ( lsnrctl start), the primary starts successfully and the database opens.

Switching to Maximum Performance Mode

Finally, the protection mode can be degraded to Maximum Performance for higher throughput:

ALTER DATABASE SET STANDBY DATABASE TO MAXIMIZE PERFORMANCE;

SQL> SELECT name, open_mode, database_role, protection_mode FROM v$database;
NAME   OPEN_MODE   DATABASE_ROLE   PROTECTION_MODE
-----  ----------  --------------  -----------------
VLIFE  READ WRITE  PRIMARY          MAXIMUM PERFORMANCE

Conclusion

Oracle Data Guard’s three protection modes are tightly coupled with the archive log transport mechanism; the mode determines how the primary behaves during log‑transport failures, with Maximum Protection automatically shutting down the primary to avoid data loss.