<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="group-replication-responses-failure-exit">
      </a>
      20.7.7.4 Exit Action
     </h4>
    </div>
   </div>
  </div>
  <p>
   The
   <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_exit_state_action">
    <code class="literal">
     group_replication_exit_state_action
    </code>
   </a>
   system variable specifies what Group Replication does when the
        member leaves the group unintentionally due to an error or
        problem, and either fails to auto-rejoin or does not try. Note
        that in the case of an expelled member, the member does not know
        that it was expelled until it reconnects to the group, so the
        specified action is only taken if the member manages to
        reconnect, or if the member raises a suspicion on itself and
        expels itself.
  </p>
  <p>
   In order of impact, the exit actions are as follows:
  </p>
  <div class="orderedlist">
   <ol class="orderedlist" type="1">
    <li class="listitem">
     <p>
      If
      <code class="literal">
       READ_ONLY
      </code>
      is the exit action, the
            instance switches MySQL to super read only mode by setting
            the system variable
      <a class="link" href="server-system-variables.html#sysvar_super_read_only">
       <code class="literal">
        super_read_only
       </code>
      </a>
      to
      <code class="literal">
       ON
      </code>
      . When the member is in super read only
            mode, clients cannot make any updates, even if they have the
      <a class="link" href="privileges-provided.html#priv_connection-admin">
       <code class="literal">
        CONNECTION_ADMIN
       </code>
      </a>
      privilege
            (or the deprecated
      <a class="link" href="privileges-provided.html#priv_super">
       <code class="literal">
        SUPER
       </code>
      </a>
      privilege). However, clients can still read data, and
            because updates are no longer being made, there is a
            probability of stale reads which increases over time. With
            this setting, you therefore need to pro-actively monitor the
            servers for failures. This exit action is the default; after
            is taken, the member's status is shown as
      <code class="literal">
       ERROR
      </code>
      in the view of the group.
     </p>
    </li>
    <li class="listitem">
     <p>
      If
      <code class="literal">
       OFFLINE_MODE
      </code>
      is the exit action, the
            instance switches MySQL to offline mode by setting the
            system variable
      <a class="link" href="server-system-variables.html#sysvar_offline_mode">
       <code class="literal">
        offline_mode
       </code>
      </a>
      to
      <code class="literal">
       ON
      </code>
      . When the member is in offline mode,
            connected client users are disconnected on their next
            request and connections are no longer accepted, with the
            exception of client users that have the
      <a class="link" href="privileges-provided.html#priv_connection-admin">
       <code class="literal">
        CONNECTION_ADMIN
       </code>
      </a>
      privilege
            (or the deprecated
      <a class="link" href="privileges-provided.html#priv_super">
       <code class="literal">
        SUPER
       </code>
      </a>
      privilege). Group Replication also sets the system variable
      <a class="link" href="server-system-variables.html#sysvar_super_read_only">
       <code class="literal">
        super_read_only
       </code>
      </a>
      to
      <code class="literal">
       ON
      </code>
      , so clients cannot make any updates,
            even if they have connected with the
      <a class="link" href="privileges-provided.html#priv_connection-admin">
       <code class="literal">
        CONNECTION_ADMIN
       </code>
      </a>
      or
      <a class="link" href="privileges-provided.html#priv_super">
       <code class="literal">
        SUPER
       </code>
      </a>
      privilege. This exit
            action prevents both updates and stale reads (with the
            exception of reads by client users with the stated
            privileges), and enables proxy tools such as MySQL Router to
            recognize that the server is unavailable and redirect client
            connections. It also leaves the instance running so that an
            administrator can attempt to resolve the issue without
            shutting down MySQL. After this exit action is taken, the
            member's status is displayed as
      <code class="literal">
       ERROR
      </code>
      in
            the view of the group (not
      <code class="literal">
       OFFLINE
      </code>
      , which
            means a member has Group Replication functionality available
            but does not currently belong to a group).
     </p>
    </li>
    <li class="listitem">
     <p>
      If
      <code class="literal">
       ABORT_SERVER
      </code>
      is the exit action, the
            instance shuts down MySQL. Instructing the member to shut
            itself down prevents all stale reads and client updates, but
            it means that the MySQL Server instance is unavailable and
            must be restarted, even if the issue could have been
            resolved without that step. After this exit action is taken,
            the member is removed from the listing of servers in the
            view of the group.
     </p>
    </li>
   </ol>
  </div>
  <p>
   Bear in mind that operator intervention is required whatever
        exit action is set, as an ex-member that has exhausted its
        auto-rejoin attempts (or never had any) and has been expelled
        from the group is not allowed to rejoin without a restart of
        Group Replication. The exit action only influences whether or
        not clients can still read data on the server that was unable to
        rejoin the group, and whether or not the server stays running.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    If a failure occurs before the member has successfully joined
          the group, the exit action specified by
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_exit_state_action">
     <code class="literal">
      group_replication_exit_state_action
     </code>
    </a>
    <span class="emphasis">
     <em>
      is not taken
     </em>
    </span>
    . This is the case if there
          is a failure during the local configuration check, or a
          mismatch between the configuration of the joining member and
          the configuration of the group. In these situations, the
    <a class="link" href="server-system-variables.html#sysvar_super_read_only">
     <code class="literal">
      super_read_only
     </code>
    </a>
    system
          variable is left with its original value, and the server does
          not shut down MySQL. To ensure that the server cannot accept
          updates when Group Replication did not start, we therefore
          recommend that
    <a class="link" href="server-system-variables.html#sysvar_super_read_only">
     <code class="literal">
      super_read_only=ON
     </code>
    </a>
    is set in
          the server's configuration file at startup, which Group
          Replication changes to
    <code class="literal">
     OFF
    </code>
    on primary
          members after it has been started successfully. This safeguard
          is particularly important when the server is configured to
          start Group Replication on server boot
          (
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_start_on_boot">
     <code class="literal">
      group_replication_start_on_boot=ON
     </code>
    </a>
    ),
          but it is also useful when Group Replication is started
          manually using a
    <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
     <code class="literal">
      START
          GROUP_REPLICATION
     </code>
    </a>
    statement.
   </p>
  </div>
  <p>
   If a failure occurs after the member has successfully joined the
        group, the specified exit action is taken. This is the case in
        the following situations:
  </p>
  <div class="orderedlist">
   <ol class="orderedlist" type="1">
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        Applier error
       </em>
      </span>
      - There is an error in
            the replication applier. This issue is not recoverable.
     </p>
    </li>
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        Distributed recovery not possible
       </em>
      </span>
      -
            There is an issue that means Group Replication's distributed
            recovery process (which uses remote cloning operations and
            state transfer from the binary log) cannot be completed.
            Group Replication retries distributed recovery automatically
            where this makes sense, but stops if there are no more
            options to complete the process. For details, see
      <a class="xref" href="group-replication-distributed-recovery-fault.html" title="20.5.4.4 Fault Tolerance for Distributed Recovery">
       Section 20.5.4.4, “Fault Tolerance for Distributed Recovery”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        Group configuration change error
       </em>
      </span>
      - An
            error occurred during a group-wide configuration change
            carried out using a function, as described in
      <a class="xref" href="group-replication-configuring-online-group.html" title="20.5.1 Configuring an Online Group">
       Section 20.5.1, “Configuring an Online Group”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        Primary election error
       </em>
      </span>
      - An error
            occurred during election of a new primary member for a group
            in single-primary mode, as described in
      <a class="xref" href="group-replication-single-primary-mode.html" title="20.1.3.1 Single-Primary Mode">
       Section 20.1.3.1, “Single-Primary Mode”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        Unreachable majority timeout
       </em>
      </span>
      - The
            member has lost contact with a majority of the group members
            so is in a minority, and a timeout that was set by the
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_unreachable_majority_timeout">
       <code class="literal">
        group_replication_unreachable_majority_timeout
       </code>
      </a>
      system variable has expired.
     </p>
    </li>
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        Member expelled from group
       </em>
      </span>
      - A
            suspicion has been raised on the member, and any timeout set
            by the
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_member_expel_timeout">
       <code class="literal">
        group_replication_member_expel_timeout
       </code>
      </a>
      system variable has expired, and the member has resumed
            communication with the group and found that it has been
            expelled.
     </p>
    </li>
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        Out of auto-rejoin attempts
       </em>
      </span>
      - The
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_autorejoin_tries">
       <code class="literal">
        group_replication_autorejoin_tries
       </code>
      </a>
      system variable was set to specify a number of auto-rejoin
            attempts after a loss of majority or expulsion, and the
            member completed this number of attempts without success.
     </p>
    </li>
   </ol>
  </div>
  <p>
   The following table summarizes the failure scenarios and actions
        in each case:
  </p>
  <div class="table">
   <a name="idm46045131925856">
   </a>
   <p class="title">
    <b>
     Table 20.3 Exit actions in Group Replication failure situations
    </b>
   </p>
   <div class="table-contents">
    <table frame="all" summary="Summarizes how the selected exit action does or does not operate depending on the failure situation">
     <colgroup>
      <col align="left" style="width: 33%"/>
      <col align="left" style="width: 33%"/>
      <col align="left" style="width: 33%"/>
     </colgroup>
     <thead>
      <tr>
       <th scope="col">
        <p>
         Failure situation
        </p>
       </th>
       <th scope="col">
        <p>
         Group Replication started with
         <code class="literal">
          START
                GROUP_REPLICATION
         </code>
        </p>
       </th>
       <th scope="col">
        <p>
         Group Replication started with
         <code class="literal">
          group_replication_start_on_boot =ON
         </code>
        </p>
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <th scope="row">
        <p>
         Member fails local configuration check
        </p>
        <p>
         Mismatch between joining member and group configuration
        </p>
       </th>
       <td>
        <p>
         <code class="literal">
          super_read_only
         </code>
         and
         <code class="literal">
          offline_mode
         </code>
         unchanged
        </p>
        <p>
         MySQL continues running
        </p>
        <p>
         Set
         <code class="literal">
          super_read_only=ON
         </code>
         at startup to
                prevent updates
        </p>
       </td>
       <td>
        <p>
         <code class="literal">
          super_read_only
         </code>
         and
         <code class="literal">
          offline_mode
         </code>
         unchanged
        </p>
        <p>
         MySQL continues running
        </p>
        <p>
         Set
         <code class="literal">
          super_read_only=ON
         </code>
         at startup to
                prevent updates (Important)
        </p>
       </td>
      </tr>
      <tr>
       <th scope="row">
        <p>
         Applier error on member
        </p>
        <p>
         Distributed recovery not possible
        </p>
        <p>
         Group configuration change error
        </p>
        <p>
         Primary election error
        </p>
        <p>
         Unreachable majority timeout
        </p>
        <p>
         Member expelled from group
        </p>
        <p>
         Out of auto-rejoin attempts
        </p>
       </th>
       <td>
        <p>
         <code class="literal">
          super_read_only
         </code>
         set to
         <code class="literal">
          ON
         </code>
        </p>
        <p>
         OR
        </p>
        <p>
         <code class="literal">
          offline_mode
         </code>
         and
         <code class="literal">
          super_read_only
         </code>
         set to
         <code class="literal">
          ON
         </code>
        </p>
        <p>
         OR
        </p>
        <p>
         MySQL shuts down
        </p>
       </td>
       <td>
        <p>
         <code class="literal">
          super_read_only
         </code>
         set to
         <code class="literal">
          ON
         </code>
        </p>
        <p>
         OR
        </p>
        <p>
         <code class="literal">
          offline_mode
         </code>
         and
         <code class="literal">
          super_read_only
         </code>
         set to
         <code class="literal">
          ON
         </code>
        </p>
        <p>
         OR
        </p>
        <p>
         MySQL shuts down
        </p>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
 </div>
 <br/>
</div>
