My two synchronous-commit SQL AO replicas are set for manual failover mode but are failing over automatically. When I look through the logs and extended events, it looks just like what would happen if it were set automatically. This was set before a time when I was out of this office and the servers have been rebooted multiple times for updates, so I know the service account isn't waiting for a restart. Manual failover works but unsure why automatic is happening. There were 4 nodes, but the 2 remote DR nodes are currently removed both from SQL AOAG and WSFC. Any advice on where to look to figure this out?
1 Answer
A reboot of a cluster node that has a resource group that's configured to automatically start forces the WSFC to start that resource on a surviving node, implementing HA feature of SQL Server AAG. This action also triggers SQL Server instance to promote an existing synchronous secondary replica to primary. I think you can avoid automatic failover by setting only one replica to be synchronous, however this will effectively make you lose data should you irreversibly lose the cluster node with the primary replica.
