Our application vendor demands that we keep FastStartFailoverPmyShutdown set to true, however this means that the primary will commit suicide if it loses contact with both the standby database and the observer process running on a 3rd machine. This is unacceptable to us because if the primary is still up and running perfectly fine and actively servicing clients, then it is absolutely crucial that it stays up and running despite whatever may be happening on the secondary server or the DG observer server. A very real possible failure mode in our installation would be that the primary could indeed get isolated on a network segment, but its most important clients would also be on that segment with it too, and the rest of the network is much less important. Unfortunately the standby database server, and the server machine upon which the Observer is running both reside on a different network physical segment from the primary. It's not possible for me to add a 4th machine to the same segment as the primary to run an alternate observer there since that segment is 100% full and has no more available physical ports. Running an observer process on one of the regular clients is also Strictly Verboten, as they are all
Even though all the docs advise against running an Observer on the primary or standby servers themselves, would running an alternate Observer on the primary database server itself help avoid the primary database from committing suicide when it's the "last man standing"?
I'm also tempted to just set FastStartFailoverPmyShutdown to false and tell the app vendor they have no further say in the matter.