Emergency DBA · 24×7×365 · Severity 1 acknowledged in 15 minutes · PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, Db2, MongoDB, ClickHouse, Redis and cloud DBaaS
Emergency DBA Services for Production Databases That Cannot Stay Down
MinervaDB emergency DBA services put a principal-level database engineer on your incident within 15 minutes of a Severity 1 page, day or night. We measure before we touch anything, state the blast radius and rollback path before every change, and stay on the incident until service, data and replication are back to normal. Then we find the root cause and fix it, so the same page does not wake anyone up again.
01 · How an emergency DBA engagement runs
The emergency DBA incident lifecycle, from page to prevention
Database emergencies rarely announce their cause. A lock pile-up looks like slow application servers, a full disk looks like a crashed primary, and replication lag looks like missing orders. Our emergency DBA process is built to replace guesswork with measurement in the first minutes.
Acknowledge and triage
A named emergency DBA acknowledges the Severity 1 page within 15 minutes and starts with evidence: wait events, lock chains, replication state, storage and the last change that shipped.
Stabilise, then recover
We take the smallest reversible action that stops the damage spreading, such as cancelling one runaway statement, before we consider failover, point-in-time recovery or a rebuild.
Verify and prevent
Validation queries confirm the fix. A written root cause analysis follows, with the permanent fix, the alert that would have fired earlier and an updated runbook.
Severity matrix for MinervaDB emergency DBA support
| Severity | Definition | Acknowledgement |
|---|---|---|
| S1 | Production down or data at risk; business halted | 15 minutes, 24×7×365 |
| S2 | Production seriously degraded; a workaround exists | 12 hours |
| S3 | Non-critical fault or performance issue | 24 hours |
| S4 | Question, advice or planned change | 48 hours |
02 · Architecture
Designing for recovery before the emergency DBA is ever paged
The fastest incident is the one with a known way out. Recovery point objective (RPO) and recovery time objective (RTO) only mean something when they are written in business terms and proven by a restore or failover that someone actually ran.
Every engine has its own failover mechanics, and an emergency DBA has to know them cold. We design and review these topologies so the failover target, the restore point and the connection switch are decided long before an outage forces the question.
| Engine | High availability we design and operate | Point-in-time recovery source |
|---|---|---|
| PostgreSQL | Streaming replication with Patroni, synchronous standbys, PgBouncer | WAL archive with pgBackRest or Barman |
| MySQL | Group Replication and InnoDB Cluster, ProxySQL or MySQL Router | Binary logs with Percona XtraBackup or MySQL Enterprise Backup |
| MariaDB | Galera Cluster or asynchronous replication behind MaxScale | Binary logs with mariadb-backup |
| SQL Server | Always On availability groups and failover cluster instances | Full, differential and transaction log backups |
| Oracle | Data Guard and Active Data Guard, RAC where justified | RMAN with archived redo logs |
| Db2 | HADR with Pacemaker on LUW; data sharing on z/OS | Archive logging with online backups |
| MongoDB | Replica sets with majority write concern, sharded clusters | Oplog with snapshot backups |
| ClickHouse | ReplicatedMergeTree with ClickHouse Keeper quorum | Part-level backups to object storage |
| Redis | Redis Sentinel or Redis Cluster; Valkey equivalents | RDB snapshots and AOF |
Synchronous replication protects data and costs write latency; asynchronous replication protects latency and can lose the last transactions. Choosing between them is a business decision, and we put the trade-off in front of you in plain terms.
03 · Engineering
First-fifteen-minute triage scripts our emergency DBA engineers run
These are the read-only queries we run first on each engine. They change nothing, return in seconds, and tell us whether we are looking at locking, replication, resource exhaustion or a bad plan. Credentials are always placeholders; we never paste secrets into a bridge or a script.
PostgreSQL: lock chains and wraparound headroom
The blocking tree uses pg_blocking_pids(), documented in the PostgreSQL system information functions. The second query shows how close each database is to transaction ID wraparound, the one PostgreSQL emergency that forces downtime if it is ignored.
-- PostgreSQL 14+: who is blocking whom, longest wait first
SELECT
blocked.pid AS blocked_pid,
blocked.usename AS blocked_user,
NOW() - blocked.query_start AS blocked_for,
blocking.pid AS blocking_pid,
blocking.state AS blocking_state,
NOW() - blocking.xact_start AS blocking_xact_age,
LEFT(blocking.query, 120) AS blocking_query
FROM pg_stat_activity AS blocked
CROSS JOIN LATERAL UNNEST(pg_blocking_pids(blocked.pid)) AS b(pid)
JOIN pg_stat_activity AS blocking
ON blocking.pid = b.pid
ORDER BY blocked_for DESC;
-- Transaction ID wraparound headroom per database
SELECT
datname,
AGE(datfrozenxid) AS xid_age,
ROUND(100.0 * AGE(datfrozenxid) / 2147483647, 1) AS pct_of_hard_limit
FROM pg_database
ORDER BY xid_age DESC;
MySQL and MariaDB: InnoDB lock waits, replication and Galera
sys.innodb_lock_waits pairs every waiting transaction with its blocker; see the MySQL 8.4 reference. Note the column names that differ between MySQL and MariaDB.
-- MySQL 8.0 / 8.4 (MariaDB 10.6+ ships the sys schema too): current InnoDB lock waits
SELECT
wait_age,
locked_table,
waiting_pid,
LEFT(waiting_query, 100) AS waiting_query,
blocking_pid,
LEFT(blocking_query, 100) AS blocking_query,
sql_kill_blocking_query
FROM sys.innodb_lock_waits
ORDER BY wait_age_secs DESC;
-- Replication health. MySQL 8.0.22+ and MariaDB 10.5.1+ accept the REPLICA keyword;
-- MySQL reports Seconds_Behind_Source, MariaDB reports Seconds_Behind_Master.
SHOW REPLICA STATUS\G
-- MariaDB Galera: is this node part of the primary component, and is flow control throttling writes?
SHOW GLOBAL STATUS
WHERE Variable_name IN (
'wsrep_cluster_status',
'wsrep_cluster_size',
'wsrep_local_state_comment',
'wsrep_flow_control_paused'
);
SQL Server: blocking and availability group queues
Blocking comes from sys.dm_exec_requests; the availability group query shows whether a secondary is safe to fail over to before anyone presses the button.
-- SQL Server 2016+: requests that are blocked, and the sessions blocking them
SELECT
r.session_id,
r.blocking_session_id,
r.wait_type,
r.wait_time / 1000.0 AS wait_s,
r.status,
DB_NAME(r.database_id) AS database_name,
LEFT(t.text, 200) AS sql_text
FROM sys.dm_exec_requests AS r
CROSS APPLY sys.dm_exec_sql_text(r.sql_handle) AS t
WHERE r.blocking_session_id <> 0
ORDER BY r.wait_time DESC;
-- Always On availability group health: send and redo queues per database (KB)
SELECT
ag.name AS ag_name,
ar.replica_server_name,
DB_NAME(drs.database_id) AS database_name,
drs.synchronization_state_desc,
drs.synchronization_health_desc,
drs.log_send_queue_size AS log_send_queue_kb,
drs.redo_queue_size AS redo_queue_kb
FROM sys.dm_hadr_database_replica_states AS drs
JOIN sys.availability_replicas AS ar
ON ar.replica_id = drs.replica_id
JOIN sys.availability_groups AS ag
ON ag.group_id = drs.group_id
ORDER BY drs.log_send_queue_size DESC;
Oracle: blocking sessions and Data Guard lag
We start from V$SESSION because it needs no extra licence. Active Session History and AWR require the Oracle Diagnostics Pack, so we confirm that entitlement before we query them.
-- Oracle 19c / 23ai: blocking chains from V$SESSION (no Diagnostics Pack required)
SELECT
s.sid,
s.serial#,
s.username,
s.blocking_session,
s.event,
ROUND(s.wait_time_micro / 1e6, 1) AS wait_s,
s.sql_id
FROM v$session s
WHERE s.blocking_session IS NOT NULL
ORDER BY s.wait_time_micro DESC;
-- Data Guard: transport and apply lag on the standby
SELECT name, value, time_computed
FROM v$dataguard_stats
WHERE name IN ('transport lag', 'apply lag');
Db2: lock waits and HADR state
On Db2 for LUW the monitoring views answer the locking question directly. On Db2 for z/OS, triage runs through DISPLAY THREAD and DISPLAY DATABASE commands with your systems programmers.
-- Db2 11.5 / 12.1 for LUW: current lock waits, longest first
SELECT
hld_application_handle,
req_application_handle,
tabschema,
tabname,
lock_object_type,
lock_mode,
lock_wait_elapsed_time
FROM sysibmadm.mon_lockwaits
ORDER BY lock_wait_elapsed_time DESC;
-- HADR state, log gap and standby replay delay (run on the primary host)
-- db2pd -db ${DB2_DBNAME} -hadr
MongoDB: long-running operations and replica set lag
The $currentOp aggregation stage finds what is holding the cluster, and the replica set view shows whether a secondary is far enough behind to make failover lose writes.
// MongoDB 6.0+ (mongosh): operations running longer than 30 seconds
db.getSiblingDB("admin").aggregate([
{ $currentOp: { allUsers: true, idleConnections: false } },
{ $match: { active: true, secs_running: { $gt: 30 } } },
{ $project: { opid: 1, secs_running: 1, op: 1, ns: 1, waitingForLock: 1, "command.comment": 1 } },
{ $sort: { secs_running: -1 } }
]);
// Replica set health and secondary lag
rs.status().members.map(m => ({ name: m.name, state: m.stateStr, optime: m.optimeDate }));
rs.printSecondaryReplicationInfo();
ClickHouse: runaway queries and replication backlog
ClickHouse emergencies are handled with our sister company ChistaDATA, whose engineers run ClickHouse in production every day. These are the first two system tables they read.
-- ClickHouse 24.x / 25.x: queries running longer than 60 seconds
SELECT
query_id,
user,
elapsed,
formatReadableSize(memory_usage) AS memory,
substring(query, 1, 120) AS query_head
FROM system.processes
WHERE elapsed > 60
ORDER BY elapsed DESC;
-- Replication backlog per table, with failing entries counted separately
SELECT
database,
table,
count() AS queued,
countIf(last_exception != '') AS with_errors,
max(num_tries) AS max_tries
FROM system.replication_queue
GROUP BY database, table
ORDER BY queued DESC;
Redis and Valkey: replication, memory and slow commands
Most Redis emergencies are memory pressure, an eviction storm or one slow command blocking the single-threaded event loop. Five commands usually tell us which.
# Redis 7.x / Valkey 8.x: credentials come from the environment, never the command line
export REDISCLI_AUTH="${REDIS_PASSWORD}"
redis-cli -h "${REDIS_HOST}" INFO replication # role, connected replicas, link status, offsets
redis-cli -h "${REDIS_HOST}" INFO memory | grep -E 'used_memory_human|maxmemory_human|maxmemory_policy|mem_fragmentation_ratio'
redis-cli -h "${REDIS_HOST}" INFO stats | grep -E 'evicted_keys|rejected_connections|instantaneous_ops_per_sec'
redis-cli -h "${REDIS_HOST}" SLOWLOG GET 10 # slowest recent commands
redis-cli -h "${REDIS_HOST}" LATENCY DOCTOR # needs latency-monitor-threshold > 0
04 · Operations
How an emergency DBA changes production safely under pressure
The riskiest moment in an outage is the change that was meant to fix it. Our emergency DBA runbooks make every production change explicit, approved and reversible, even at three in the morning.
The confirmation gate in practice
This is how we end a blocking session on PostgreSQL. A verification query confirms the target, the change waits for approval in the incident bridge, the gentler cancel comes before the terminate, and a validation query proves the result.
-- Verification before: confirm the target is the blocker found above SELECT pid, usename, state, NOW() - xact_start AS xact_age, LEFT(query, 120) AS query_head FROM pg_stat_activity WHERE pid = :blocking_pid; -- CONFIRMATION GATE: run only after the incident lead approves in the bridge. -- Cancel the statement first; terminate the session only if cancelling does not clear it. SELECT pg_cancel_backend(:blocking_pid); -- SELECT pg_terminate_backend(:blocking_pid); -- Validation after: blocked sessions should drain to zero SELECT COUNT(*) AS still_blocked FROM pg_stat_activity WHERE CARDINALITY(pg_blocking_pids(pid)) > 0;
What runs alongside the technical work
- An incident lead owns the timeline and decisions, so the engineer at the keyboard can concentrate on the database.
- Status updates go to your stakeholders on a cadence agreed at the start of the incident.
- Every command and its output is kept in the incident record, which becomes the basis of the root cause analysis.
- Failover, restore and any data-changing command needs your explicit approval in the bridge.
- If the cause sits with a cloud provider, we open the ticket with the evidence already attached.
For customers on a remote DBA retainer, access, contacts and runbooks are agreed in advance, which is why the first fifteen minutes go to the database instead of to paperwork.
05 · Production engineering
After the emergency DBA work: root cause, SLOs and alerts that fire earlier
Restoring service closes the incident. It does not close the risk. Production engineering is the part of the emergency DBA engagement that turns one bad night into a permanent improvement.
Alert on leading indicators, not on CPU
Most of the incidents we are called into were visible minutes or hours earlier in lock waits, replication lag or connection saturation. On PostgreSQL, replication lag is exposed as time, which makes it straightforward to set a service level objective on it.
-- PostgreSQL 10+: replication lag as time, the leading indicator to alert on
SELECT
application_name,
client_addr,
state,
sync_state,
write_lag,
flush_lag,
replay_lag
FROM pg_stat_replication
ORDER BY replay_lag DESC NULLS LAST;
What the root cause analysis contains
- A timeline from first symptom to full recovery, built from the incident record.
- The technical cause and the conditions that allowed it, including any change that shipped beforehand.
- The permanent fix, with its own blast radius and rollback path.
- The service level objective and alert that would have warned earlier.
- Failover and restore drills scheduled so the recovery path stays proven.
Customers who want this discipline running continuously use our consultative database support, where the same engineers own reliability between incidents.
06 · Cloud DBaaS
Emergency DBA support for Amazon RDS, Aurora, Azure, Cloud SQL and Atlas
Managed databases still have emergencies. The provider keeps the hardware and the engine patched; it does not rewrite your queries, size your parameters or decide which point in time to restore to. That work belongs to the emergency DBA.
Restore beside, never over
A point-in-time restore on a managed service always goes to a new instance, so the damaged one stays available for comparison and for any data the restore point missed. These are the commands we use on the three largest clouds.
# Amazon RDS: what the service itself recorded in the last two hours
aws rds describe-events \
--source-type db-instance \
--source-identifier "${DB_INSTANCE_ID}" \
--duration 120
# Point-in-time restore to a NEW instance, never over the original
# (Aurora uses restore-db-cluster-to-point-in-time instead)
aws rds restore-db-instance-to-point-in-time \
--source-db-instance-identifier "${DB_INSTANCE_ID}" \
--target-db-instance-identifier "${DB_INSTANCE_ID}-pitr" \
--restore-time "${RESTORE_TIME_UTC}"
# Azure Database for PostgreSQL flexible server: restore to a new server
az postgres flexible-server restore \
--resource-group "${RESOURCE_GROUP}" \
--name "${NEW_SERVER_NAME}" \
--source-server "${SOURCE_SERVER_NAME}" \
--restore-time "${RESTORE_TIME_UTC}"
# Google Cloud SQL: clone to a point in time as a new instance
gcloud sql instances clone "${SOURCE_INSTANCE}" "${SOURCE_INSTANCE}-pitr" \
--point-in-time="${RESTORE_TIME_UTC}"
What we bring to a managed-database incident
- Diagnosis inside the engine: locks, waits, plans and parameters the provider console does not explain.
- A decision on the restore point, made with you, before any restore is started.
- Provider tickets raised with evidence, so they are escalated on facts.
- Cut-over planning for connection strings, DNS and application configuration.
For AWS estates specifically, see Amazon RDS support.
07 · FinOps
What an emergency costs, and how the emergency DBA brings it back down
The quickest way out of some incidents is more capacity: a larger instance class, more provisioned IOPS, an extra replica. That is often the right call during the outage. It becomes waste when nobody reverses it afterwards.
Measure the incident window
After every incident that involved a scale-up, we pull the spend for the incident window by usage type and agree which changes stay and which are rolled back.
# Daily Amazon RDS spend across the incident window, split by usage type
aws ce get-cost-and-usage \
--time-period Start="${WINDOW_START}",End="${WINDOW_END}" \
--granularity DAILY \
--metrics UnblendedCost \
--filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon Relational Database Service"]}}' \
--group-by Type=DIMENSION,Key=USAGE_TYPE
Right-size once the system is stable
- Return instance classes and storage performance to what the measured workload needs.
- Remove replicas and snapshots that were created only for the recovery.
- Fix the query or the index that caused the spike, so the capacity is not needed next time.
- Review reserved capacity and savings plans against the post-incident baseline.
Ongoing cost work sits with our cloud database optimization and FinOps practice.
08 · Engines
One emergency DBA team for every engine in your estate
Mixed estates are normal. The incident that starts in the cache often ends in the relational database behind it, so we keep specialists for every engine on the same rota and the same bridge.
PostgreSQL
Lock chains, autovacuum and wraparound, replication slots, Patroni failover, PgBouncer saturation.
MySQL
InnoDB lock waits and deadlocks, replication breakage, Group Replication quorum, disk full on binary logs.
MariaDB
Galera flow control and split brain, MaxScale routing, replication recovery with mariadb-backup.
SQL Server
Blocking chains, availability group failover, transaction log growth, tempdb contention.
Oracle
Blocking sessions, Data Guard switchover, archive destination full, undo and temp exhaustion.
Db2
Lock escalation and timeouts, HADR takeover, log full conditions on LUW and z/OS.
MongoDB
Primary elections, replication lag, WiredTiger cache pressure, runaway aggregations.
ClickHouse
Too many parts, stuck mutations, Keeper quorum loss, replication queue backlog, with ChistaDATA.
Redis
Memory pressure and eviction storms, replica resynchronisation, slow commands blocking the event loop.
Every major cloud DBaaS is covered as well, including Amazon RDS and Aurora, Azure SQL, Azure Database for PostgreSQL and MySQL, Google Cloud SQL and AlloyDB, and MongoDB Atlas.
09 · FAQ
Emergency DBA questions we are asked most often
If your question is not here, call us. During an incident the fastest answer is a conversation with an emergency DBA.
What is an emergency DBA service?
An emergency DBA service puts a senior database engineer on your production incident when the database is down, degraded or at risk of data loss. At MinervaDB the same engineer measures the problem, makes the smallest safe change, restores service and data, and then works through the root cause so the incident does not repeat.
How fast does the MinervaDB emergency DBA team respond?
Under a MinervaDB support agreement, a Severity 1 incident is acknowledged within 15 minutes, 24×7×365. Severity 2 is acknowledged within 12 hours, Severity 3 within 24 hours and Severity 4 within 48 hours. Acknowledgement means a named engineer is working the incident, not an automated reply.
We are not a MinervaDB customer yet. Can you still help during an outage?
Call us. The 15-minute Severity 1 commitment applies to customers whose access, runbooks and contacts are set up in advance, because that preparation is what makes the response time achievable. If you are not onboarded yet, we will tell you plainly how quickly we can engage and what access we need to start.
Which databases and cloud services does your emergency DBA cover?
PostgreSQL, MySQL, MariaDB, Microsoft SQL Server, Oracle, IBM Db2, MongoDB, ClickHouse, Redis and Valkey, plus the managed services that run them: Amazon RDS and Aurora, Azure SQL and Azure Database for PostgreSQL and MySQL, Google Cloud SQL and AlloyDB, MongoDB Atlas and the other major cloud DBaaS platforms. ClickHouse incidents are handled with our sister company ChistaDATA.
Will your engineers change our production database during an incident?
Only with approval. Before any change we state the blast radius and the rollback path in the incident bridge. Destructive commands such as terminating sessions, failing over or restoring carry an explicit confirmation gate, a verification query before and a validation query after.
Do you handle emergencies on managed databases such as Amazon RDS, Azure or Cloud SQL?
Yes. The provider owns the hardware, host patching and the managed failover mechanics. We own the diagnosis of queries, locks, waits and parameters, the point-in-time restore runbook and the evidence we attach to any provider support ticket so it is escalated with facts rather than symptoms.
What happens after the emergency is over?
We deliver a written root cause analysis with a timeline, the permanent fix, updated runbooks and alerts on the leading indicators that would have warned earlier. We also review what the incident cost, including any emergency scale-up, and right-size once the system is stable.
How is an emergency DBA different from a remote DBA retainer?
An emergency DBA engagement is about the incident in front of you. A remote DBA retainer is the standing relationship that prevents most incidents and shortens the rest, because the engineers already know your topology, your change history and your recovery points.
Need an emergency DBA right now?
Call us and tell us what you see: the error, the time it started and the last change that shipped. A senior emergency DBA will start the triage with you on the call.