Cold, warm, and hot standby: why reliability costs vary

When a contractor says “you have a backup configured”, that doesn’t answer the main question: how long will the business be down without a working system and how much recent data will it lose. The answer depends on which of the three kinds of standby is actually meant — and the types differ in price not by a percentage, but by orders of magnitude.

Three words that save an awkward conversation with accounting

Cold standby (cold). A copy of the data sits separately from the main system and is not connected to anything — a database dump file, an archive, a disk snapshot. To use it, you need to manually bring up a new server, deploy the copy on it and only then start. Between the failure and return to operation — hours, sometimes a day: time is spent not on the copy itself, but on assembling a working system around it.

Warm standby (warm). A second server already exists and receives all changes from the primary in real time — this is replication, explained technically in a separate article about MySQL and PostgreSQL. The data on it is fresh, but it does not serve users, and switching to it is a human manual decision, not automation. Between the failure and return to operation — minutes: you need time to notice the problem, make a decision and click the switch, but not to assemble the system from scratch.

Hot standby (hot). The second server not only receives data, but is actively ready to take traffic itself, and switching happens automatically, without human involvement — seconds, sometimes less. This is the “cluster with automatic failover” that people most often think of when they hear the word “fault tolerance”, although only a minority of systems that need it actually reach this level.

How this translates into costs

The three kinds of standby are not three degrees of the same work, but three different solutions, and the price grows non-linearly.

Cold standby costs almost nothing beyond the storage of the copy itself: disk space and, maybe, the cost of transferring the file. Warm adds a continuously running second server — so the hosting bill doubles regardless of whether a failure occurs. Hot adds to that a system that continuously monitors the state of both servers and can decide which one is primary — and such a system itself requires resources, configuration and, less obviously, the qualification to support it: a misconfigured automatic failover is more dangerous than its absence, because it can fail over for no reason or, worse, fail over in both directions at once.

Hence a practical rule that saves budget more often than it spends it: paying for warm when cold is enough is a common, unnoticed item of unnecessary expense; paying for hot when warm is enough is the same mistake, only orders of magnitude more expensive.

How to choose without guessing

The choice between the three kinds is not made by taste — it follows directly from two numbers that have names: RTO (how long you can be down) and RPO (how much recent data you can afford to lose). A separate article is devoted to these two numbers: cold standby covers RTO measured in hours, warm — in minutes, hot — in seconds. If the real loss from several hours of downtime has been calculated and fits a reasonable amount, buying protection against downtime measured in seconds is not prudence, but an expense that no one will notice except the hosting bill. The same logic is discussed more broadly in the article about the four levels of fault tolerance — standby types describe the technique, and the levels describe at what point in a product’s life which technique is justified.

Separately, two similar words that even experienced managers confuse should be distinguished: warm and hot standby are about equipment failure, while a backup in the usual sense (an archive that can be restored to any moment in the past) is protection against human error, not against failure, and is always needed regardless of which of the three standby types is chosen for the rest. Replication faithfully repeats any error made on the primary to the standby within seconds — this is explained separately, and there it is also explained why a backup that no one has restored cannot be trusted, whether cold or warm.

A short checklist for talking to a contractor: ask not “is there a backup”, but “which of the three” — and then immediately “how much will downtime cost in minutes for warm versus seconds for hot”. The answer to the second question almost always settles the budget question by itself.