Validation gates

Validation gates turn a completed restore into an explicit pass or failure. Every database schedule requires at least one success criterion.

Gate types

File schedules use file existence plus optional age and size rules rather than database gates.

Configure query probes

For PostgreSQL, MySQL, and MariaDB, enter a read-only SQL statement. For MongoDB, choose a supported typed operation and provide its database, collection, field, filter, or statistic fields as requested.

Choose the result type and comparison:

Give each probe a unique name that explains the condition, such as “orders table has records,” rather than describing the query syntax.

SQL probes run with read-only database access. Return one scalar value that matches the selected result type. Queries are limited to 4,000 characters; backslashes and the standalone keyword system are rejected because client meta-commands are not allowed. MongoDB uses the typed operation fields instead of arbitrary JavaScript.

Each probe has a time limit: 300 seconds unless you set another, at most 3,600 seconds. A query still running at the limit is stopped, and the probe fails with “query exceeded the gate time limit of N s”. Raise the limit for probes that legitimately read a lot of data, such as an exact count over a large collection. For MongoDB the database enforces the limit on the operation itself; collection counts, collection existence, and database statistics can take up to about 10 seconds longer.

The check's overall run limit still applies. Probes run one after another after the restore, so long probe limits can make a check end as Timeout instead of with a failed probe.

Configure duration gates

Duration gates apply to download, restore, or health probes. Add no more than one threshold for each stage. Less than and less than or equal limits can stop an overdue stage rather than waiting for all work to finish; choose limits that allow for normal variation in file size, source speed, and worker load.

RestoreTrust measures a stage from when it receives the worker's start report to when it receives the finish report. When that interval agrees with the worker's duration within 15 seconds or 5 percent of the server interval, whichever is larger, the server interval determines the verdict. If the difference is larger, for example because a finish report arrived late during a service interruption, the gate must pass for both values. A reconnect alone does not invalidate the measurement; timing anomalies remain visible even when the gate passes.

A completed stage without a usable start/finish interval or worker duration fails its gate with "server-side timing not observed". This also covers receive times that are out of order. A violated duration gate produces Probe failure. If a time limit stops a stage, the abort is attributed to that stage; gates for stages that never ran are skipped.

The worker reports every few seconds, so a stage that ends between two reports can measure close to zero. Use greater than limits only on stages that take well over a few seconds, typically the restore. For a download that is usually short, set only an upper limit.

Treat duration gates as operational objectives, not proof of recovery time for your entire application. They measure only the stages performed by this check.

Design strong gates

1. 1

   Require import completion

   Include the successful-import criterion so query results are never interpreted without a completed restore.

2. 2

   Identify critical invariants

   Test data or schema facts that a useful recovery must satisfy, such as a minimum count for a critical entity or a known migration marker.

3. 3

   Use conservative thresholds

   Allow expected data and performance variation while ensuring a stale, empty, or partial backup fails.

4. 4

   Run and review

   Use a manual check against a representative backup. Confirm the probe type and expected value match the actual result, then periodically revisit the criteria as the application changes.

Review results under the check's Probes tab and use Logs when a probe cannot run.