One of the most basic preventions is introducing redundancy. Similar to how you can have a spare tire for your car, you can have a backup service that takes over when your primary server goes down. This stepping-in is also known as failover.
How does the backup server know when to step in? One way to implement this is by using the heartbeat mechanism described in the Detecting faults section.
To make the switch faster, you can send all the messages that are going into the primary server also to the backup one. This is called a hot standby, as opposed to a cold one – initializing from zero. A good idea in such a case is to stay one message behind, so if a poisoned message kills the primary server, the backup one can simply reject it.
The preceding mechanism is called an active-passive (or master-slave) failover, as the backup server doesn't handle incoming traffic. If it did, we would have an active-active (or master-master) failover. For more on active-active...
