---
title: "Losing two Kafka brokers with min.insync.replicas=2"
description: "An RF=3 acks=all partition loses broker-2, re-elects a leader and keeps writing. Losing broker-3 drops the Kafka ISR below the floor until broker-2 restarts."
url: https://monedula.dev/kafka-simulator/scenarios/losing-two-brokers/
---

# Losing two Kafka brokers with min.insync.replicas=2

Scenario 03.2.1 · Canonical failure. Replication · Intermediate · about 2 min · Apache Kafka 4.3.

Kill broker-2, then broker-3 under acks=all + min.ISR=2.

Run it: https://monedula.dev/kafka-simulator/playground/?scenario=03.2.1

## What you start with

The canonical durability setup: a 3-replica partition with acks=all and min.insync.replicas=2. Brokers are killed one after another while a producer writes, walking the partition from healthy, to degraded-but-writable, to below min.ISR.

## Step by step

1. **Cluster ready** (t+0.000s) [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=03.2.1&t=0)
2. **Produce committed** (t+4.250s) [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=03.2.1&t=1)
3. **broker-2 hard kill** (t+8.500s): broker-2 is offline. ISR shrinks on every partition it replicated to. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=03.2.1&t=2)
4. **Leader re-elected** (t+9.000s) [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=03.2.1&t=3)
5. **broker-3 hard kill** (t+14.800s): Below min.insync.replicas - ISR is down to 1. Any acks=all write would now be refused with NotEnoughReplicas until a replica returns. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=03.2.1&t=4)
6. **Recovery (broker-2 restart)** (t+22.000s): broker-2 rejoined; ISR is back to 2 on every partition. broker-3 is still down. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=03.2.1&t=5)

## The takeaway

As long as the ISR holds at least min.insync.replicas the partition keeps accepting acks=all writes; the second failure drops it below the floor and writes are refused until a replica returns.

## Configs in this scenario

- [`acks`](https://kafka.apache.org/43/configuration/producer-configs/#producerconfigs_acks): How many replicas must have a write before the producer counts it as sent: 0 (none), 1 (the leader only) or all (every in-sync replica, the default, and required for idempotence). [How acks works](https://monedula.dev/kafka-simulator/configs/acks/)
- [`min.insync.replicas`](https://kafka.apache.org/43/configuration/topic-configs/#topicconfigs_min.insync.replicas): The fewest in-sync replicas, leader included, that must have a write for an acks=all produce to succeed (default 1); with fewer in the ISR the leader rejects the write with NOT_ENOUGH_REPLICAS. [How min.insync.replicas works](https://monedula.dev/kafka-simulator/configs/min-insync-replicas/)

## Further reading

- [Apache Kafka documentation](https://kafka.apache.org/43/design/design/#replication)