skip to content

Acks and Durability

The acks=0/1/all trade-off and how it combines with min.insync.replicas to define a committed write. The single most common Kafka durability question.

part ofApache Kafkaoverview, primer and where to startread it →
on this pageshow

questions

5

What do the producer acks settings 0, 1, and all (-1) mean, and how do they trade durability against latency?

level: juniorimportance: must knowfreq 85%

answer

  1. 0 = fire-and-forget
  2. 1 = leader only
  3. all/-1 = full ISR
  4. durability up, latency up
  5. all = committed, 1 = written at leader

basics

~20 s

acks=0 means the producer never waits for acknowledgement (fastest, can lose data). acks=1 waits only for the leader to write the record. acks=all waits for the leader plus all in-sync replicas, giving the strongest durability but the highest latency.

solid answer

~40 s

The producer config `acks` controls how many broker acknowledgements a producer waits for before considering a send successful. `acks=0`: fire-and-forget, the producer doesn't wait at all and assumes success the moment the record leaves the client buffer — lowest latency, no delivery guarantee, records lost on any failure. `acks=1`: the leader replica writes the record to its log and acknowledges immediately, without waiting for followers — moderate latency, but data is lost if the leader fails before a follower replicates it. `acks=all` (alias `acks=-1`): the leader waits until all replicas in the in-sync replica set (ISR) have replicated the record before acknowledging — highest latency, strongest durability. With idempotence enabled (default in modern clients), `acks=all` is the recommended setting for no data loss.

go deeper

for a junior

Memorize the three values and the durability/latency direction: 0 fastest/least safe, all slowest/safest.

for a middle

Explain the leader-crash data-loss window under acks=1 and that all means the ISR, not all replicas.

for a senior

Connect acks=all to committed vs leader-written semantics and the high watermark, and to idempotence requiring acks=all.

for a principal

Frame acks as one knob in a durability budget alongside min.insync.replicas, replication.factor, and unclean.leader.election for an org-wide reliability standard.

## What `acks` is In Apache Kafka, a producer sends records to a **partition**, which is replicated across several **brokers**. One broker is the **leader** for that partition (handles all reads/writes); the others are **followers** that copy the leader's log. The set of replicas currently caught up to the leader is the **in-sync replica set (ISR)**. The producer config `acks` (set on `ProducerConfig.ACKS_CONFIG`) decides how many acknowledgements the producer waits for before its `send()` future completes successfully. ### `acks=0` — fire and forget The producer does **not** wait for any response from the broker. It considers the record sent as soon as it is written to the client's socket buffer. Lowest latency and highest throughput, but **any** failure (network drop, broker down, leader change) silently loses the record. Retries are meaningless because the producer never learns of failures. Use only for tolerable-loss telemetry/metrics. ### `acks=1` — leader acknowledgement The **leader** writes the record to its local log and immediately acknowledges, **without** waiting for followers. If the leader crashes after acknowledging but before a follower replicated the record, that record is **lost** — a classic window of data loss. Good latency, partial durability. ### `acks=all` (a.k.a. `acks=-1`) — full ISR acknowledgement The leader waits until **every replica in the ISR** has fetched and appended the record before acknowledging. Combined with `min.insync.replicas` this gives a tunable durability floor (see follow-ups). This is the only setting that guarantees no acknowledged record is lost as long as at least one ISR member survives. It costs an extra replication round-trip of latency. ### Important nuance: committed vs written A record acknowledged under `acks=all` is **committed** — visible to consumers and durable across the ISR. Under `acks=1` it is merely **written at the leader** and only becomes committed once followers catch up. Consumers only ever read up to the **high watermark** (the offset replicated to all ISR members), so they never see uncommitted records regardless of `acks`. ### Edge cases - With idempotent producers (`enable.idempotence=true`, default since 3.0), Kafka **requires** `acks=all`; setting `acks=0/1` with idempotence throws a config error. - `acks=all` does **not** mean 'all replicas' — it means all **in-sync** replicas. If the ISR has shrunk to just the leader, `acks=all` behaves like `acks=1` unless `min.insync.replicas` forbids it.

  • Why is acks=1 still vulnerable to data loss?
    The leader acknowledges before followers replicate. If the leader crashes during that window and a follower without the record becomes the new leader, the record is permanently lost.
  • Does acks=all wait for all replicas or all in-sync replicas?
    All in-sync replicas (the ISR), not all assigned replicas. A replica that has fallen behind is removed from the ISR and isn't waited on.

saying these in an interview costs you the question

  • Saying acks=all waits for every assigned replica regardless of ISR membership.
  • Claiming acks=0 supports retries or delivery guarantees.
  • Confusing acks=2 as a valid value — only 0, 1, and all/-1 exist.
  • Saying acks controls how many partitions are written, not replicas.

context

open as a page

How do acks=all, min.insync.replicas, and replication.factor work together to define a durability guarantee?

level: middleimportance: must knowfreq 80%

basics

~20 s

replication.factor sets how many copies of each partition exist. min.insync.replicas sets how many in-sync copies must acknowledge a write under acks=all. Only acks=all enforces min.insync.replicas; together they define how many failures the system tolerates without losing acknowledged data.

open as a page

When is a produced record considered 'committed', and how does that differ from being written at the leader? What role does the high watermark play?

level: seniorimportance: should knowfreq 60%

basics

~20 s

A record is 'written at the leader' once the leader appends it to its log. It becomes 'committed' only once all in-sync replicas have replicated it — at which point the high watermark advances. Consumers only read up to the high watermark, so they never see uncommitted records.

open as a page

Explain the NotEnoughReplicas and NotEnoughReplicasAfterAppend errors: when does each occur, are they retriable, and how should a producer handle them?

level: seniorimportance: should knowfreq 45%

basics

~20 s

Both occur with acks=all when the in-sync replica count is below min.insync.replicas. NotEnoughReplicas is raised before the leader appends the record; NotEnoughReplicasAfterAppend is raised after appending but before full replication. Both are retriable, so the producer retries until enough replicas rejoin the ISR.

open as a page

Design an end-to-end no-data-loss producer/topic configuration. Beyond acks=all, what settings are required and what failure modes remain?

level: principalimportance: should knowfreq 40%

basics

~20 s

Use acks=all with enable.idempotence=true on the producer, replication.factor=3 and min.insync.replicas=2 on the topic, and unclean.leader.election.enable=false on the brokers. Handle send failures (don't drop them) and bound delivery.timeout.ms. Remaining risks: simultaneous loss of all ISR replicas and consumer-side processing gaps.

open as a page