Date: Fri, 10 Mar 2023 18:39:40 +0100 (CET)
From: Erik Wienhold <ewie@ewie.name>
To: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Message-ID: <509806252.274449.1678469980651@office.mailbox.org>
Subject: LOG: could not rename temporary statistics file
 "pg_stat_tmp/global.tmp" to "pg_stat_tmp/global.stat"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Importance: Normal
Archived-At: 
 <https://www.postgresql.org/message-id/509806252.274449.1678469980651%40office.mailbox.org>
Precedence: bulk

I manage two Postgres instances (12.14 and 14.7) on a Windows 10
server at work.  Both instances are regular EnterpriseDB installations.

Lately, I see the following log messages on both instances:

	2023-03-07 02:37:08.171 CET [4624] LOG: could not rename temporary statistics file "pg_stat_tmp/global.tmp" to "pg_stat_tmp/global.stat": Permission denied
	2023-03-07 02:37:11.874 CET [3656] LOG: using stale statistics instead of current ones because stats collector is not responding

Both messages appear at irregular intervals.  The first message every few
minutes.  The second message every few hours.

The "permission denied" message apparently is caused by another process having
an open file handle at the same time, likely some antivirus software scanning
the system.

What's the impact of this on Postgres, besides using stale statistics, if this
does not get resolved?  I assume the file will be renamed eventually once no
other process has an open file handle and the statistics will eventually be
refreshed.

The log messages appeared after a server admin switched from Symantec Endpoint
Protection to Cortex XDR.  I had the admin exclude Postgres from the scan and
they disabled Cortex XDR entirely.  But the messages still appear, although
less frequently.  I doubt that Cortex XDR is fully disabled because it's still
writing its event log.  But its UI says disabled.

The switch to Cortex XDR was triggered because something deleted pg_ctl.exe
from my Postgres 14 instance.  I still don't know what caused that.  But the
admin had the brilliant idea of replacing one snake oil with another.  Maybe
it's unrelated to the snake oil but I haven't received any further info on
possible causes from the admin.

--
Erik