Message-ID: <4BAB3A51.5050707@enterprisedb.com>
Date: Thu, 25 Mar 2010 12:26:25 +0200
From: Heikki Linnakangas <heikki.linnakangas@enterprisedb.com>
Organization: EnterpriseDB
User-Agent: Mozilla-Thunderbird 2.0.0.22 (X11/20090706)
MIME-Version: 1.0
To: Simon Riggs <simon@2ndQuadrant.com>
CC: Tom Lane <tgl@sss.pgh.pa.us>, Fujii Masao <masao.fujii@gmail.com>,
	Aidan Van Dyk <aidan@highrise.ca>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: Re: [COMMITTERS] pgsql: Make standby server continuously
	retry restoring the next WAL
References: <3f0b79eb1002092105r21e009d3v468496058ba04392@mail.gmail.com>	
	<4B743E7D.5070603@enterprisedb.com>	
	<3f0b79eb1002180337t1fab1395ve3491256672af15f@mail.gmail.com>	
	<4BA0B079.3050301@enterprisedb.com>	
	<3f0b79eb1003180727g7877743eq81274e014fe70a49@mail.gmail.com>	
	<1268988724.3556.3.camel@ebony>
	<4BA361E4.7020309@enterprisedb.com>	
	<3f0b79eb1003230017v16f4ecbeyc20e75beeffe8f1c@mail.gmail.com>	
	<4BAA060A.2020000@enterprisedb.com>
	<1269472981.8481.8946.camel@ebony>	
	<3f0b79eb1003241908n1e8f38e0q7cd7465163b3d7af@mail.gmail.com>	
	<6198.1269483277@sss.pgh.pa.us> <4BAB1AC1.7000900@enterprisedb.com>
	<1269505427.8481.8978.camel@ebony>
In-Reply-To: <1269505427.8481.8978.camel@ebony>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Simon Riggs wrote:
> On Thu, 2010-03-25 at 10:11 +0200, Heikki Linnakangas wrote:
> 
>> PANIC seems like the appropriate solution for now.
> 
> It definitely is not. Think some more.

Well, what happens now in previous versions with pg_standby et al is
that the standby starts up. That doesn't seem appropriate either.

Hmm, it would be trivial to just stay in the standby mode at a corrupt
file, continuously retrying to restore it and continue replay. If it's
genuinely corrupt, it will never succeed and the standby gets stuck at
that point. Maybe that's better; it's close to what Fujii suggested
except that you don't need a new mode for it.

I'm worried that the administrator won't notice the error promptly
because at a quick glance the server is up and running, while it's
actually stuck at the error and falling indefinitely behind the master.
Maybe if we make it a WARNING, that's enough to alleviate that. It's
true that if the standby is actively being used for read-only queries,
shutting it down to just get the administrators attention isn't good either.

-- 
  Heikki Linnakangas
  EnterpriseDB   http://www.enterprisedb.com