Message-ID: <4BAB3F2B.9030405@enterprisedb.com>
Date: Thu, 25 Mar 2010 12:47:07 +0200
From: Heikki Linnakangas <heikki.linnakangas@enterprisedb.com>
Organization: EnterpriseDB
User-Agent: Mozilla-Thunderbird 2.0.0.22 (X11/20090706)
MIME-Version: 1.0
To: Simon Riggs <simon@2ndQuadrant.com>
CC: Tom Lane <tgl@sss.pgh.pa.us>, Fujii Masao <masao.fujii@gmail.com>,
	Aidan Van Dyk <aidan@highrise.ca>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: Re: [COMMITTERS] pgsql: Make standby server continuously
	retry restoring the next WAL
References: <3f0b79eb1002092105r21e009d3v468496058ba04392@mail.gmail.com>	
	<4B743E7D.5070603@enterprisedb.com>	
	<3f0b79eb1002180337t1fab1395ve3491256672af15f@mail.gmail.com>	
	<4BA0B079.3050301@enterprisedb.com>	
	<3f0b79eb1003180727g7877743eq81274e014fe70a49@mail.gmail.com>	
	<1268988724.3556.3.camel@ebony>
	<4BA361E4.7020309@enterprisedb.com>	
	<3f0b79eb1003230017v16f4ecbeyc20e75beeffe8f1c@mail.gmail.com>	
	<4BAA060A.2020000@enterprisedb.com>
	<1269472981.8481.8946.camel@ebony>	
	<3f0b79eb1003241908n1e8f38e0q7cd7465163b3d7af@mail.gmail.com>	
	<6198.1269483277@sss.pgh.pa.us> <4BAB1AC1.7000900@enterprisedb.com>
	<1269505427.8481.8978.camel@ebony>
	<4BAB3A51.5050707@enterprisedb.com>
In-Reply-To: <4BAB3A51.5050707@enterprisedb.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Heikki Linnakangas wrote:
> Simon Riggs wrote:
>> On Thu, 2010-03-25 at 10:11 +0200, Heikki Linnakangas wrote:
>>
>>> PANIC seems like the appropriate solution for now.
>> It definitely is not. Think some more.
> 
> Well, what happens now in previous versions with pg_standby et al is
> that the standby starts up. That doesn't seem appropriate either.
> 
> Hmm, it would be trivial to just stay in the standby mode at a corrupt
> file, continuously retrying to restore it and continue replay. If it's
> genuinely corrupt, it will never succeed and the standby gets stuck at
> that point. Maybe that's better; it's close to what Fujii suggested
> except that you don't need a new mode for it.

On second thought, that's easy for the built-in standby mode, but not
for archive recovery where we're not currently retrying anything. In
archive recovery, we could throw a WARNING and start up, which would be
like the current behavior in older versions except you get a WARNING
instead of LOG, or we could PANIC. I'm leaning towards PANIC, which
makes most sense for genuine point-in-time or archive recovery (ie. not
a standby server), but I can see the rationale for WARNING too, for
pg_standby and for the sake of preserving old behavior.

-- 
  Heikki Linnakangas
  EnterpriseDB   http://www.enterprisedb.com