Subject: Re: Sync Rep Design
From: Simon Riggs <simon@2ndQuadrant.com>
To: Kevin Grittner <Kevin.Grittner@wicourts.gov>
Cc: greg@2ndquadrant.com, hannu@2ndquadrant.com,
	heikki.linnakangas@enterprisedb.com, robertmhaas@gmail.com,
	stefan@kaltenbrunner.cc, josh@postgresql.org, pgsql-hackers@postgresql.org
In-Reply-To: <4D205D650200002500038EDC@gw.wicourts.gov>
References: <4D205D650200002500038EDC@gw.wicourts.gov>
Content-Type: text/plain; charset="UTF-8"
Date: Sun, 02 Jan 2011 17:43:02 +0000
Message-ID: <1293990182.2090.1914.camel@ebony>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit

On Sun, 2011-01-02 at 11:11 -0600, Kevin Grittner wrote:
> Simon Riggs  wrote:
>  
> > Do you agree that requiring response from 2 sync standbys, or
> > locking up, gives us 94% server availability, but 99.9992% data
> > durability?
>  
> I'm not sure how to answer that.  The calculations so far have been
> based around up-time and the probabilities that you have a machine up
> at any moment and whether you can have confidence that if you do, you
> have all committed transactions represented.  There's been an implied
> assumption that the down time is unplanned, but not much else.  The
> above question seems to me to get into too many implied assumptions
> to feel safe throwing out a number without pinning those down a whole
> lot better.  If, for example, that 2% downtime always means the
> machine irretrievably went up in smoke, hitting unavailable means
> things are unrecoverable.  That's probably not the best assumption
> (at least outside of a combat zone), but what is?

Not really relevant. There's no room at all for downtime of any kind in
a situation where all servers must be available.

-- 
 Simon Riggs           http://www.2ndQuadrant.com/books/
 PostgreSQL Development, 24x7 Support, Training and Services