Date: Wed, 20 Mar 2019 21:54:51 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Fabien COELHO <coelho@cri.ensmp.fr>
Cc: Andres Freund <andres@anarazel.de>,
	Michael Banck <michael.banck@credativ.de>,
	Magnus Hagander <magnus@hagander.net>,
	Sergei Kornilov <sk@zsrv.org>,
	PostgreSQL Developers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Offline enabling/disabling of data checksums
Message-ID: <20190320125451.GA20192@paquier.xyz>
References: <20190319153626.vgxcem5r65yhydck@alap3.anarazel.de>
 <1553010912.9697.53.camel@credativ.de>
 <20190319160037.baalicue7ovkhvb2@alap3.anarazel.de>
 <1553011697.9697.55.camel@credativ.de>
 <20190319161317.utyo6pnkxznxu4bu@alap3.anarazel.de>
 <1553013016.9697.57.camel@credativ.de>
 <20190319164717.ex2pw66zusbdqg2o@alap3.anarazel.de>
 <20190319230907.GA3488@paquier.xyz>
 <20190320051750.GA26601@paquier.xyz>
 <alpine.DEB.2.21.1903201012040.24709@lancre>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="AqsLC8rIMeq19msA"
Content-Disposition: inline
In-Reply-To: <alpine.DEB.2.21.1903201012040.24709@lancre>
Precedence: bulk


--AqsLC8rIMeq19msA
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Mar 20, 2019 at 10:38:36AM +0100, Fabien COELHO wrote:
> Hmmm=E2=80=A6 so nothing:-)

The core of the feature is still here, fortunately.

> I think that a clear warning not to run any cluster command in parallel,
> under pain of possible cluster corruption, and possibly other caveats abo=
ut
> replication, should appear in the documentation.

I still have the following extra documentation in my notes:
+ <refsect1>
+  <title>Notes</title>
+  <para>
+   When disabling or enabling checksums in a cluster of multiple instances,
+   it is recommended to stop all the instances of the cluster before doing
+   the switch to all the instances consistently.  When using a cluster with
+   tools which perform direct copies of relation file blocks (for example
+   <xref linkend=3D"app-pgrewind"/>), enabling or disabling checksums can
+   lead to page corruptions in the shape of incorrect checksums if the
+   operation is not done consistently across all nodes.  Destroying all
+   the standbys in a cluster first, enabling or disabling checksums on
+   the primary and finally recreate the cluster nodes from scratch is
+   also safe.
+  </para>
+ </refsect1>
This sounds kind of enough for me but..

> I also think that some mechanism should be used to prevent such occurence,
> whether in this patch or another.

I won't counter-argue on that.

> I still think that the control file update should be made *after* the data
> directory has been synced, otherwise the control file could be updated wh=
ile
> some data files are not. It just means exchanging two lines.

The parent path of the control file needs also to be flushed to make
the change durable, just doing things the same way pg_rewind keeps the
code simple in my opinion.

> If the conditional sync is moved before the file update, the file update
> should pass do_sync to update_controlfile.

For the durability of the operation, the current order is
intentional.
--
Michael

--AqsLC8rIMeq19msA
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAlySOBsACgkQnvQgOdby
QH0NpxAAiseqrv1Vff1ONDM6G54eZWpO/9rba5D1vaCddDsUqUL8QoL3VpGv/pcl
Mz8JeTiuxjf7tam1fiJw784x6Z3dGLOISXe9oxHxZpKJJpGpawGwgZRze3+GCYjj
2S3bPqon2INo8+OrNDMzUc2fqoW9mlkOt5AjL6YoUW5GBXyRUqeH6hVtl1GMSxOz
XlN8ubzfgcWyOviUX9OAB+qfbbELzcp4UnUkPv/KxWsty3PiYs2fPFmzGchUV4Dm
fUw85hF2DT4znHgWm2hQqSHql0ZdxtzVjykp9yue2Gns6Qo8Tvfgk+G1K+OmzuW7
z2/qoryw+12CMVJelnhrAFYti/NeeJ/rORzlfWcn7AIPKUpX7XGvNIb+ddFkFE44
cagPX1pO90kYb1GdOSCBuHA5PAt8ZYRPBRCjnOmZlZy/p78qYuMBgvtNITvHQlNI
RXmS4otBfXpXXtnEFbox/wZeoTK24N9DNXW1FYSchfGqLShPy48wrJzTKSdhGunO
TLikcN+W6Dgmg7nvP39ctmC3RAHKWE1RUf4O4uDDM3uE0m8Bu/kB3scLHoM80CM2
8TzzKf8G+rQ0tYFnEPHR0ydth6gG48l/q6wsWMDnUl3/3/DwloI+NuZxLVGrricz
fWlAkwu8LIPRN5unu8RVzK+Vw0DA1B0FwjSArqI8HlR9ShtpTXA=
=60EU
-----END PGP SIGNATURE-----

--AqsLC8rIMeq19msA--