Subject: Re: Allow some recovery parameters to be changed with reload
To: Sergei Kornilov <sk@zsrv.org>, Kyotaro Horiguchi
 <horikyota.ntt@gmail.com>,
 "a.lubennikova@postgrespro.ru" <a.lubennikova@postgrespro.ru>
Cc: "robertmhaas@gmail.com" <robertmhaas@gmail.com>,
 "michael@paquier.xyz" <michael@paquier.xyz>,
 "andres@anarazel.de" <andres@anarazel.de>,
 "peter.eisentraut@2ndquadrant.com" <peter.eisentraut@2ndquadrant.com>,
 "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
References: <20200809052149.GB17986@paquier.xyz>
 <CA+TgmobB4Syv3rh_v_QoyS=hMpw_Hf4JmjeOFQvDEQA8f2TFGw@mail.gmail.com>
 <1741c40b-73e3-133b-77e6-05ebc7bf3c0f@postgrespro.ru>
 <20201022.110026.524650499365127827.horikyota.ntt@gmail.com>
 <4920201603879284@mail.yandex.ru>
 <0e0d5982-ac64-818d-1ec6-18a80b9300b1@oss.nttdata.com>
 <56311604665173@mail.yandex.ru>
From: Fujii Masao <masao.fujii@oss.nttdata.com>
Message-ID: <a136a397-1401-9531-20c1-1b83575fd68d@oss.nttdata.com>
Date: Sat, 7 Nov 2020 01:28:49 +0900
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0)
 Gecko/20100101 Thunderbird/78.4.0
MIME-Version: 1.0
In-Reply-To: <56311604665173@mail.yandex.ru>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 2020/11/06 21:36, Sergei Kornilov wrote:
> Hello
> 
>> Currently when restore_command is not set, archive recovery fails
>> at the beginning. With the patch, how should we treat the case where
>> retore_command is reset to empty during archive recovery? We should
>> reject that change of restore_command?
> 
> Good point. I think we should reject that change. But (AFAIC) I cannot use GUC check callback for this purpose, as only the startup process knows StandbyModeRequested. I think it would be appropriate to call validateRecoveryParameters from StartupRereadConfig.

I don't think this idea is ok because emptying restore_command and the reload
of configuration file could cause the server doing archive recovery to
shut down with FATAL error.

I'm wondering if it's safe to allow restore_command to be emptied during
archive recovery. Even when it's emptied, archive recovery can proceed
by reading WAL files from pg_wal directory. This is the same behavior as
when restore_command is set to, e.g., /bin/false. So maybe we don't need
to treat the empty restore_command so special??

OTOH, we should not remove the check of restore_command in
validateRecoveryParameters(). Otherwise, when users forget to specify
restore_command when starting archive recovery, recovery could
wrongly proceed and the database could get corrupted.

Regards,


-- 
Fujii Masao
Advanced Computing Technology Center
Research and Development Headquarters
NTT DATA CORPORATION