Subject: Re: Changing the state of data checksums in a running cluster

From: Tomas Vondra <[email-masked]>
Date: Mon, 9 Feb 2026 23:36:30 +0100

On 2/9/26 08:52, Michael Banck wrote:
> Hi,
> 
> On Fri, Feb 06, 2026 at 12:15:27AM +0100, Tomas Vondra wrote:
>> It's a bit unfortunate we only detect invalid checksums if the failures
>> appear in the server log. I wonder if we could run pg_checksums after
>> the cluster gets shut down in 'fast' mode (we can't do that with
>> immediate shutdowns, of course).
> 
> Well, maybe we could do that with immediate shutdowns if we add a
> --force parameter to pg_checksums that is clearly labelled/docmented as
> being dangerous for running instances (but the instance wouldn't run in
> this case).  Or something undocumented like
> --debug-force-unclean-controlfile.
> 

What would that tell us? Let's say we force running pg_checksums even
after unclean shutdown and it reports some invalid page checksums - then
what? We don't know if that's a bug in the online checksums, or just
(expected) corruption due to immediate shutdown.

regards

-- 
Tomas Vondra