Tom,

> > ... In the case of a postmaster crash, I think 
> > something in the system is so wrong that I'd prefer an immediate shutdown.
> 
> Surely some other people have opinions on this?  Hello out there?

Well, my opinion is based on the question, can we restart the postmaster if it 
dies and the other backends are still running?     If not, why are we even 
discussing this?

Otherwise, as someone who does support for a number of high-demand databases, 
I'd like to give you the rules that such applications need to have enforced 
in order to continue using Postgres:

1) If any transaction is reported as complete to the client, it must be 
written to disk and not rolled back, even in the event of a sudden power 
outage.
2) If any transaction is *not* reported as complete, except in split-second 
timing cases, it should be rolled back.  Always.

Basically, in high-demand situations where one expects occasional failures due 
to load, one depends on the application log, the syslog and the transaction 
log being in synch.   Otherwise on restart one doesn't know what has or 
hasn't been committed.

-- 
-Josh Berkus
 Aglio Database Solutions
 San Francisco


Thu, 26 Feb 2004 10:01:07 -0800
Josh Berkus <josh@agliodbs.com>
Re: bgwriter never dies 
Josh Berkus <josh@agliodbs.com> writes:
> Well, my opinion is based on the question, can we restart the
> postmaster if it dies and the other backends are still running?

You can't start a fresh postmaster until the last of the old backends is
gone (and yes, there's an interlock to prevent you from making this
mistake, though people have been known to override the interlock :-().

This means there's a tradeoff between allowing new sessions to start
soon and letting old ones finish their work.  It seems to me that
either of these goals might have priority in particular situations,
and that it would not be wise for us to design in a forced choice.
With the current setup, the DBA can manually SIGINT or SIGTERM
individual backends when he deems them unworthy of allowing to finish.
If we put in a forced quit as Jan is suggesting, we take away that
flexibility.

			regards, tom lane

Thu, 26 Feb 2004 14:00:04 -0500
Tom Lane <tgl@sss.pgh.pa.us>
Re: bgwriter never dies 