Re: why not kill -9 postmaster

On Sat, Oct 21, 2006 at 12:20:35AM +0930, Shane Ambler wrote:
> If you kill -9 the postmaster the system can still finish sending
> changes to disk and close the file but pulling the power cord can stop a
> write in the middle of a block giving you half new data and half old
> data in the one file.

Well, if you kill -9 the postmaster all the connections stay alive and
stay processing tuples and writing to disk, except the coordination is
gone. Some queues won't be processed, some signals will be ignored, if
the postmaster pid gets reused you'll have some fun.

In particular, the sinval-queue processing would break, which could
lead to some interesting issues. But I expect any number of issues to
start occurring.

A half-written disk blocks is a solved problem, postgresql will recover
from that without blinking.

> It's all a matter of timing.

Pulling the plug is *way* safer, it's a known quantity. As Tom said,
killing the postmaster needs cleanup, and some people screwup the
cleanup enough to corrupt their own data.

Now: killall -9 postgres (kill the parents, all the clients,
autovacuum, bgwriter, etc) all in one go is much more like a crash. But
that's not what's being discussed here.

Have a nice day,
--
Martijn van Oosterhout <kleptog(at)svana(dot)org> http://svana.org/kleptog/
> From each according to his ability. To each according to his ability to litigate.