Re: Immediate standby promotion

On 25 September 2014 18:30, Andres Freund <andres(at)2ndquadrant(dot)com> wrote:
> On 2014-09-25 18:18:09 +0100, Simon Riggs wrote:
>> On 25 September 2014 16:29, Andres Freund <andres(at)2ndquadrant(dot)com> wrote:
>> > I think that's not really related. Such a promotion doesn't cause data
>> > loss in the sense of loosing data a *clueful* operator wanted to
>> > keep. Yes, it can be used wrongly, but it's far from alone in that.
>>
>> Yes it does cause data loss. The clueful operator has no idea where
>> they are so there is no "used rightly" in that case.
>
> What? There definitely are cases where you don't need to know that to
> the T. Just think of the - quite frequently happening - need to promote
> a standby to run tests or reporting queries that can't be run on a
> standby.

What do they do with the standby afterwards?

Perhaps for testing, but I'd hope that Business Intelligence is done
by freezing databases at known target times. So at least you can say,
"using a database snapshot of 9am, we had the following results".

We seem to be trying to justify something that is dangerous and will
destroy data for incautious users. Of course it has uses, but thats
not the point, its the danger that is the problem, not the lack of
use. We go to a lot of trouble to avoid footguns elsewhere across many
years, so I can't see why you'd want to have the --footgun option
added here. recovery-target = 'vague'

> Sure, you shouldn't use it if you expect a very specific set of the data
> being there, but that's not always necessary. And that's why it should
> never, ever be the default.

--
Simon Riggs http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services