Re: unite recovery.conf and postgresql.conf

Hi,

http://archives.postgresql.org/pgsql-hackers/2010-12/msg02343.php

In previous discussion, we've reached the consensus that we should unite
recovery.conf and postgresql.conf. The attached patch does that. The
patch is WIP, I'll have to update the document, but if you notice something,
please feel free to comment.

This patch allows us to specify recovery parameters like primary_conninfo
in postgresql.conf. You can change some of them without restarting
the server (i.e., by using "pg_ctl reload") and see the current settings by
SHOW command. But note that recovery.conf is still required as a status
file for archive recovery and standby server even if you put all the settings
in postgresql.conf. Recovery parameters in postgresql.conf only have effect
when recovery.conf exists.

For backward compatibility, this patch still allows us to specify recovery
parameters in recovery.conf. But, as in past years, you cannot reload
recovery.conf and see the current settings by SHOW command. We should
recommend to put all the settings in postgresql.conf and empty recovery.conf,
but you can also put all recovery parameters in recovery.conf.

If the same parameter is specified in both file, the setting in recovery.conf
overrides that in postgresql.conf. In this case, SHOW command displays
the settings in postgresql.conf even though they are not used at all. Even if
you change the settings in postgresql.conf and reload it, they have no effect
because the settings in recovery.conf are used preferentially.

These limitations on recovery.conf might confuse users. But since most
users will put all the settings in postgresql.conf if we recommend to do that,
I don't think that it's worth complicating the source code for getting rid of
those limitations.

Thought?

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Fri, Sep 9, 2011 at 11:56, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
> Hi,
>
> http://archives.postgresql.org/pgsql-hackers/2010-12/msg02343.php
>
> In previous discussion, we've reached the consensus that we should unite
> recovery.conf and postgresql.conf. The attached patch does that. The
> patch is WIP, I'll have to update the document, but if you notice something,
> please feel free to comment.
>
> This patch allows us to specify recovery parameters like primary_conninfo
> in postgresql.conf. You can change some of them without restarting
> the server (i.e., by using "pg_ctl reload") and see the current settings by
> SHOW command. But note that recovery.conf is still required as a status
> file for archive recovery and standby server even if you put all the settings
> in postgresql.conf. Recovery parameters in postgresql.conf only have effect
> when recovery.conf exists.

Why exactly do we need to keep recovery.conf in this case?

> For backward compatibility, this patch still allows us to specify recovery
> parameters in recovery.conf. But, as in past years, you cannot reload
> recovery.conf and see the current settings by SHOW command. We should
> recommend to put all the settings in postgresql.conf and empty recovery.conf,
> but you can also put all recovery parameters in recovery.conf.

Perhaps we should just have people use recovery.conf as an include
file in this case?

As a whole, I'm not sure I like the idea of having such critical
parameters in two different places. Do we really need to care about
the backwards compatibility of something like that this much?

> If the same parameter is specified in both file, the setting in recovery.conf
> overrides that in postgresql.conf. In this case, SHOW command displays
> the settings in postgresql.conf even though they are not used at all. Even if

Now, *that* is just broken, IMHO. The SHOW command should show what is
actually in use, period. Everything is guaranteed to confuse the hell
out of anybody trying to use it.

> you change the settings in postgresql.conf and reload it, they have no effect
> because the settings in recovery.conf are used preferentially.
>
> These limitations on recovery.conf might confuse users. But since most
> users will put all the settings in postgresql.conf if we recommend to do that,
> I don't think that it's worth complicating the source code for getting rid of
> those limitations.

I think we should just get rid of supporting them in recovery.conf
completely. Recovery settings are critical, and making that confusing
to the user is not a good thing.

--
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/

On Fri, Sep 9, 2011 at 7:21 PM, Magnus Hagander <magnus(at)hagander(dot)net> wrote:
> On Fri, Sep 9, 2011 at 11:56, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>> Hi,
>>
>> http://archives.postgresql.org/pgsql-hackers/2010-12/msg02343.php
>>
>> In previous discussion, we've reached the consensus that we should unite
>> recovery.conf and postgresql.conf. The attached patch does that. The
>> patch is WIP, I'll have to update the document, but if you notice something,
>> please feel free to comment.
>>
>> This patch allows us to specify recovery parameters like primary_conninfo
>> in postgresql.conf. You can change some of them without restarting
>> the server (i.e., by using "pg_ctl reload") and see the current settings by
>> SHOW command. But note that recovery.conf is still required as a status
>> file for archive recovery and standby server even if you put all the settings
>> in postgresql.conf. Recovery parameters in postgresql.conf only have effect
>> when recovery.conf exists.
>
> Why exactly do we need to keep recovery.conf in this case?

PostgreSQL automatically reinitializes after a backend crash. Imagine the case
where this happens after archive recovery. Since restore_command is left set
in postgresql.conf and it still has effect (if we've completely removed
recovery.conf), the reinitialization will makes the server go into
archive recovery
mode again unexpectedly.

We can avoid this problem by using recovery.conf. At the end of
archive recovery,
recovery.conf is renamed to recovery.done. So when the reinitialization happens,
recovery.conf doesn't exist and restore_command has no effect. Which prevents
the server from going into archive recovery mode again.

>> For backward compatibility, this patch still allows us to specify recovery
>> parameters in recovery.conf. But, as in past years, you cannot reload
>> recovery.conf and see the current settings by SHOW command. We should
>> recommend to put all the settings in postgresql.conf and empty recovery.conf,
>> but you can also put all recovery parameters in recovery.conf.
>
> Perhaps we should just have people use recovery.conf as an include
> file in this case?

Yeah, that's my first idea, but I've given up adopting that. The problem is that
recovery.conf is renamed to recovery.done at the end of recovery. This means
that all the settings in recovery.conf are reset when archive recovery ends.
If you run "pg_ctl reload" after archive recovery, you'll get something like the
following error message and the reload will always fail;

LOG: parameter "standby_mode" cannot be changed without
restarting the server

> As a whole, I'm not sure I like the idea of having such critical
> parameters in two different places. Do we really need to care about
> the backwards compatibility of something like that this much?

I don't have strong opinion about this. But in previous discussion, Simon argued
that we should.
http://archives.postgresql.org/pgsql-hackers/2010-10/msg00017.php

>> If the same parameter is specified in both file, the setting in recovery.conf
>> overrides that in postgresql.conf. In this case, SHOW command displays
>> the settings in postgresql.conf even though they are not used at all. Even if
>
> Now, *that* is just broken, IMHO. The SHOW command should show what is
> actually in use, period. Everything is guaranteed to confuse the hell
> out of anybody trying to use it.

I'm afraid that we have to add very complicated code to fix that problem.
Though of course we can easily fix the problem if we don't care about
the backward compatibility.

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Fri, Sep 9, 2011 at 13:15, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
> On Fri, Sep 9, 2011 at 7:21 PM, Magnus Hagander <magnus(at)hagander(dot)net> wrote:
>> On Fri, Sep 9, 2011 at 11:56, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>>> Hi,
>>>
>>> http://archives.postgresql.org/pgsql-hackers/2010-12/msg02343.php
>>>
>>> In previous discussion, we've reached the consensus that we should unite
>>> recovery.conf and postgresql.conf. The attached patch does that. The
>>> patch is WIP, I'll have to update the document, but if you notice something,
>>> please feel free to comment.
>>>
>>> This patch allows us to specify recovery parameters like primary_conninfo
>>> in postgresql.conf. You can change some of them without restarting
>>> the server (i.e., by using "pg_ctl reload") and see the current settings by
>>> SHOW command. But note that recovery.conf is still required as a status
>>> file for archive recovery and standby server even if you put all the settings
>>> in postgresql.conf. Recovery parameters in postgresql.conf only have effect
>>> when recovery.conf exists.
>>
>> Why exactly do we need to keep recovery.conf in this case?
>
> PostgreSQL automatically reinitializes after a backend crash. Imagine the case
> where this happens after archive recovery. Since restore_command is left set
> in postgresql.conf and it still has effect (if we've completely removed
> recovery.conf), the reinitialization will makes the server go into
> archive recovery
> mode again unexpectedly.
>
> We can avoid this problem by using recovery.conf. At the end of
> archive recovery,
> recovery.conf is renamed to recovery.done. So when the reinitialization happens,
> recovery.conf doesn't exist and restore_command has no effect. Which prevents
> the server from going into archive recovery mode again.

Ah, ugh. Good point.

I have to wonder though, if it wouldn't be less confusing to just get
rid of recovery.conf and use a *different* file for this. Just to make
it clear it's not a config file, but just a boolean exists/notexists
state.

>>> For backward compatibility, this patch still allows us to specify recovery
>>> parameters in recovery.conf. But, as in past years, you cannot reload
>>> recovery.conf and see the current settings by SHOW command. We should
>>> recommend to put all the settings in postgresql.conf and empty recovery.conf,
>>> but you can also put all recovery parameters in recovery.conf.
>>
>> Perhaps we should just have people use recovery.conf as an include
>> file in this case?
>
> Yeah, that's my first idea, but I've given up adopting that. The problem is that
> recovery.conf is renamed to recovery.done at the end of recovery. This means
> that all the settings in recovery.conf are reset when archive recovery ends.
> If you run "pg_ctl reload" after archive recovery, you'll get something like the
> following error message and the reload will always fail;
>
>    LOG:  parameter "standby_mode" cannot be changed without
> restarting the server

Good point. And I believe another argument for actually using
completely different files ;)

>> As a whole, I'm not sure I like the idea of having such critical
>> parameters in two different places. Do we really need to care about
>> the backwards compatibility of something like that this much?
>
> I don't have strong opinion about this. But in previous discussion, Simon argued
> that we should.
> http://archives.postgresql.org/pgsql-hackers/2010-10/msg00017.php

I see his argument, but I think reduced confusion is a more important one.

>>> If the same parameter is specified in both file, the setting in recovery.conf
>>> overrides that in postgresql.conf. In this case, SHOW command displays
>>> the settings in postgresql.conf even though they are not used at all. Even if
>>
>> Now, *that* is just broken, IMHO. The SHOW command should show what is
>> actually in use, period. Everything is guaranteed to confuse the hell
>> out of anybody trying to use it.
>
> I'm afraid that we have to add very complicated code to fix that problem.
> Though of course we can easily fix the problem if we don't care about
> the backward compatibility.

That is an even bigger reason to drop backwards compatibility. Unless
someone else can come up with a neat way of fixing it.

--
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/

Magnus Hagander <magnus(at)hagander(dot)net> writes:
> I have to wonder though, if it wouldn't be less confusing to just get
> rid of recovery.conf and use a *different* file for this. Just to make
> it clear it's not a config file, but just a boolean exists/notexists
> state.

+1. If it's not a configuration file anymore, it shouldn't be called
one.

regards, tom lane

On Fri, Sep 9, 2011 at 3:05 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Magnus Hagander <magnus(at)hagander(dot)net> writes:
>> I have to wonder though, if it wouldn't be less confusing to just get
>> rid of recovery.conf and use a *different* file for this. Just to make
>> it clear it's not a config file, but just a boolean exists/notexists
>> state.
>
> +1.  If it's not a configuration file anymore, it shouldn't be called
> one.

+1 to rename file

+1 to overall concept, just thinking same myself, not looked at patch yet

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On 9/9/11 7:05 AM, Tom Lane wrote:
> Magnus Hagander <magnus(at)hagander(dot)net> writes:
>> I have to wonder though, if it wouldn't be less confusing to just get
>> rid of recovery.conf and use a *different* file for this. Just to make
>> it clear it's not a config file, but just a boolean exists/notexists
>> state.
>
> +1. If it's not a configuration file anymore, it shouldn't be called
> one.

I'm in favor of this. People are sufficiently confused by the existing
behavior that we're not going to confuse them further by changing it.

In fact: currently we have a "trigger file" concept in recovery.conf.
Might we unite the trigger file concept with the concept of having a
file to indicate that server is a replica on startup?

i.e. in postgresql.conf we have two settings:

replication_status = {master,standby}
failover_trigger_file = '' #defaults to $PGDATA/master_trigger

If replication_status = master, then the server is a standalone or
master node.

If replication_status = standby, then the server is a PITR, warm
standby, or hot standby replica.

If the failover_trigger_file is created and detected, then PostgreSQL
will reload in master mode. replication_status will get set to "master"
so that it's easy to tell this from the command line.

The above would be a lot easier to comprehend than the current behavior,
and would allow us all of the same options the current behavoir does.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Fri, Sep 9, 2011 at 6:40 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
> I'm in favor of this.  People are sufficiently confused by the existing
> behavior that we're not going to confuse them further by changing it.
>

Fwiw as someone who *was* confused previously, it now makes perfect
sense to me. "We have postgres.conf which always applies and then
recovery.conf which can have all the same options but they only apply
during recover". That's much clearer than "we have two configuration
files with two disjoint sets of options and good luck remembering
which options belong in which file". And it still serves a useful
purpose if you have options like recovery_target that you only want to
apply during recovery and then plan to remove.

--
greg

On Sat, Sep 10, 2011 at 01:07, Greg Stark <stark(at)mit(dot)edu> wrote:
> On Fri, Sep 9, 2011 at 6:40 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>> I'm in favor of this.  People are sufficiently confused by the existing
>> behavior that we're not going to confuse them further by changing it.
>>
>
> Fwiw as someone who *was* confused previously, it now makes perfect
> sense to me. "We have postgres.conf which always applies and then
> recovery.conf which can have all the same options but they only apply
> during recover". That's much clearer than "we have two configuration

But it only means that for *some* options. Which certainly doesn't
reduce confusion.

--
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/

On Fri, Sep 9, 2011 at 8:27 PM, Magnus Hagander <magnus(at)hagander(dot)net> wrote:
>>>> If the same parameter is specified in both file, the setting in recovery.conf
>>>> overrides that in postgresql.conf. In this case, SHOW command displays
>>>> the settings in postgresql.conf even though they are not used at all. Even if
>>>
>>> Now, *that* is just broken, IMHO. The SHOW command should show what is
>>> actually in use, period. Everything is guaranteed to confuse the hell
>>> out of anybody trying to use it.
>>
>> I'm afraid that we have to add very complicated code to fix that problem.
>> Though of course we can easily fix the problem if we don't care about
>> the backward compatibility.
>
> That is an even bigger reason to drop backwards compatibility. Unless
> someone else can come up with a neat way of fixing it.

Agreed. After a little thought, it's came to mind that we might be
able to simply
fix that problem by making the postmaster instead of the startup process read
recovery.conf; The postmaster reads recovery.conf before it invokes the startup
process, and sets the global variables of GUC to the specified values. The child
processes including the startup process inherit the global variables of GUC, so
SHOW can return the exact setting value and the startup process can use them
to do a recovery. Even in EXEC_BACKEND case, we can adopt this idea because
those global variables are inherited from parent to children via the
save/restore_backend_variables functions.

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Sat, Sep 10, 2011 at 12:18 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Fri, Sep 9, 2011 at 3:05 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> Magnus Hagander <magnus(at)hagander(dot)net> writes:
>>> I have to wonder though, if it wouldn't be less confusing to just get
>>> rid of recovery.conf and use a *different* file for this. Just to make
>>> it clear it's not a config file, but just a boolean exists/notexists
>>> state.
>>
>> +1.  If it's not a configuration file anymore, it shouldn't be called
>> one.
>
> +1 to rename file
>
> +1 to overall concept, just thinking same myself, not looked at patch yet

Are you still thinking the backward-compatibility (i.e., the
capability to specify
recovery parameters in recovery.conf) is required?

Even if we maintain the backward-compatibility, if we rename the file, ISTM
that the tools which depends on recovery.conf would need to be changed so
that <file-with-new-name> is used instead of recovery.conf. So I'm not sure
whether leaving the capability to set parameters in recovery.conf as it is is
really worth supporting or not. If we would like to make our effort for the
backward-compatibility more worthwhile, we might have to make the path of
the file configurable as a user can set it to "recovery.conf".

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On tis, 2011-09-13 at 14:46 +0900, Fujii Masao wrote:
> Are you still thinking the backward-compatibility (i.e., the
> capability to specify recovery parameters in recovery.conf) is
> required?

I think parameters related to a particular recovery, e.g.,
recovery_target_time, fit better into a recovery.conf that is renamed
after the recovery is complete. That was the original idea, after all.

Everything that is a permanent setting across multiple recovery
attempts, and anything related to replication, better fits elsewhere.

On Tue, Sep 13, 2011 at 2:51 PM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
> On tis, 2011-09-13 at 14:46 +0900, Fujii Masao wrote:
>> Are you still thinking the backward-compatibility (i.e., the
>> capability to specify recovery parameters in recovery.conf) is
>> required?
>
> I think parameters related to a particular recovery, e.g.,
> recovery_target_time, fit better into a recovery.conf that is renamed
> after the recovery is complete.  That was the original idea, after all.
>
> Everything that is a permanent setting across multiple recovery
> attempts, and anything related to replication, better fits elsewhere.

I've just been thinking that a better way would be to make
recovery.conf an extension of postgresql.conf when we are in archive
recovery.

So treat postgresql.conf as if it has an automatic "include
recovery.conf" in it. The file format is the same.

That way we don't need to change existing behaviour, so any software
that relies upon this will still work, but we gain the additional
ability to reload values in recovery,conf (where appropriate).

We can change the .sample files to show parameters that make more
sense in one or the other file, rather than making it a hard
requirement for them to appear in specific files which will be a real
pain in the ass.

Internal changes would then be to move existing recovery.conf
parameters into guc.c and revise the manual accordingly.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Wed, Sep 14, 2011 at 1:10 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Tue, Sep 13, 2011 at 2:51 PM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
>> On tis, 2011-09-13 at 14:46 +0900, Fujii Masao wrote:
>>> Are you still thinking the backward-compatibility (i.e., the
>>> capability to specify recovery parameters in recovery.conf) is
>>> required?
>>
>> I think parameters related to a particular recovery, e.g.,
>> recovery_target_time, fit better into a recovery.conf that is renamed
>> after the recovery is complete.  That was the original idea, after all.
>>
>> Everything that is a permanent setting across multiple recovery
>> attempts, and anything related to replication, better fits elsewhere.
>
> I've just been thinking that a better way would be to make
> recovery.conf an extension of postgresql.conf when we are in archive
> recovery.
>
> So treat postgresql.conf as if it has an automatic "include
> recovery.conf" in it. The file format is the same.
>
> That way we don't need to change existing behaviour, so any software
> that relies upon this will still work, but we gain the additional
> ability to reload values in recovery,conf (where appropriate).
>
> We can change the .sample files to show parameters that make more
> sense in one or the other file, rather than making it a hard
> requirement for them to appear in specific files which will be a real
> pain in the ass.
>
> Internal changes would then be to move existing recovery.conf
> parameters into guc.c and revise the manual accordingly.

Sounds reasonable. I'll revise the patch that way.

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On tis, 2011-09-13 at 17:10 +0100, Simon Riggs wrote:
> So treat postgresql.conf as if it has an automatic "include
> recovery.conf" in it. The file format is the same.

Sounds good. That would also have the merit that you could use, say,
different memory settings during recovery.

On Wed, Sep 14, 2011 at 6:33 PM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
> On tis, 2011-09-13 at 17:10 +0100, Simon Riggs wrote:
>> So treat postgresql.conf as if it has an automatic "include
>> recovery.conf" in it. The file format is the same.
>
> Sounds good.  That would also have the merit that you could use, say,
> different memory settings during recovery.

One problem of this is that recovery.conf is relative to the configuration
file directory instead of data directory if we treat it as an "include" file.
If your configuration file directory is the same as the data directory, you
don't need to worry about this problem. But if you set data_directory to
the directory other than ConfigDir, the problem might break your tool
which depends on recovery.conf under the data directory.

If we'd like to treat recovery.conf as if it's under the data directory, I'm
afraid that we should add complicated code to parse recovery.conf after
the value of data_directory has been determined from postgresql.conf.
Furthermore, what if recovery.conf has another setting of data_directory?

Since recovery.conf is a configuration file, it's intuitive for me to put it
in configuration file directory rather than data directory. So I'm not inclined
to treat recovery.conf as if it's under data directory. Is this OK?

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

Fujii Masao <masao(dot)fujii(at)gmail(dot)com> writes:
> If we'd like to treat recovery.conf as if it's under the data directory, I'm
> afraid that we should add complicated code to parse recovery.conf after
> the value of data_directory has been determined from postgresql.conf.
> Furthermore, what if recovery.conf has another setting of data_directory?

We already do this dance for custom_variable_classes. IIRC the only
thing you have to care about is setting the GUC before any other one. I
guess you could just process the data_directory the same way, before the
main loop, and be done with it.

> Since recovery.conf is a configuration file, it's intuitive for me to put it
> in configuration file directory rather than data directory. So I'm not inclined
> to treat recovery.conf as if it's under data directory. Is this OK?

I think that if we keep some compatibility with recovery.conf, then we
need to include finding it in the data_directory or the configuration
file directory, in that order, and with a LOG message that says where we
did find it.

I think we should *NOT* load both of them with some priority rules.

Regards,
--
Dimitri Fontaine
http://2ndQuadrant.fr PostgreSQL : Expertise, Formation et Support

On tor, 2011-09-15 at 16:54 +0900, Fujii Masao wrote:
> On Wed, Sep 14, 2011 at 6:33 PM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
> > On tis, 2011-09-13 at 17:10 +0100, Simon Riggs wrote:
> >> So treat postgresql.conf as if it has an automatic "include
> >> recovery.conf" in it. The file format is the same.
> >
> > Sounds good. That would also have the merit that you could use, say,
> > different memory settings during recovery.
>
> One problem of this is that recovery.conf is relative to the configuration
> file directory instead of data directory if we treat it as an "include" file.

Treat it *as if* it were an included file. A special included file if
you will.

> If we'd like to treat recovery.conf as if it's under the data directory, I'm
> afraid that we should add complicated code to parse recovery.conf after
> the value of data_directory has been determined from postgresql.conf.
> Furthermore, what if recovery.conf has another setting of data_directory?

Perhaps that could be addresses by inventing a new context setting
PGC_RECOVERY so that you can only set sane values.

> Since recovery.conf is a configuration file, it's intuitive for me to put it
> in configuration file directory rather than data directory. So I'm not inclined
> to treat recovery.conf as if it's under data directory. Is this OK?

It's not a configuration file, because it disappears after use. (And a
lot of configuration file management systems would be really upset if we
had a configuration file that behaved that way.) The whole point of
this exercise is allowing the permanent configuration file parameters to
be moved to a real configuration file (postgresql.conf), while leaving
the temporary settings separately.

Alternatively, we could just forget about the whole thing and move
everything to postgresql.conf and treat recovery.conf as a simple empty
signal file. I don't know if that's necessarily better.

On Thu, Sep 15, 2011 at 5:58 AM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
> Alternatively, we could just forget about the whole thing and move
> everything to postgresql.conf and treat recovery.conf as a simple empty
> signal file.  I don't know if that's necessarily better.

Seems like it might be simpler.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Thu, Sep 15, 2011 at 8:04 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> On Thu, Sep 15, 2011 at 5:58 AM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
>> Alternatively, we could just forget about the whole thing and move
>> everything to postgresql.conf and treat recovery.conf as a simple empty
>> signal file.  I don't know if that's necessarily better.
>
> Seems like it might be simpler.

It seems to need a bit more time until we've reached a consensus about
the treatment of recovery.conf. How about committing the core patch
first, and addressing the recovery.conf issue as a different patch later?

The attached patch provides a core part of the feature, i.e., it moves
every recovery parameters from recovery.conf to postgresql.conf.
Even if you create recovery.conf, the server doesn't read it automatically.

The patch renames recovery.conf to recovery.ready, so if you want to
enter archive recovery or standby mode, you need to create
recovery.ready file in the cluster data directory. Since recovery.ready is
just a signal file, its contents have no effect.

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

Fujii Masao <masao(dot)fujii(at)gmail(dot)com> writes:
> It seems to need a bit more time until we've reached a consensus about
> the treatment of recovery.conf. How about committing the core patch
> first, and addressing the recovery.conf issue as a different patch later?

> The attached patch provides a core part of the feature, i.e., it moves
> every recovery parameters from recovery.conf to postgresql.conf.
> Even if you create recovery.conf, the server doesn't read it automatically.

> The patch renames recovery.conf to recovery.ready, so if you want to
> enter archive recovery or standby mode, you need to create
> recovery.ready file in the cluster data directory. Since recovery.ready is
> just a signal file, its contents have no effect.

This seems like it's already predetermining the outcome of the argument
about recovery.conf. Mind you, I'm not unhappy with this choice, but
it's hardly implementing only behavior that's not being debated.

If we're satisfied with not treating recovery-only parameters different
from run-of-the-mill GUCs, this is fine.

regards, tom lane

On Thu, Sep 15, 2011 at 11:37 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> This seems like it's already predetermining the outcome of the argument
> about recovery.conf.  Mind you, I'm not unhappy with this choice, but
> it's hardly implementing only behavior that's not being debated.
>
> If we're satisfied with not treating recovery-only parameters different
> from run-of-the-mill GUCs, this is fine.

Okay, we need to reach a consensus about the treatment of
recovery.conf.

We have three choices. Which do you like the best?

#1
Use empty recovery.ready file to enter arhicve recovery. recovery.conf
is not read automatically. All recovery parameters are expected to be
specified in postgresql.conf. If you must specify them in recovery.conf,
you need to add "include 'recovery.conf'" into postgresql.conf. But note
that that recovery.conf will not be renamed to recovery.done at the
end of recovery. This is what the patch I've posted does. This is
simplest approach, but might confuse people who use the tools which
depend on recovery.conf.

#2
Use empty recovery.ready file to enter archive recovery. recovery.conf
is read automatically. You can specify recovery parameters in
recovery.conf without adding "include 'recovery.conf'" into
postgresql.conf. But note that that recovery.conf will not be renamed
to recovery.done at the end of recovery. If we adopt this, we might
need to implement what Dimitri suggested. I guess this is not so difficult
thing.
http://archives.postgresql.org/pgsql-hackers/2011-09/msg00745.php

#3
Use recovery.conf file to enter archive recovery. recovery.conf is read
automatically, and will be renamed to recovery.done at the end of
recovery. This is least confusing approach for the existing users, but
I guess we need to add lots of code (e.g., as Peter suggested, we might
need to invent new context setting like PGC_RECOVERY) to address
the problem I pointed before.
http://archives.postgresql.org/pgsql-hackers/2011-09/msg00482.php

If we want to use recovery.conf as a temporary configuration file for
recovery (i.e., configuration file disappears after use), we must choose
#3. If we can live with that recovery.conf is treated as a permanent
configuration file but don't want to add "include 'recovery.conf'" into
postgresql.conf, #2 is best. If we don't use recovery.conf or mind
editing postgresql.conf to use recovery.conf, #1 is best. Which behavior
are you expecting?

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

Fujii Masao <masao(dot)fujii(at)gmail(dot)com> writes:
> We have three choices. Which do you like the best?

I'm in favor of defining a separate, content-free trigger file to enable
archive recovery. Not sure about the name "recovery.ready", though ---
that makes it look like one of the WAL archive transfer trigger files,
which does not seem like a great analogy. The pg_standby documentation
suggests names like "foo.trigger" for failover triggers, which is a bit
better analogy because something external to the database creates the
file. What about "recovery.trigger"?

As far as the other issues go, I think there is actually a prerequisite
discussion to be had here, which is whether we are turning the recovery
parameters into plain old GUCs or not. If they are plain old GUCs, then
they will presumably still have their values when we are *not* doing
recovery. That leads to a couple of questions:
* will seeing these values present in pg_settings confuse anybody?
* can the values be changed when not in recovery, if so what happens,
and again will that confuse anybody?
* is there any security hazard from ordinary users being able to see
what settings had been used?

If these settings are to be plain old GUCs, then I think we should just
stick them in postgresql.conf and forget about recovery.conf (although
of course someone could "include recovery.conf" if he were bent on
storing them separately). On the other hand, if we think they are *not*
plain old GUCs, maybe they shouldn't be in postgresql.conf. But the
source file isn't the first thing to worry about in that case.

regards, tom lane

On fre, 2011-09-16 at 01:32 -0400, Tom Lane wrote:
> As far as the other issues go, I think there is actually a
> prerequisite
> discussion to be had here, which is whether we are turning the
> recovery
> parameters into plain old GUCs or not. If they are plain old GUCs,
> then
> they will presumably still have their values when we are *not* doing
> recovery. That leads to a couple of questions:
> * will seeing these values present in pg_settings confuse anybody?

How so? We add or change the available parameters all the time.

> * can the values be changed when not in recovery, if so what happens,
> and again will that confuse anybody?

Should be similar to archive_command and archive_mode. You can still
see and change archive_command when archive_mode is off.

> * is there any security hazard from ordinary users being able to see
> what settings had been used?

Again, not much different from the archive_* settings. They are, after
all, almost the same in the opposite direction.

On fre, 2011-09-16 at 11:54 +0900, Fujii Masao wrote:
> #1
> Use empty recovery.ready file to enter arhicve recovery. recovery.conf
> is not read automatically. All recovery parameters are expected to be
> specified in postgresql.conf. If you must specify them in recovery.conf,
> you need to add "include 'recovery.conf'" into postgresql.conf. But note
> that that recovery.conf will not be renamed to recovery.done at the
> end of recovery. This is what the patch I've posted does. This is
> simplest approach, but might confuse people who use the tools which
> depend on recovery.conf.

A small variant to this: When you are actually doing recovery from a
backup, having a recovery trigger and a recovery done file is obviously
quite helpful and necessary for safety. But when you're setting up a
replication slave, it adds extra complexity for the user. The
approximately goal ought to be to be able to do

pg_basebackup -h master -D there
postgres -D there --standby-mode=on --primary-conninfo=master

without the need to touch any obscure recovery trigger files.

So perhaps recovery.{trigger,ready} should not be needed if, say,
standby_mode=on. But then what impact should the presence of
recovery.done have?

On 15-09-2011 23:54, Fujii Masao wrote:
> #1
> Use empty recovery.ready file to enter arhicve recovery. recovery.conf
> is not read automatically. All recovery parameters are expected to be
> specified in postgresql.conf. If you must specify them in recovery.conf,
> you need to add "include 'recovery.conf'" into postgresql.conf. But note
> that that recovery.conf will not be renamed to recovery.done at the
> end of recovery. This is what the patch I've posted does. This is
> simplest approach, but might confuse people who use the tools which
> depend on recovery.conf.
>
more or less +1. We don't need two config files.; just one: postgresql.conf.
Just turn all recovery.conf parameters to GUCs. As already said, the
recovery.conf settings are not different from archive settings, we just need a
way to trigger the recovery. And that trigger could be pulled by a GUC
(standby_mode) or a file (say recovery -> recovery.done). Also, recovery.done
could be filled with recovery information just for DBA record. standby_mode
does not create any file, it just trigger the recovery (as it will be used
mainly for replication purposes).

--
Euler Taveira de Oliveira - Timbira http://www.timbira.com.br/
PostgreSQL: Consultoria, Desenvolvimento, Suporte 24x7 e Treinamento

> I'm in favor of defining a separate, content-free trigger file to
> enable
> archive recovery. Not sure about the name "recovery.ready", though
> ---
> that makes it look like one of the WAL archive transfer trigger
> files,
> which does not seem like a great analogy. The pg_standby
> documentation
> suggests names like "foo.trigger" for failover triggers, which is a
> bit
> better analogy because something external to the database creates the
> file. What about "recovery.trigger"?

Do we want a trigger file to enable recovery, or one to *disable* recovery? Or both?

Also, I might point out that we're really confusing our users by talking about "recovery" all the time, if they're just using streaming replication. Just sayin'

> * will seeing these values present in pg_settings confuse anybody?

No. pg_settings already has a couple dozen "developer" parameters which nobody not on this mailing list understands. Adding the recovery parameters to it wouldn't confuse anyone further, and would have the advantage of making the recovery parameters available by monitoring query on a hot standby.

For that matter, I'd suggest that we add a read-only setting called in_recovery.

> * can the values be changed when not in recovery, if so what happens,
> and again will that confuse anybody?

Yes, and no.

> * is there any security hazard from ordinary users being able to see
> what settings had been used?

primary_conninfo could be a problem, since it's possible to set a password there.

--Josh

On Fri, Sep 16, 2011 at 3:22 PM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:
> No.  pg_settings already has a couple dozen "developer" parameters which nobody not on this mailing list understands.  Adding the recovery parameters to it wouldn't confuse anyone further, and would have the advantage of making the recovery parameters available by monitoring query on a hot standby.

+1.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Sat, Sep 17, 2011 at 4:22 AM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:
>> that makes it look like one of the WAL archive transfer trigger
>> files,
>> which does not seem like a great analogy.  The pg_standby
>> documentation
>> suggests names like "foo.trigger" for failover triggers, which is a
>> bit
>> better analogy because something external to the database creates the
>> file.  What about "recovery.trigger"?

I'm OK with that name.

> Do we want a trigger file to enable recovery, or one to *disable* recovery?  Or both?

ISTM that only supporting a trigger file to enable recovery is less confusing.

>> * will seeing these values present in pg_settings confuse anybody?
>
> No.  pg_settings already has a couple dozen "developer" parameters which nobody not on this mailing list understands.  Adding the recovery parameters to it wouldn't confuse anyone further, and would have the advantage of making the recovery parameters available by monitoring query on a hot standby.

+1

>> * is there any security hazard from ordinary users being able to see
>>   what settings had been used?
>
> primary_conninfo could be a problem, since it's possible to set a password there.

True. I agree that primary_conninfo should be restricted to superuser.

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Fri, Sep 16, 2011 at 9:25 PM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
> On fre, 2011-09-16 at 11:54 +0900, Fujii Masao wrote:
>> #1
>> Use empty recovery.ready file to enter arhicve recovery. recovery.conf
>> is not read automatically. All recovery parameters are expected to be
>> specified in postgresql.conf. If you must specify them in recovery.conf,
>> you need to add "include 'recovery.conf'" into postgresql.conf. But note
>> that that recovery.conf will not be renamed to recovery.done at the
>> end of recovery. This is what the patch I've posted does. This is
>> simplest approach, but might confuse people who use the tools which
>> depend on recovery.conf.
>
> A small variant to this:  When you are actually doing recovery from a
> backup, having a recovery trigger and a recovery done file is obviously
> quite helpful and necessary for safety.  But when you're setting up a
> replication slave, it adds extra complexity for the user.  The
> approximately goal ought to be to be able to do
>
> pg_basebackup -h master -D there
> postgres -D there --standby-mode=on --primary-conninfo=master
>
> without the need to touch any obscure recovery trigger files.
>
> So perhaps recovery.{trigger,ready} should not be needed if, say,
> standby_mode=on.

Or what about making pg_basebackup automatically create a
recovery trigger file?

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Fri, Sep 16, 2011 at 3:54 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
> On Thu, Sep 15, 2011 at 11:37 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> This seems like it's already predetermining the outcome of the argument
>> about recovery.conf.  Mind you, I'm not unhappy with this choice, but
>> it's hardly implementing only behavior that's not being debated.
>>
>> If we're satisfied with not treating recovery-only parameters different
>> from run-of-the-mill GUCs, this is fine.
>
> Okay, we need to reach a consensus about the treatment of
> recovery.conf.
>
> We have three choices.

What we should focus on is these requirements

1. Don't break software that relies on the existing behaviour

2. Allow parameters to be reloaded at SIGHUP

3. Allow recovery parameters to be handled same way as other GUCs

4. We need to retain recovery.conf/.done style behaviour to mark end
of archive recovery

Making an automatic include makes (2) and (3) work OK, without
breaking (1). I haven't seen another solution that doesnt break (1).

Rename of .conf to .done allows us to maintain working code for
existing solutions (there are *many* out there...)

We should say that the automatic include only works during recovery,
so if someone puts recovery.conf back then we ignore it.

If we treat recovery,conf as being read *first* then any parameter
mentioned twice (i.e. mentioned again in postgresql.conf) will
override the setting in recovery.conf and we have no issues.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Fri, Sep 16, 2011 at 2:46 PM, Euler Taveira de Oliveira
<euler(at)timbira(dot)com> wrote:
> On 15-09-2011 23:54, Fujii Masao wrote:
>>
>> #1
>> Use empty recovery.ready file to enter arhicve recovery. recovery.conf
>> is not read automatically. All recovery parameters are expected to be
>> specified in postgresql.conf. If you must specify them in recovery.conf,
>> you need to add "include 'recovery.conf'" into postgresql.conf. But note
>> that that recovery.conf will not be renamed to recovery.done at the
>> end of recovery. This is what the patch I've posted does. This is
>> simplest approach, but might confuse people who use the tools which
>> depend on recovery.conf.
>>
> more or less +1. We don't need two config files.; just one: postgresql.conf.
> Just turn all recovery.conf parameters to GUCs. As already said, the
> recovery.conf settings are not different from archive settings, we just need
> a way to trigger the recovery. And that trigger could be pulled by a GUC
> (standby_mode) or a file (say recovery -> recovery.done). Also,
> recovery.done could be filled with recovery information just for DBA record.
> standby_mode does not create any file, it just trigger the recovery (as it
> will be used mainly for replication purposes).

I sympathise with this view, to an extent.

If people want to put all parameters in one file, they can do so. So +1 to that.

Should they be forced to adopt that new capability by us deliberately
breaking their existing setups? No. So -1 to that.

If we do an automatic include of recovery.conf first, then follow by
reading postgresql,conf then we will preserve the old as well as
allowing the new.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Fri, Sep 16, 2011 at 1:13 PM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
> On fre, 2011-09-16 at 01:32 -0400, Tom Lane wrote:
>> As far as the other issues go, I think there is actually a
>> prerequisite
>> discussion to be had here, which is whether we are turning the
>> recovery
>> parameters into plain old GUCs or not.  If they are plain old GUCs,
>> then
>> they will presumably still have their values when we are *not* doing
>> recovery.  That leads to a couple of questions:
>> * will seeing these values present in pg_settings confuse anybody?
>
> How so?  We add or change the available parameters all the time.
>
>> * can the values be changed when not in recovery, if so what happens,
>>   and again will that confuse anybody?
>
> Should be similar to archive_command and archive_mode.  You can still
> see and change archive_command when archive_mode is off.

I do think special handling would be useful here, of some kind. We
could reset them as well, if we wished, but that is probably more
trouble than is worth.

Perhaps we need a new SCOPE attribute on pg_settings to show whether
the parameter applies in recovery, in normal or both.

>> * is there any security hazard from ordinary users being able to see
>>   what settings had been used?
>
> Again, not much different from the archive_* settings.  They are, after
> all, almost the same in the opposite direction.

There is a potential security hole if people hardcode passwords into
primary_conninfo. As long as we document not to do that, we're OK.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

Simon Riggs <simon(at)2ndQuadrant(dot)com> writes:
> I sympathise with this view, to an extent.

> If people want to put all parameters in one file, they can do so. So +1 to that.

> Should they be forced to adopt that new capability by us deliberately
> breaking their existing setups? No. So -1 to that.

> If we do an automatic include of recovery.conf first, then follow by
> reading postgresql,conf then we will preserve the old as well as
> allowing the new.

I don't buy this argument at all. I don't believe that recovery.conf is
part of anyone's automated processes at all, let alone to an extent that
they won't be able to cope with a change to rationalize the file layout.
And most especially I don't buy that someone who does want to keep using
it couldn't cope with adding an "include" to postgresql.conf manually.

If we're going to move these parameters into postgresql.conf, we should
just do that and remove all mention of recovery.conf. Anything else
will generate much more confusion than benefit.

regards, tom lane

> I don't buy this argument at all. I don't believe that recovery.conf is
> part of anyone's automated processes at all, let alone to an extent that
> they won't be able to cope with a change to rationalize the file layout.
> And most especially I don't buy that someone who does want to keep using
> it couldn't cope with adding an "include" to postgresql.conf manually.

Speaking as someone who has a lot of client admin scripts written around
recovery.conf, we will be *thrilled* to update those scripts in order to
simplify the configuration file situation. Having a third conf file (or
fourth, or fifth, depending on which auth features you're using) already
adds unwarranted complexity to automation scripts, and each config file
we get rid of makes those scripts easier to maintain and troubleshoot.

For that matter, I'd love to consolidate pg_hba and pg_ident into a
single file. Any chance?

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

All,

First, if we're going to change behavior, I assert that we should stop
calling stuff "recovery" and either call it "replica" or "standby". Our
use of the word "recovery" confuses users; it is historical in nature
and requires an understanding of PostgreSQL internals to know why it's
called that. It's also inconsistent with our use of the word "standby"
everywhere else.

Second, I haven't seen a response to this:

> Do we want a trigger file to enable recovery, or one to *disable*
recovery? Or both?

I'll go further and say that we only want one trigger file by default,
one which either enables or disables recovery. I'll further suggest
that we:

a) have a standby.on file which puts the server in replica/recovery mode
if it's detected on startup, and
b) that we poll for the standby.on file going away as a trigger to stop
recovery and bring up the server in master mode, and
c) that pg_basebackup automatically create a standby.on file.

> Perhaps we need a new SCOPE attribute on pg_settings to show whether
> the parameter applies in recovery, in normal or both.

An overhaul of the category tree would also do that. I've been putting
off an overhaul/cleanup of categories for pg_settings, maybe it's about
time.

> There is a potential security hole if people hardcode passwords into
> primary_conninfo. As long as we document not to do that, we're OK.

Yeah, I'd almost be inclined to actively prohibit this, but that would
draw user complaints. We'll have to be satisfied with a doc plus a comment.

Speaking of which, .pgpass could be better documented as an option for
handling this sort of thing. Will take a stab, eventually.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Tue, Sep 20, 2011 at 1:01 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
> I'll go further and say that we only want one trigger file by default,
> one which either enables or disables recovery.  I'll further suggest
> that we:
>
> a) have a standby.on file which puts the server in replica/recovery mode
> if it's detected on startup, and
> b) that we poll for the standby.on file going away as a trigger to stop
> recovery and bring up the server in master mode, and
> c) that pg_basebackup automatically create a standby.on file.

It seems a bit confusing to me to have a file that takes effect only
at startup when created but anytime when removed.

I think one of the insufficiently-lauded 9.1 features is Fujii Masao's
"pg_ctl promote". Now THAT is a good interface. Unlike
trigger_file, it doesn't require any advance preparation, or monkeying
with files on disk. You just tell it to promote, and it does. Sweet.
Now it turns out that it uses a file to make that happen behind the
scenes, but who cares? From the user's perspective It Just Works.

I like the idea of some kind of sentinel file that tells the server to
start up in recovery mode. But instead of having the user remove it
to cause a promotion, I think the server should remove it when it does
promote. That's more like what we've done in the past, and it ties in
very nicely with what pg_ctl promote already does.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On 9/20/11 10:09 AM, Robert Haas wrote:
> I like the idea of some kind of sentinel file that tells the server to
> start up in recovery mode. But instead of having the user remove it
> to cause a promotion, I think the server should remove it when it does
> promote. That's more like what we've done in the past, and it ties in
> very nicely with what pg_ctl promote already does.

Yes, I agree that that is a superior approach.

And then we could keep the trigger_file configuration parameter for
backwards compatibility, with intent to depreciate it after a couple
more Postgres versions.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

Josh Berkus <josh(at)agliodbs(dot)com> writes:
> First, if we're going to change behavior, I assert that we should stop
> calling stuff "recovery" and either call it "replica" or "standby". Our
> use of the word "recovery" confuses users; it is historical in nature
> and requires an understanding of PostgreSQL internals to know why it's
> called that. It's also inconsistent with our use of the word "standby"
> everywhere else.

Are we all talking about the same thing? In my mind recovery.conf is
for configuring a point-in-time archive recovery run. It's got nothing
to do with either replication or standbys. Perhaps part of our problem
here is overloading that case with standby behavior.

> Second, I haven't seen a response to this:

> Do we want a trigger file to enable recovery, or one to *disable*
> recovery? Or both?

As far as the PITR scenario is concerned, only the former can possibly
make any sense; the latter would be downright dangerous.

>> There is a potential security hole if people hardcode passwords into
>> primary_conninfo. As long as we document not to do that, we're OK.

> Yeah, I'd almost be inclined to actively prohibit this, but that would
> draw user complaints. We'll have to be satisfied with a doc plus a comment.

I think that marking the GUC as "only readable by superuser" is a
sufficient fix.

regards, tom lane

On Tue, Sep 20, 2011 at 1:30 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Josh Berkus <josh(at)agliodbs(dot)com> writes:
>> First, if we're going to change behavior, I assert that we should stop
>> calling stuff "recovery" and either call it "replica" or "standby".  Our
>> use of the word "recovery" confuses users; it is historical in nature
>> and requires an understanding of PostgreSQL internals to know why it's
>> called that.  It's also inconsistent with our use of the word "standby"
>> everywhere else.
>
> Are we all talking about the same thing?  In my mind recovery.conf is
> for configuring a point-in-time archive recovery run.  It's got nothing
> to do with either replication or standbys.

Huh? How else can you create a standby? I do it by creating a
recovery.conf file that says:

standby_mode=on
primary_conninfo='whatever'

I wasn't aware that there is another method.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

Robert Haas <robertmhaas(at)gmail(dot)com> writes:
> On Tue, Sep 20, 2011 at 1:30 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> Are we all talking about the same thing? In my mind recovery.conf is
>> for configuring a point-in-time archive recovery run. It's got nothing
>> to do with either replication or standbys.

> Huh? How else can you create a standby? I do it by creating a
> recovery.conf file that says:
> standby_mode=on

The point I'm trying to make is that it seems like this discussion is
getting driven entirely by the standby case, without remembering that
recovery.conf was originally designed for, and is still used in,
a significantly different use-case. Maybe we had better take two
steps back and think about the implications for the archive-recovery
case.

regards, tom lane

> The point I'm trying to make is that it seems like this discussion is
> getting driven entirely by the standby case, without remembering that
> recovery.conf was originally designed for, and is still used in,
> a significantly different use-case. Maybe we had better take two
> steps back and think about the implications for the archive-recovery
> case.

I think we should take that into consideration, sure. But it should not
be in the driver's seat for things like nomenclature. Far more people
use replication than use PITR.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Tue, Sep 20, 2011 at 3:10 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Robert Haas <robertmhaas(at)gmail(dot)com> writes:
>> On Tue, Sep 20, 2011 at 1:30 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>>> Are we all talking about the same thing?  In my mind recovery.conf is
>>> for configuring a point-in-time archive recovery run.  It's got nothing
>>> to do with either replication or standbys.
>
>> Huh?  How else can you create a standby?  I do it by creating a
>> recovery.conf file that says:
>> standby_mode=on
>
> The point I'm trying to make is that it seems like this discussion is
> getting driven entirely by the standby case, without remembering that
> recovery.conf was originally designed for, and is still used in,
> a significantly different use-case.  Maybe we had better take two
> steps back and think about the implications for the archive-recovery
> case.

I'm not sure there really are any implications that are worth getting
excited about. The problem is really one of naming; I'm reminded of
our recent discussions of the use of the term "relation". The problem
is that the word "recovery" encompasses a number of very different
scenarios. First, we have crash recovery. Second, we have archive
recovery (which, confusingly enough, no longer requires an archive).
Archive recovery can be further subdivided by where the xlog files are
coming from (archive, streaming replication, both, or neither) and how
long we plan to stay in recovery (forever, if acting as a standby;
until end of WAL, if promoting a standby or recovering a hot backup;
or until the recovery target is reached, if performing a point in time
recovery). I would guess that most of those are not what the typical
user thinks of as "recovery", but what else are we gonna call it?
Josh is arguing that we ought to use the term "replication", but it
seems to me that's just as misleading - maybe moreso, since "recovery"
is sufficiently a term of art to make you at least think about reading
the manual, whereas you know (or think you know) what replication is.

For now, I think we're best off not changing the terminology, and
confining the remit of this patch to (a) turning all of the existing
recovery.conf parameters into GUCs and (b) replacing recovery.conf
with a sentinel file a sentinel file (name TBB) to indicate that the
server is to start in recovery mode. The naming isn't great but the
more we change at once the less chance of reaching agreement. It
seems like we have pretty broad agreement on the basics here, so let's
start with that.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

Robert,

> Josh is arguing that we ought to use the term "replication", but it

Actually, no. I'm arguing that we should use the term "standby", since
that term is consistent with how we refer to replica servers throughout
the docs, and the term "recovery" is not.

> seems to me that's just as misleading - maybe moreso, since "recovery"
> is sufficiently a term of art to make you at least think about reading
> the manual, whereas you know (or think you know) what replication is.

Nope. What it means is that users see stuff relating to "recovery" and
say "oh, that's not right, the replication stuff must be somewhere else".

I've taught a half-dozen classes on PostgreSQL binary replication now,
and the "recovery" nomenclature *always* confuses students.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Wed, Sep 21, 2011 at 12:55 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>> Josh is arguing that we ought to use the term "replication", but it
>
> Actually, no. I'm arguing that we should use the term "standby", since
> that term is consistent with how we refer to replica servers throughout
> the docs, and the term "recovery" is not.
>
>> seems to me that's just as misleading - maybe moreso, since "recovery"
>> is sufficiently a term of art to make you at least think about reading
>> the manual, whereas you know (or think you know) what replication is.
>
> Nope.  What it means is that users see stuff relating to "recovery" and
> say "oh, that's not right, the replication stuff must be somewhere else".
>
> I've taught a half-dozen classes on PostgreSQL binary replication now,
> and the "recovery" nomenclature *always* confuses students.

Yeah, I get it. But I think standby would confuse them, too, just in
a different set of situations.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

> Yeah, I get it. But I think standby would confuse them, too, just in
> a different set of situations.

Other than PITR, what situations?

PITR is used by a minority of our users. Binary replication, if not
already used by a majority, will be in the future (it's certainly the
majority of my professional clients). Further, PITR is usually
something which is either handled by vendor backup management software,
or by professional DBAs, whereas replication is used by developers with
little or no DBA support.

Why should we make terminology obscure for the majority usecase to make
it clear for the minority one? Especially since the majority use-case
has almost all the newbies?

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Wed, Sep 21, 2011 at 1:03 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>> Yeah, I get it.  But I think standby would confuse them, too, just in
>> a different set of situations.
>
> Other than PITR, what situations?

Hot backup?

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On 9/21/11 10:07 AM, Robert Haas wrote:
> On Wed, Sep 21, 2011 at 1:03 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>>> Yeah, I get it. But I think standby would confuse them, too, just in
>>> a different set of situations.
>>
>> Other than PITR, what situations?
>
> Hot backup?

Hot backup == PITR. You're just not bothering to accumulate WAL logs.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Wed, Sep 21, 2011 at 1:08 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
> On 9/21/11 10:07 AM, Robert Haas wrote:
>> On Wed, Sep 21, 2011 at 1:03 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>>>> Yeah, I get it.  But I think standby would confuse them, too, just in
>>>> a different set of situations.
>>>
>>> Other than PITR, what situations?
>>
>> Hot backup?
>
> Hot backup == PITR.   You're just not bothering to accumulate WAL logs.

Well, I don't think of it that way, but YMMV, of course.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Wed, Sep 21, 2011 at 1:13 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> On Wed, Sep 21, 2011 at 1:08 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>> On 9/21/11 10:07 AM, Robert Haas wrote:
>>> On Wed, Sep 21, 2011 at 1:03 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>>>>> Yeah, I get it.  But I think standby would confuse them, too, just in
>>>>> a different set of situations.
>>>>
>>>> Other than PITR, what situations?
>>>
>>> Hot backup?
>>
>> Hot backup == PITR.   You're just not bothering to accumulate WAL logs.
>
> Well, I don't think of it that way, but YMMV, of course.

I think that the major differentiating factor is the "intended action
when caught up", and the definition of caught up, and trying to use a
single term for both of them is going to always cause confusion.

So I tend to think of the use cases by their "continuation". A
"slave" is intended to "continually keep trying to get more" once it's
retrieved and applied all the changes it can. It can be hot, or cold,
streaming, or archive, etc... And "recovery" is intended to stop
recovering and become "normal" once it's finished retrieving and
applying all changes it can. Again, it has multiple ways to retrive
it's wal too.

And I think Tom touched on this point in the
"recovery.conf/recovery.done" thread a bit too. Maybe we need to
really start talking about the different "when done do ..."
distinctions, and and using that distinction to help our nomenclature.

Both recovery/slave (both hot or cold) use the same retrieve/apply
machinery (and thus configuration options). But because of the
different "caught up action", are different features.

a.

--
Aidan Van Dyk                                             Create like a god,
aidan(at)highrise(dot)ca                                       command like a king,
http://www.highrise.ca/                                   work like a slave.

On Wed, Sep 21, 2011 at 1:34 PM, Aidan Van Dyk <aidan(at)highrise(dot)ca> wrote:

> And I think Tom touched on this point in the
> "recovery.conf/recovery.done" thread a bit too.

Doh! That's this thread....

/me slinks away, ashamed for not even taking a close look at the to/cc list...

--
Aidan Van Dyk                                             Create like a god,
aidan(at)highrise(dot)ca                                       command like a king,
http://www.highrise.ca/                                   work like a slave.

On tis, 2011-09-20 at 16:38 -0400, Robert Haas wrote:
> For now, I think we're best off not changing the terminology, and
> confining the remit of this patch to (a) turning all of the existing
> recovery.conf parameters into GUCs and (b) replacing recovery.conf
> with a sentinel file a sentinel file (name TBB) to indicate that the
> server is to start in recovery mode. The naming isn't great but the
> more we change at once the less chance of reaching agreement. It
> seems like we have pretty broad agreement on the basics here, so let's
> start with that.

The only thing that's slightly bogus about that is that if you were
doing an archive recovery, you'd have to edit the main postgresql.conf
with one-shot parameters for that particular recovery (and then delete
them again, or leave them in place, confusing the next guy). But
perhaps that's worth the overall simplification.

On Tue, Sep 20, 2011 at 5:23 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Simon Riggs <simon(at)2ndQuadrant(dot)com> writes:
>> I sympathise with this view, to an extent.
>
>> If people want to put all parameters in one file, they can do so. So +1 to that.
>
>> Should they be forced to adopt that new capability by us deliberately
>> breaking their existing setups? No. So -1 to that.
>
>> If we do an automatic include of recovery.conf first, then follow by
>> reading postgresql,conf then we will preserve the old as well as
>> allowing the new.
>
> I don't buy this argument at all.  I don't believe that recovery.conf is
> part of anyone's automated processes at all, let alone to an extent that
> they won't be able to cope with a change to rationalize the file layout.

There are many. Tools I can name include pgpool, 2warm, PITRtools, but
there are also various tools from Sun, an IBM reseller I have
forgotten the name of, OmniTI and various other backup software
providers. Those are just the ones I can recall quickly. We've
encouraged people to write software on top and they have done so.

Breaking backwards compatibility isn't something we do elsewhere, when
its easy to keep it.

I don't object to new functionality (and agreed to it upthread), just
don't break the old way when there is no need.

> And most especially I don't buy that someone who does want to keep using
> it couldn't cope with adding an "include" to postgresql.conf manually.

This just creates a barrier to upgrade. Most people using PostgreSQL
use multiple releases, so its a pain to have to maintain multiple
versions of scripts to have things work properly. Even people that
don't mind changing won't be able to do it fully. That creates
confusion, which leads to mistakes.

These things relate to backup and recovery. Any changes to them give
risk of data loss. Cosmetic considerations are secondary.

There is no command to safely confirm that "include recovery.conf" is
added to postgresql.conf, so leaving it optional makes it unclear as
to whether the old ways will work or not.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On 09/20/2011 09:23 AM, Tom Lane wrote:
> Simon Riggs<simon(at)2ndQuadrant(dot)com> writes:
>> I sympathise with this view, to an extent.
>

>> If we do an automatic include of recovery.conf first, then follow by
>> reading postgresql,conf then we will preserve the old as well as
>> allowing the new.
>
> I don't buy this argument at all. I don't believe that recovery.conf is
> part of anyone's automated processes at all, let alone to an extent that
> they won't be able to cope with a change to rationalize the file layout.
> And most especially I don't buy that someone who does want to keep using
> it couldn't cope with adding an "include" to postgresql.conf manually.

As Simon has already appropriately posted.... You would be incorrect.

Joshua D. Drake

--
Command Prompt, Inc. - http://www.commandprompt.com/
PostgreSQL Support, Training, Professional Services and Development
The PostgreSQL Conference - http://www.postgresqlconference.org/
@cmdpromptinc - @postgresconf - 509-416-6579

Simon,

> There are many. Tools I can name include pgpool, 2warm, PITRtools, but
> there are also various tools from Sun, an IBM reseller I have
> forgotten the name of, OmniTI and various other backup software
> providers. Those are just the ones I can recall quickly. We've
> encouraged people to write software on top and they have done so.

Actually, just to correct this list:
* there are no tools from Sun
* pgPool2 does not deal with recovery.conf
* there are additional ones: WAL-E, etc., which may or may not need to
be edited.

> Breaking backwards compatibility isn't something we do elsewhere, when
> its easy to keep it.

FWIW, I've already found that I have to modify all my backup scripts for
9.0 from 8.4, and again for 9.1 from 9.0. So we do break backwards
compatibility, frequently.

> I don't object to new functionality (and agreed to it upthread), just
> don't break the old way when there is no need.

I'm happy to make upgrades easier, but I want a path which eventually
ends in recovery.conf going away. It's a bad API, confuses our users,
and is difficult to support and maintain. If you think it's easier on
our users to do that in stages over several versions rather than in one
fell swoop, then let's plan it that way.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Fri, Sep 23, 2011 at 12:51 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
> I'm happy to make upgrades easier, but I want a path which eventually
> ends in recovery.conf going away.  It's a bad API, confuses our users,
> and is difficult to support and maintain.

I agree.

GUC = Grand Unified Configuration, but recovery.conf is an example of
where it's not so unified after all. We've already done a non-trivial
amount of work to allow recovery.conf values to be specified without
quotes, a random incompatibility with GUCs that resulted from having
different parsing code for each file. If that were the last issue,
then maybe it wouldn't be worth worrying about, but it's not. For
example, it would be nice to have reload behavior on SIGHUP. And we
keep talking about having an ALTER SYSTEM SET guc = value or SET
PERMANENT guc = value command, and I think ALTER SYSTEM SET
recovery_target_time = '...' would be pretty sweet. I don't want us
to have to implement such things separately for postgresql.conf and
recovery.conf.

Now, it's true that Simon's proposal (of having recovery.conf
automatically included) if it exists doesn't necessarily preclude
those things. But it seems to me that it is adding a lot of
complexity to core for a pretty minimal benefit to end-users, and that
the semantics are not going to end up being very clean. For example,
now you potentially have the situation where recovery.conf has
work_mem=128MB and postgresql.conf has work_mem=4MB, and now when you
end recovery you've got to make sure that everyone picks up the new
setting. Now, in some sense you could say that's a feature addition,
and I'm not going to deny that it might be useful to some people, but
I think it's also going to require a fairly substantial convolution of
the GUC machinery, and it's going to discourage people from moving
away from recovery.conf. And like Josh, I think that ought to be the
long-term goal, for the reasons he states.

I don't want to go willy-nilly breaking third-party tools that work
with PostgreSQL, but in this case I think that the reason there are so
many tools in the first place is because what we're providing in core
is not very good. If we are unwilling to improve it for fear of
breaking compatibility with the tools, then we are stuck.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Sep23, 2011, at 17:46 , Peter Eisentraut wrote:
> On tis, 2011-09-20 at 16:38 -0400, Robert Haas wrote:
>> For now, I think we're best off not changing the terminology, and
>> confining the remit of this patch to (a) turning all of the existing
>> recovery.conf parameters into GUCs and (b) replacing recovery.conf
>> with a sentinel file a sentinel file (name TBB) to indicate that the
>> server is to start in recovery mode. The naming isn't great but the
>> more we change at once the less chance of reaching agreement. It
>> seems like we have pretty broad agreement on the basics here, so let's
>> start with that.
>
> The only thing that's slightly bogus about that is that if you were
> doing an archive recovery, you'd have to edit the main postgresql.conf
> with one-shot parameters for that particular recovery (and then delete
> them again, or leave them in place, confusing the next guy). But
> perhaps that's worth the overall simplification.

OTOH, if they're GUCs, you can specify them on the postmaster's
command line. We could even get crazy and patch pg_ctl to allow

<untar base backup>
pg_ctl recover -D <dir> --target_xid=<the xid that broke stuff> --target_inclusive=false
pg_ctl start -D <dir>

best regards,
Florian Pflug

Josh,

>> There are many. Tools I can name include pgpool, 2warm, PITRtools, but
>> there are also various tools from Sun, an IBM reseller I have
>> forgotten the name of, OmniTI and various other backup software
>> providers. Those are just the ones I can recall quickly. We've
>> encouraged people to write software on top and they have done so.
>
> Actually, just to correct this list:
> * there are no tools from Sun
> * pgPool2 does not deal with recovery.conf

I'm not sure what you mean by "not deal with" but part of pgpool-II's
functionality assumes that we can easily generate recovery.conf. If
reconf.conf is integrated into postgresql.conf, we need to edit
postgresql.conf, which is a little bit harder than generating
recovery.conf, I think.

> * there are additional ones: WAL-E, etc., which may or may not need to
> be edited.
>
>> Breaking backwards compatibility isn't something we do elsewhere, when
>> its easy to keep it.
>
> FWIW, I've already found that I have to modify all my backup scripts for
> 9.0 from 8.4, and again for 9.1 from 9.0. So we do break backwards
> compatibility, frequently.
>
>> I don't object to new functionality (and agreed to it upthread), just
>> don't break the old way when there is no need.
>
> I'm happy to make upgrades easier, but I want a path which eventually
> ends in recovery.conf going away. It's a bad API, confuses our users,
> and is difficult to support and maintain. If you think it's easier on
> our users to do that in stages over several versions rather than in one
> fell swoop, then let's plan it that way.
>
> --
> Josh Berkus
> PostgreSQL Experts Inc.
> http://pgexperts.com
>
> --
> Sent via pgsql-hackers mailing list (pgsql-hackers(at)postgresql(dot)org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-hackers

> I'm not sure what you mean by "not deal with" but part of pgpool-II's
> functionality assumes that we can easily generate recovery.conf. If
> reconf.conf is integrated into postgresql.conf, we need to edit
> postgresql.conf, which is a little bit harder than generating
> recovery.conf, I think.

Oh? Clearly I've been abusing pgPool2 then. Where's the code that
generates that?

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Fri, Sep 23, 2011 at 6:17 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> On Fri, Sep 23, 2011 at 12:51 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>> I'm happy to make upgrades easier, but I want a path which eventually
>> ends in recovery.conf going away.  It's a bad API, confuses our users,
>> and is difficult to support and maintain.
>
> I agree.
>
> GUC = Grand Unified Configuration, but recovery.conf is an example of
> where it's not so unified after all.  We've already done a non-trivial
> amount of work to allow recovery.conf values to be specified without
> quotes, a random incompatibility with GUCs that resulted from having
> different parsing code for each file.  If that were the last issue,
> then maybe it wouldn't be worth worrying about, but it's not.  For
> example, it would be nice to have reload behavior on SIGHUP.
...
> I don't want us
> to have to implement such things separately for postgresql.conf and
> recovery.conf.

It was always my plan to do exactly the above, and there are code
comments that say that from 2004. The time to replace it is now and I
welcome that day and have already agreed to it.

We all want every word quoted above and nothing there is under debate.

> And we
> keep talking about having an ALTER SYSTEM SET guc = value or SET
> PERMANENT guc = value command, and I think ALTER SYSTEM SET
> recovery_target_time = '...' would be pretty sweet.  I don't want us
> to have to implement such things separately for postgresql.conf and
> recovery.conf.

There is a reason why it doesn't work that way which you overlook.
Please start a separate thread if you wish to discuss that.

> Now, it's true that Simon's proposal (of having recovery.conf
> automatically included) if it exists doesn't necessarily preclude
> those things.  But it seems to me that it is adding a lot of
> complexity to core for a pretty minimal benefit to end-users, and that
> the semantics are not going to end up being very clean.  For example,
> now you potentially have the situation where recovery.conf has
> work_mem=128MB and postgresql.conf has work_mem=4MB, and now when you
> end recovery you've got to make sure that everyone picks up the new
> setting.  Now, in some sense you could say that's a feature addition,
> and I'm not going to deny that it might be useful to some people, but
> I think it's also going to require a fairly substantial convolution of
> the GUC machinery, and it's going to discourage people from moving
> away from recovery.conf.  And like Josh, I think that ought to be the
> long-term goal, for the reasons he states.

The semantics are clear: recovery.conf is read first, then
postgresql.conf. It's easy to implement (1 line of code) and easy to
understand.

So we can support the old and the new very, very easily and clearly.
"Complexity" - no definitely not. "Minimal benefit for end users" -
backwards compatibility isn't minimal benefit. It's a major issue.

If you put things in two places, yes that causes problems. You can
already add the same parameter twice and cause exactly the same
problems.

> I don't want to go willy-nilly breaking third-party tools that work
> with PostgreSQL, but in this case I think that the reason there are so
> many tools in the first place is because what we're providing in core
> is not very good.  If we are unwilling to improve it for fear of
> breaking compatibility with the tools, then we are stuck.

No, there are many tools because there are many requirements. A
simple, open API has allowed our technology to be widely used. That
was by design not by chance.

Nobody is unwilling to improve it. The debate is about people being
unwilling to provide a simple and easy to understand backwards
compatibility feature, which breaks things for no reason and does not
interfere with the proposed new features.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Fri, Sep 23, 2011 at 5:51 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
> Simon,
>
>> There are many. Tools I can name include pgpool, 2warm, PITRtools, but
>> there are also various tools from Sun, an IBM reseller I have
>> forgotten the name of, OmniTI and various other backup software
>> providers. Those are just the ones I can recall quickly. We've
>> encouraged people to write software on top and they have done so.
>
> Actually, just to correct this list:
> * there are no tools from Sun

Just for the record, I sat through a 1 hour presentation at the
PostgreSQL UK conference from a Sun employee describing the product
and its very clear use of PostgreSQL facilities. Josh definitely
wasn't at that presentation, many others here were.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

>> I'm not sure what you mean by "not deal with" but part of pgpool-II's
>> functionality assumes that we can easily generate recovery.conf. If
>> reconf.conf is integrated into postgresql.conf, we need to edit
>> postgresql.conf, which is a little bit harder than generating
>> recovery.conf, I think.
>
> Oh? Clearly I've been abusing pgPool2 then. Where's the code that
> generates that?

pgpool-II itself does not generate the file but scripts for pgpool-II
are generating the file as stated in documentation comimg with
pgpool-II.
--
Tatsuo Ishii
SRA OSS, Inc. Japan
English: http://www.sraoss.co.jp/index_en.php
Japanese: http://www.sraoss.co.jp

On Sat, Sep 24, 2011 at 9:02 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> The semantics are clear: recovery.conf is read first, then
> postgresql.conf. It's easy to implement (1 line of code) and easy to
> understand.

Eh, well, if you can implement it in one line of code, consider my
objection withdrawn. I can't see how that would be possible, though.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Fri, Sep 23, 2011 at 6:55 PM, Tatsuo Ishii <ishii(at)postgresql(dot)org> wrote:
>>> There are many. Tools I can name include pgpool, 2warm, PITRtools, but
>>> there are also various tools from Sun, an IBM reseller I have
>>> forgotten the name of, OmniTI and various other backup software
>>> providers. Those are just the ones I can recall quickly. We've
>>> encouraged people to write software on top and they have done so.
>>
>> Actually, just to correct this list:
>> * there are no tools from Sun
>> * pgPool2 does not deal with recovery.conf
>
> I'm not sure what you mean by "not deal with" but part of pgpool-II's
> functionality assumes that we can easily generate recovery.conf. If
> reconf.conf is integrated into postgresql.conf, we need to edit
> postgresql.conf, which is a little bit harder than generating
> recovery.conf, I think.

Since we haven't yet come up with a reasonable way of machine-editing
postgresql.conf, this seems like a fairly serious objection to getting
rid of recovery.conf. I wonder if there's a way we can work around
that...

*thinks a little*

What if we modified pg_ctl to allow passing configuration parameters
through to postmaster, so you could do something like this:

pg_ctl start -c work_mem=8MB -c recovery_target_time='...'

Would that meet pgpool's needs?

(Sadly pg_ctl -c means something else right now, so we'd probably have
to pick another option name, but you get the idea.)

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

Simon Riggs <simon(at)2ndQuadrant(dot)com> writes:
> ... The time to replace it is now and I
> welcome that day and have already agreed to it.

Okay, so you do agree that eventually we want to be rid of
recovery.conf? I think everyone else agrees on that. But if we are
going to remove recovery.conf eventually, what is the benefit of
postponing doing so? The pain is going to be inflicted sooner or later,
and the longer we wait, the more third-party code there is likely to be
that expects it to exist. If optionally reading it helped provide a
smoother transition, then maybe there would be some point. But AFAICS
having a temporary third behavior will just make things even more
complicated, not less so, for third-party code that needs to cope with
multiple versions.

> The semantics are clear: recovery.conf is read first, then
> postgresql.conf. It's easy to implement (1 line of code) and easy to
> understand.

It's not clear to me why the override order should be that way; I'd have
expected the other way myself. So this isn't as open-and-shut as you
think.

regards, tom lane

Robert Haas <robertmhaas(at)gmail(dot)com> writes:
> On Fri, Sep 23, 2011 at 6:55 PM, Tatsuo Ishii <ishii(at)postgresql(dot)org> wrote:
>> I'm not sure what you mean by "not deal with" but part of pgpool-II's
>> functionality assumes that we can easily generate recovery.conf. If
>> reconf.conf is integrated into postgresql.conf, we need to edit
>> postgresql.conf, which is a little bit harder than generating
>> recovery.conf, I think.

> Since we haven't yet come up with a reasonable way of machine-editing
> postgresql.conf, this seems like a fairly serious objection to getting
> rid of recovery.conf.

I don't exactly buy this argument. If postgresql.conf is hard to
machine-edit, why is recovery.conf any easier?

> What if we modified pg_ctl to allow passing configuration parameters
> through to postmaster,

You mean like pg_ctl -o?

regards, tom lane

On Sep 24, 2011, at 1:04 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> I don't exactly buy this argument. If postgresql.conf is hard to
> machine-edit, why is recovery.conf any easier?

Because you generally just write a brand-new file, without worrying about preserving existing settings. You aren't really editing at all, just writing.

>
>> What if we modified pg_ctl to allow passing configuration parameters
>> through to postmaster,
>
> You mean like pg_ctl -o?

Oh, cool. Yes, like that.

...Robert

On Sat, Sep 24, 2011 at 6:01 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Simon Riggs <simon(at)2ndQuadrant(dot)com> writes:
>> ... The time to replace it is now and I
>> welcome that day and have already agreed to it.
>
> Okay, so you do agree that eventually we want to be rid of
> recovery.conf?  I think everyone else agrees on that.  But if we are
> going to remove recovery.conf eventually, what is the benefit of
> postponing doing so?

I am happy that we don't recommend the use of recovery.conf in the
future, and that the handling of the contents of recovery.conf should
be identical to the handling of postgresql.conf. The latter point has
always been the plan from day one.

(I should not have used "it" in my sentence, since doing so always
leads to confusion)

My joyous rush into agreeing to removal has since been replaced with
the cold reality that we must support backwards compatibility.
Emphasise "must".

>> The semantics are clear: recovery.conf is read first, then
>> postgresql.conf. It's easy to implement (1 line of code) and easy to
>> understand.
>
> It's not clear to me why the override order should be that way; I'd have
> expected the other way myself.  So this isn't as open-and-shut as you
> think.

I agree with you that recovery.conf as an override makes more sense,
though am happy with either way.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

> Since we haven't yet come up with a reasonable way of machine-editing
> postgresql.conf, this seems like a fairly serious objection to
> getting
> rid of recovery.conf. I wonder if there's a way we can work around
> that...

Well, we *did* actually come up with a reasonable way, but it died under an avalanche of bikeshedding and "we-must-do-everything-the-way-we-always-have-done". I refer, of course, to the "configuration directory" patch, which was a fine solution, and would indeed take care of the recovery.conf issues as well had we implemented it. We can *still* implement it, for 9.2.

> pg_ctl start -c work_mem=8MB -c recovery_target_time='...'

This wouldn't survive a restart, and isn't compatible with init scripts.

On Sat, Sep 24, 2011 at 3:49 PM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:
>> Since we haven't yet come up with a reasonable way of machine-editing
>> postgresql.conf, this seems like a fairly serious objection to
>> getting
>> rid of recovery.conf.  I wonder if there's a way we can work around
>> that...
>
> Well, we *did* actually come up with a reasonable way, but it died under an avalanche of bikeshedding and "we-must-do-everything-the-way-we-always-have-done".  I refer, of course, to the "configuration directory" patch, which was a fine solution, and would indeed take care of the recovery.conf issues as well had we implemented it.  We can *still* implement it, for 9.2.

Well, I find that a fairly ugly solution to the problem, but I agree
that it is solvable, if we could get a critical mass on any some
particular solution.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

Simon Riggs <simon(at)2ndQuadrant(dot)com> writes:
> On Sat, Sep 24, 2011 at 6:01 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> Okay, so you do agree that eventually we want to be rid of
>> recovery.conf? I think everyone else agrees on that. But if we are
>> going to remove recovery.conf eventually, what is the benefit of
>> postponing doing so?

> My joyous rush into agreeing to removal has since been replaced with
> the cold reality that we must support backwards compatibility.
> Emphasise "must".

[ shrug... ] I do not agree with your conclusion. We have to break
some eggs to make this omelet. The reason why we have a mess here is
that the recovery.conf mechanism, which was designed with only the
one-shot archive-recovery case in mind, has been abused beyond its
capacity. If we don't break with past practice we are not going to be
able to fix it. And it's not like we don't break configuration file
contents in most releases anyway, so I really fail to see why this one
has suddenly become sacrosanct.

regards, tom lane

Robert Haas <robertmhaas(at)gmail(dot)com> writes:
> On Sep 24, 2011, at 1:04 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> I don't exactly buy this argument. If postgresql.conf is hard to
>> machine-edit, why is recovery.conf any easier?

> Because you generally just write a brand-new file, without worrying
> about preserving existing settings. You aren't really editing at all,
> just writing.

If that's all the requirement is, it's trivial to implement.

1. Write your-random-configuration-settings into recovery.conf (or any
other file name you choose ... something named after your tool would be
a better idea).

2. Temporarily append "include recovery.conf" to the end of
postgresql.conf. Restart server.

3. When done, remove "include recovery.conf" from the end of
postgresql.conf.

The hard cases involve merging user-supplied and tool-supplied settings,
but "let's overwrite recovery.conf in toto" never would have been able
to handle such cases either.

regards, tom lane

Folks,

What happens currently if we have an \include in postgresql.conf for a file which doesn't exist? Is it ignored, or do we error out?

If it could just be ignored, maybe with a note in the logs, then we could be a lot more flexible.

--Josh Berkus

Joshua Berkus <josh(at)agliodbs(dot)com> writes:
> What happens currently if we have an \include in postgresql.conf for a file which doesn't exist? Is it ignored, or do we error out?

It's an error, and I think changing that would be a really bad idea.

> If it could just be ignored, maybe with a note in the logs, then we could be a lot more flexible.

There might be a use case for a separate directive include_if_exists,
or some such name. But I think the user should have to tell us very
clearly that it's okay for the file to not be found.

regards, tom lane

> There might be a use case for a separate directive include_if_exists,
> or some such name. But I think the user should have to tell us very
> clearly that it's okay for the file to not be found.

Better to go back to include_directory, then.

--Josh Berkus

On 09/25/2011 02:39 PM, Joshua Berkus wrote:
>> There might be a use case for a separate directive include_if_exists,
>> or some such name. But I think the user should have to tell us very
>> clearly that it's okay for the file to not be found.
> Better to go back to include_directory, then.
>
>

I rather like Tom's suggestion of include_if_exists.

There might be a case for include_directory, but I think that needs to
be made separately.

cheers

andrew

> I rather like Tom's suggestion of include_if_exists.

include_if_exists certainly solves the recovery.conf/recovery.done problem. We can even phase it out, like this:

9.2: include_if_exists = 'recovery.conf' in the default postgresql.conf file.
9.3: include_if_exists = 'recovery.conf' commented out by default
9.4: renaming recovery.conf to recovery.done by core PG code removed.

This gives users/vendors 3 years to update their scripts to remove dependence on recovery.conf. I'm afraid that I agree with Simon that there's already a whole buncha 3rd-party code out there to support the current system.

--Josh Berkus

Joshua Berkus <josh(at)agliodbs(dot)com> writes:
> include_if_exists certainly solves the recovery.conf/recovery.done problem. We can even phase it out, like this:

> 9.2: include_if_exists = 'recovery.conf' in the default postgresql.conf file.
> 9.3: include_if_exists = 'recovery.conf' commented out by default
> 9.4: renaming recovery.conf to recovery.done by core PG code removed.

> This gives users/vendors 3 years to update their scripts to remove dependence on recovery.conf. I'm afraid that I agree with Simon that there's already a whole buncha 3rd-party code out there to support the current system.

If there is indeed code out there that depends on the current system,
why do you think that waiting several releases to change it will make
things better? I think it's more likely that we'd just have *more* code
that needs to be changed, and no reduction in the pain level when the
transition does finally happen.

In any case, I thought we'd agreed that the use of that file as a flag
should go away now, so I quite fail to understand your comment about 9.4.

regards, tom lane

On lör, 2011-09-24 at 13:04 -0400, Tom Lane wrote:
> > What if we modified pg_ctl to allow passing configuration parameters
> > through to postmaster,
>
> You mean like pg_ctl -o?

Note that pg_ctl -o saves the parameters it uses and reapplies them
after a restart. So this is not really the way to apply parameter
settings only once for recovery. (Or at least it has the potential to
be a very confusing way.)

On lör, 2011-09-24 at 14:02 +0100, Simon Riggs wrote:
> The semantics are clear: recovery.conf is read first, then
> postgresql.conf. It's easy to implement (1 line of code) and easy to
> understand.

What's clear about that? My intuition would have been that
recovery.conf is read second.

On sön, 2011-09-25 at 12:58 -0400, Tom Lane wrote:
> And it's not like we don't break configuration file
> contents in most releases anyway, so I really fail to see why this one
> has suddenly become sacrosanct.

Well, there is a slight difference. Changes in postgresql.conf
parameter names and settings are adjusted automatically for me by my
package upgrade script. If we, say, changed the names of recovery.conf
parameters, I'd have to get a new version of my $SuperReplicationTool.
That tool could presumably look at PG_VERSION and put a recovery.conf
with the right spellings in the right place.

But if we completely change the way the replication configuration
interacts, it's not clear that a smooth upgrade is possible without
significant effort. That said, I don't see why it wouldn't be possible,
but let's design with upgradability in mind, instead of claiming that we
have never supported upgrades of this kind anyway.

On Tue, Sep 20, 2011 at 3:38 PM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>>> What about "recovery.trigger"?
>
> I'm OK with that name.
<snip>
>>> * is there any security hazard from ordinary users being able to see
>>>   what settings had been used?
>>
>> primary_conninfo could be a problem, since it's possible to set a password there.
>
> True. I agree that primary_conninfo should be restricted to superuser.

Though there is still ongonig discussion, since there is no objection about
the above two changes, I revised the patch that way. And I fixed the minor
bug handling the default value of recovery_target_timeline wrongly.
Attached is the revised version of the patch.

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Mon, Sep 26, 2011 at 7:45 PM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
> On sön, 2011-09-25 at 12:58 -0400, Tom Lane wrote:
>> And it's not like we don't break configuration file
>> contents in most releases anyway, so I really fail to see why this one
>> has suddenly become sacrosanct.
>
> Well, there is a slight difference.  Changes in postgresql.conf
> parameter names and settings are adjusted automatically for me by my
> package upgrade script.  If we, say, changed the names of recovery.conf
> parameters, I'd have to get a new version of my $SuperReplicationTool.
> That tool could presumably look at PG_VERSION and put a recovery.conf
> with the right spellings in the right place.
>
> But if we completely change the way the replication configuration
> interacts, it's not clear that a smooth upgrade is possible without
> significant effort.  That said, I don't see why it wouldn't be possible,
> but let's design with upgradability in mind, instead of claiming that we
> have never supported upgrades of this kind anyway.

Currently recovery.conf has two roles:

#1. recovery.conf is used as a trigger file to enable archive recovery.
At the end of recovery, recovery.conf is renamed to recovery.done.

#2. recovery.conf is used as a configuration file for recovery parameters.

Which role do you think we should support in 9.2 because of the backward
compatibility? Both? Unless I misunderstand the discussion so far, Tom and
Robert (and I) agree to get rid of both. Simon seems to agree to remove
only the former role, but not the latter. How about you? If you agree to
remove the former, too, let's focus on the discussion about whether the
latter role should be supported in 9.2.

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Tue, Sep 27, 2011 at 1:33 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>
> Though there is still ongonig discussion, since there is no objection about
> the above two changes, I revised the patch that way. And I fixed the minor
> bug handling the default value of recovery_target_timeline wrongly.
> Attached is the revised version of the patch.

This patch no longer applies as it conflicts with the following commit:

commit d56b3afc0376afe491065d9eca6440b3cc7b1346
Author: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Date: Sun Oct 2 16:50:04 2011 -0400

Restructure error handling in reading of postgresql.conf.

Cheers,

Jeff

On Tue, Sep 27, 2011 at 10:34 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
> On Mon, Sep 26, 2011 at 7:45 PM, Peter Eisentraut <peter_e(at)gmx(dot)net> wrote:
>> On sön, 2011-09-25 at 12:58 -0400, Tom Lane wrote:
>>> And it's not like we don't break configuration file
>>> contents in most releases anyway, so I really fail to see why this one
>>> has suddenly become sacrosanct.
>>
>> Well, there is a slight difference.  Changes in postgresql.conf
>> parameter names and settings are adjusted automatically for me by my
>> package upgrade script.  If we, say, changed the names of recovery.conf
>> parameters, I'd have to get a new version of my $SuperReplicationTool.
>> That tool could presumably look at PG_VERSION and put a recovery.conf
>> with the right spellings in the right place.
>>
>> But if we completely change the way the replication configuration
>> interacts, it's not clear that a smooth upgrade is possible without
>> significant effort.  That said, I don't see why it wouldn't be possible,
>> but let's design with upgradability in mind, instead of claiming that we
>> have never supported upgrades of this kind anyway.
>
> Currently recovery.conf has two roles:
>
> #1. recovery.conf is used as a trigger file to enable archive recovery.
>      At the end of recovery, recovery.conf is renamed to recovery.done.
>
> #2. recovery.conf is used as a configuration file for recovery parameters.
>
> Which role do you think we should support in 9.2 because of the backward
> compatibility? Both? Unless I misunderstand the discussion so far, Tom and
> Robert (and I) agree to get rid of both. Simon seems to agree to remove
> only the former role, but not the latter. How about you? If you agree to
> remove the former, too, let's focus on the discussion about whether the
> latter role should be supported in 9.2.

Tatsuo/Josh/Robert also discussed how recovery.conf can be used to
provide parameters solely for recovery. That is difficult to do
without causing all downstream tools to make major changes in the ways
they supply parameters.

Keeping our APIs relatively stable is important to downstream tools. I
have no objection to a brave new world, as long as you don't chuck out
the one that works right now. Breaking APIs needs a good reason and
I've not seen one discussed anywhere. No problem with immediately
deprecating the old API and declare is planned to be removed in
release 10.0.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

Simon,

> Tatsuo/Josh/Robert also discussed how recovery.conf can be used to
> provide parameters solely for recovery. That is difficult to do
> without causing all downstream tools to make major changes in the ways
> they supply parameters.

Actually, this case is easily solved by an "include recovery.conf"
parameter. So it's a non-issue.

> Keeping our APIs relatively stable is important to downstream tools. I
> have no objection to a brave new world, as long as you don't chuck out
> the one that works right now. Breaking APIs needs a good reason and
> I've not seen one discussed anywhere. No problem with immediately
> deprecating the old API and declare is planned to be removed in
> release 10.0.

So after debugging some of our failover scripts, here's the real-world
problems I'm trying to solve. These design flaws are issues which cause
automated failover or failback to abort, leading to unexpected downtime,
so they are not just issues of neatness:

1. Recovery.conf being both a configuration file AND a trigger to
initiate recovery mode, preventing us from separating configuration
management from failover.

2. The inability to read recovery.conf parameters via SQL on a hot
standby, forcing us to parse the file to find out its settings, or guess.

(1) is a quite serious issue; it effectively makes recovery.conf
impossible to integrate with puppet and other configuration management
frameworks. I also don't see a way to fix it without breaking backwards
compatibility.

BTW, I'm not criticizing the original design for this. We simply didn't
know better until lots of people were using these tools in production.
But it's time to fix them, and the longer we wait, the more painful it
will be.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On 10/10/11 10:52 AM, Josh Berkus wrote:
> So after debugging some of our failover scripts, here's the real-world
> problems I'm trying to solve. These design flaws are issues which cause
> automated failover or failback to abort, leading to unexpected downtime,
> so they are not just issues of neatness:

That's "automated failover or *manual* failback". I never, ever
recommend automated failback. Just FYI.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Mon, Oct 10, 2011 at 6:52 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:

>> Tatsuo/Josh/Robert also discussed how recovery.conf can be used to
>> provide parameters solely for recovery. That is difficult to do
>> without causing all downstream tools to make major changes in the ways
>> they supply parameters.
>
> Actually, this case is easily solved by an "include recovery.conf"
> parameter.  So it's a non-issue.

That is what I've suggested and yes, doing that is straightforward.

If you mean "do that in a program" if we had a problem with adding
parameters, we also have a problem adding an include.

We should avoid breaking programs which we have no reason to break.
Stability is good, change without purpose is not.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Sun, Oct 9, 2011 at 9:15 AM, Jeff Janes <jeff(dot)janes(at)gmail(dot)com> wrote:
> On Tue, Sep 27, 2011 at 1:33 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>>
>> Though there is still ongonig discussion, since there is no objection about
>> the above two changes, I revised the patch that way. And I fixed the minor
>> bug handling the default value of recovery_target_timeline wrongly.
>> Attached is the revised version of the patch.
>
> This patch no longer applies as it conflicts with the following commit:

Thanks! Attached patch is the updated version.

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Tue, Oct 11, 2011 at 6:37 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Mon, Oct 10, 2011 at 6:52 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>
>>> Tatsuo/Josh/Robert also discussed how recovery.conf can be used to
>>> provide parameters solely for recovery. That is difficult to do
>>> without causing all downstream tools to make major changes in the ways
>>> they supply parameters.
>>
>> Actually, this case is easily solved by an "include recovery.conf"
>> parameter.  So it's a non-issue.
>
> That is what I've suggested and yes, doing that is straightforward.

Even if we do that, you still need to modify the tool so that it can handle
the recovery trigger file. recovery.conf is used as just a configuration file
(not recovery trigger file at all). It's not renamed to recovery.done at the
end of recovery. If the tool depends on the renaming from recovery.conf
to recovery.done, it also would need to be modified. If the tool needs to
be changed anyway, why do you hesitate in changing it so that it adds
"include recovery.conf" into postgresql.conf automatically?

Or you think that, to keep the backward compatibility completely,
recovery.conf should be used as not only a configuration file but also a
recovery trigger one and it should be renamed to recovery.done at
the end of recovery?

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

Fujii Masao wrote:
> On Tue, Oct 11, 2011 at 6:37 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> > On Mon, Oct 10, 2011 at 6:52 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
> >
> >>> Tatsuo/Josh/Robert also discussed how recovery.conf can be used to
> >>> provide parameters solely for recovery. That is difficult to do
> >>> without causing all downstream tools to make major changes in the ways
> >>> they supply parameters.
> >>
> >> Actually, this case is easily solved by an "include recovery.conf"
> >> parameter. ?So it's a non-issue.
> >
> > That is what I've suggested and yes, doing that is straightforward.
>
> Even if we do that, you still need to modify the tool so that it can handle
> the recovery trigger file. recovery.conf is used as just a configuration file
> (not recovery trigger file at all). It's not renamed to recovery.done at the
> end of recovery. If the tool depends on the renaming from recovery.conf
> to recovery.done, it also would need to be modified. If the tool needs to
> be changed anyway, why do you hesitate in changing it so that it adds
> "include recovery.conf" into postgresql.conf automatically?
>
> Or you think that, to keep the backward compatibility completely,
> recovery.conf should be used as not only a configuration file but also a
> recovery trigger one and it should be renamed to recovery.done at
> the end of recovery?

As much as I appreciate Simon's work in this area, I think we are still
unclear if keeping backward-compatibility is worth the complexity
required for future users. Historically we have been bold in changing
postgresql.conf settings to improve clarity, and that approach has
served us well.

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ It's impossible for everything to be true. +

On 10/10/11 9:53 PM, Fujii Masao wrote:
> Or you think that, to keep the backward compatibility completely,
> recovery.conf should be used as not only a configuration file but also a
> recovery trigger one and it should be renamed to recovery.done at
> the end of recovery?

That's precisely my point. The trigger file nature of recovery.conf is
a problem in itself, and I don't see any way to support that and fix it
at the same time. Maybe Simon can?

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Tue, Oct 11, 2011 at 3:29 PM, Bruce Momjian <bruce(at)momjian(dot)us> wrote:

> As much as I appreciate Simon's work in this area, I think we are still
> unclear if keeping backward-compatibility is worth the complexity
> required for future users.  Historically we have been bold in changing
> postgresql.conf settings to improve clarity, and that approach has
> served us well.

You raise a good point. First, thank you for the respectful comment;
my viewpoint is not formed from resistance to change per se, even if
may appear to be so. Thank you for raising that possibility to allow
me to explain and refute that.

I am genuinely concerned that we show respect to downstream software
that uses our APIs and have no personal or corporate ulterior motive.

Most people are used to the 3 year cycle of development on which
SQLServer and Oracle have now standardised. Our 1 year cycle provides
a considerable benefit in agility, but it also provides for x3
complexity in release management and a continual temptation to change
for no good reason. I want to encourage people to adopt our APIs, not
give them a headache for attempting to do so. We know that software
exists that follows the previous API and we should take steps to
deprecate that across multiple releases, with appropriate notice, just
as we do in other cases, such as standard conforming strings where our
lack of boldness is appropriate.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

Simon Riggs wrote:
> On Tue, Oct 11, 2011 at 3:29 PM, Bruce Momjian <bruce(at)momjian(dot)us> wrote:
>
> > As much as I appreciate Simon's work in this area, I think we are still
> > unclear if keeping backward-compatibility is worth the complexity
> > required for future users. ?Historically we have been bold in changing
> > postgresql.conf settings to improve clarity, and that approach has
> > served us well.
>
> You raise a good point. First, thank you for the respectful comment;
> my viewpoint is not formed from resistance to change per se, even if
> may appear to be so. Thank you for raising that possibility to allow
> me to explain and refute that.
>
> I am genuinely concerned that we show respect to downstream software
> that uses our APIs and have no personal or corporate ulterior motive.
>
> Most people are used to the 3 year cycle of development on which
> SQLServer and Oracle have now standardised. Our 1 year cycle provides
> a considerable benefit in agility, but it also provides for x3
> complexity in release management and a continual temptation to change
> for no good reason. I want to encourage people to adopt our APIs, not
> give them a headache for attempting to do so. We know that software
> exists that follows the previous API and we should take steps to
> deprecate that across multiple releases, with appropriate notice, just
> as we do in other cases, such as standard conforming strings where our
> lack of boldness is appropriate.

Well, let me be specific. Around 2003 to 2006, we added many new
configuration parameters for logging, which required renaming or
removing older parameters. There really wasn't a smooth way to allow
for this to be done without impacting users, and the current system we
have enjoyed since 2006 is logical only because we made the changes
necessary.

We can look at trying to phase changes in, but often the phasing becomes
more complicated that just doing the change. Logging parameter changes
were easier because it was assumed logging was an admin-only task, as I
assume pitr and replication are as well. Standard conforming strings
was tricky because it was more user-facing, or certainly SQL-facing.

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ It's impossible for everything to be true. +

On Tue, Oct 11, 2011 at 9:28 PM, Bruce Momjian <bruce(at)momjian(dot)us> wrote:

> Standard conforming strings
> was tricky because it was more user-facing, or certainly SQL-facing.

Why is SQL more important than backup?

There is no good reason to do this so quickly.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

Simon Riggs wrote:
> On Tue, Oct 11, 2011 at 9:28 PM, Bruce Momjian <bruce(at)momjian(dot)us> wrote:
>
> > Standard conforming strings
> > was tricky because it was more user-facing, or certainly SQL-facing.
>
> Why is SQL more important than backup?

Because the percentage of database users it affects is different.
Administrators know when they are installing a new version of Postgres
and already are probably changing these configuration files.
Application binaries and perhaps application developers are not as aware
of a change, and there are a far higher percentage of them in an
organization than administrators.

> There is no good reason to do this so quickly.

I just gave you a reason above, and as I said, doing backward
compatibility can make the system more complex.

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ It's impossible for everything to be true. +

Simon,

I haven't see a response from you on a proposed way to keep backwards
compatibility with recovery.conf as a trigger file, while also
eliminating its trigger status as an unmanagable misfeature. As far as
I can tell, that's the one area where we *cannot* maintain backwards
compatibility.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Fri, Sep 9, 2011 at 10:56 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:

> In previous discussion, we've reached the consensus that we should unite
> recovery.conf and postgresql.conf. The attached patch does that. The
> patch is WIP, I'll have to update the document, but if you notice something,
> please feel free to comment.

My short summary of the thread is

Fujii proposes we allow parameters currently in recovery.conf to be
specified in postgresql.conf. All agree to that. Fujii suggests that
if we have both postgresql.conf and recovery.conf then recovery.conf
should contain overrides.

Fujii then suggests that if such an override exists, then SHOW would
not work properly. Magnus is rightly horrified and many speak against
allowing recovery.conf to continue to exist for this reason. I note
that if recovery.conf is an include file of postgresql.conf then the
overrides would work correctly, just as if postgresql.conf had
multiple settings for that parameter. So the premise is incorrect, so
the conclusion is not relevant.

Simon, JD, Greg Stark speak in favour of the usefulness of having a
recovery.conf separate from postgresql.conf. Tatsuo confirms pgpool
uses this.

Simon, Fujii, Peter agree an automatic include of recovery.conf would be useful

Robert points out that pg_ctl promote was a good feature

Simon, JD say that backwards compatibility is important

Everybody agrees a neater way of invoking standby mode would be good.

Peter points out that including recovery target parameters in
postgresql.conf would be difficult and require manual editing, and
also that pg_ctl -o is not a suitable interface.

The thread also includes a variety of other alternate ideas,
misunderstandings and other commentary.

- - -

My thoughts on how to resolve this are...

Everybody agrees these two points:

* Allow recovery parameters to be handled same way as other GUCs, and
specified in postgresql.conf if desired.

* Allow parameters to be reloaded at SIGHUP and visible using SHOW.

Those two things do not themselves force us to break backwards compatibility.

We also agree that we want a neater way to startup in standby mode.

In 9.1 we added "pg_ctl promote" as a better way of indicating
failover/switchover. When we did that we kept the trigger_file
parameter added in 9.0, which shows it is possible to add a new API
without breaking backwards compatibility.

We should add a "pg_ctl standby" command as a better way of indicating
starting up (also described as triggering) standby mode. We keep
standby_mode parameter. There is no difference here between file
based and stream based replication: you can have file, stream or both
file and stream (as intended).
In this mode the recovery target parameters are *ignored* even if
specified (explained below).
http://developer.postgresql.org/pgdocs/postgres/recovery-target-settings.html

In 9.2 the presence of recovery.conf can and therefore should continue
to act as it does in 9.1. This should be automatically included at the
end of postgresql.conf, which naturally and with no additional code
allows us to override settings, with overrides visible by SHOW. We
don't make any specific checks to see if someone has added a
postgresql.conf parameter in there. If there is a recovery target
parameter in recovery.conf we enter recovery, otherwise we operate as
a standby. recovery.conf is no longer *required* for standby modes.

These things are announced as deprecated and will be removed when we
go to release 10.0
* trigger_file
* standby_mode
* recovery.conf indicates standby

recovery.conf should continue to be required to perform a PITR. If we
place the recovery_target parameters into postgresql.conf we will have
no way to differentiate between (1) a recovery that has successfully
completed then crashed and (2) a user-specified recovery, which was
the original rationale for its use. This is OK, since we now encourage
people to enter a recovery by creating recovery.conf and for entering
a standby to use a new cleaner API without the confusing use of the
word "recovery".

I think that meets all requirements, as far as technically possible.

Best Regards

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Sat, Oct 29, 2011 at 7:54 PM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Fri, Sep 9, 2011 at 10:56 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>
>> In previous discussion, we've reached the consensus that we should unite
>> recovery.conf and postgresql.conf. The attached patch does that. The
>> patch is WIP, I'll have to update the document, but if you notice something,
>> please feel free to comment.
>
> My short summary of the thread is

Thanks!

> In 9.1 we added "pg_ctl promote" as a better way of indicating
> failover/switchover. When we did that we kept the trigger_file
> parameter added in 9.0, which shows it is possible to add a new API
> without breaking backwards compatibility.
>
> We should add a "pg_ctl standby" command as a better way of indicating
> starting up (also described as triggering) standby mode. We keep
> standby_mode parameter. There is no difference here between file
> based and stream based replication: you can have file, stream or both
> file and stream (as intended).
> In this mode the recovery target parameters are *ignored* even if
> specified (explained below).
> http://developer.postgresql.org/pgdocs/postgres/recovery-target-settings.html

Agreed to add "pg_ctl standby". I think that this can be committed
separately from the change of recovery.conf.

> In 9.2 the presence of recovery.conf can and therefore should continue
> to act as it does in 9.1.

This means that recovery.conf is renamed to recovery.done at the end of
recovery. IOW, all settings in recovery.conf are reset when recovery ends.
Then if you run "pg_ctl reload" after recovery, you'll get something like
the following error message and the reload will always fail;

LOG: parameter "standby_mode" cannot be changed without restarting
the server

To resolve this issue, I think that we need to introduce new GUC flag
indicating parameters are used only during recovery, and need to define
recovery parameters with that flag. Whenever "pg_ctl reload" is executed,
all the processes check whether recovery is in progress, and ignore
silently the parameters with that flag if not. I'm not sure how easy we
can implement this. In addition to introducing that flag, we might need to
change some processes which cannot access to the shared memory so that
they can. Otherwise, they cannot know whether recovery is in progress.
Or we might need to change them so that they always ignore recovery
parameters.

Another simple but somewhat restricted approach is to read and set
all parameters specified in recovery.conf by using PGC_S_OVERRIDE.
If we do this, those parameters cannot be changed after startup
even if recovery.conf is renamed. But the problem is that a user also
cannot change their settings by reloading the configuration files. This is
obviously a restriction. But it doesn't break any backward compatibility,
I believe. No? If a user prefers new functionality (i.e., reload recovery
parameters) rather than the backward compatibility, he/she can specify
parameters in postgresql.conf. Thought?

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Mon, Oct 31, 2011 at 7:38 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:

>> In 9.2 the presence of recovery.conf can and therefore should continue
>> to act as it does in 9.1.
>
> This means that recovery.conf is renamed to recovery.done at the end of
> recovery. IOW, all settings in recovery.conf are reset when recovery ends.
> Then if you run "pg_ctl reload" after recovery, you'll get something like
> the following error message and the reload will always fail;
>
>   LOG:  parameter "standby_mode" cannot be changed without restarting
> the server

> To resolve this issue,

This issue exists whether or not we have recovery.conf etc., so yes,
we must solve the problem.

> I think that we need to introduce new GUC flag
> indicating parameters are used only during recovery, and need to define
> recovery parameters with that flag. Whenever "pg_ctl reload" is executed,
> all the processes check whether recovery is in progress, and ignore
> silently the parameters with that flag if not. I'm not sure how easy we
> can implement this. In addition to introducing that flag, we might need to
> change some processes which cannot access to the shared memory so that
> they can. Otherwise, they cannot know whether recovery is in progress.
> Or we might need to change them so that they always ignore recovery
> parameters.

The postmaster knows whether its in recovery or not without checking
shared memory. Various postmaster states describe this. If not
postmaster, other backends can run recoveryinprogress() as normal.

It makes sense to have a new flag and that is easily created and used.

> Another simple but somewhat restricted approach is to read and set
> all parameters specified in recovery.conf by using PGC_S_OVERRIDE.
> If we do this, those parameters cannot be changed after startup
> even if recovery.conf is renamed. But the problem is that a user also
> cannot change their settings by reloading the configuration files. This is
> obviously a restriction. But it doesn't break any backward compatibility,
> I believe. No? If a user prefers new functionality (i.e., reload recovery
> parameters) rather than the backward compatibility, he/she can specify
> parameters in postgresql.conf. Thought?

No need to create problems.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

Simon,

> Everybody agrees a neater way of invoking standby mode would be good.

I don't think this goes far enough. The whole
recovery.conf/recovery.done thing is a serious problem for automated
management of servers and automated failover. So it's not just "a
neater way would be good" but "using recovery.conf as a trigger file is
a broken idea and needs to be changed."

> These things are announced as deprecated and will be removed when we
> go to release 10.0
> * trigger_file
> * standby_mode
> * recovery.conf indicates standby

So you're idea is that people who don't want recovery.conf to be used as
a trigger file would not have the file at all, but would have something
like "replication.conf" instead?

If it's possible to run a replica without having a recovery.conf file,
then I'm fine with your solution. If it's not, then I find your
solution not to be a solution at all.

> recovery.conf should continue to be required to perform a PITR. If we
> place the recovery_target parameters into postgresql.conf we will have
> no way to differentiate between (1) a recovery that has successfully
> completed then crashed and (2) a user-specified recovery, which was
> the original rationale for its use. This is OK, since we now encourage
> people to enter a recovery by creating recovery.conf and for entering
> a standby to use a new cleaner API without the confusing use of the
> word "recovery".

Sure. recovery.conf worked fine for PITR. We've just overextended it
for other purposes.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Mon, Oct 31, 2011 at 7:05 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:

> If it's possible to run a replica without having a recovery.conf file,
> then I'm fine with your solution.  If it's not, then I find your
> solution not to be a solution at all.

Then you are fine with the solution - not mine alone, just the sum of
everybody's inputs.

So we can teach the new way, while supporting the old way a while longer.

> Sure.  recovery.conf worked fine for PITR.  We've just overextended it
> for other purposes.

Agreed.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Mon, Oct 31, 2011 at 3:19 PM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Mon, Oct 31, 2011 at 7:05 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
>
>> If it's possible to run a replica without having a recovery.conf file,
>> then I'm fine with your solution.  If it's not, then I find your
>> solution not to be a solution at all.
>
> Then you are fine with the solution - not mine alone, just the sum of
> everybody's inputs.
>
> So we can teach the new way, while supporting the old way a while longer.
>

In most cases we either break backwards compatibility or require some
type of switch to turn on backwards compatibility for those who want
it. While the above plan tries to do one better, it leaves me feeling
that the thing I don't like about this is that it sounds like you are
forcing backwards compatibility on people who would much rather just
do things the new way. Given that, I foresee a whole new generation of
confused users who end up setting their configs one way only to have
someone else set the same config in the other file, or some tool dump
out some config file, overriding what was really intended. This will
also make things *harder* for those tool providers you are trying to
help, as they will be forced to support the behavior *both ways*. I'd
much rather see some type of switch which turns on the old behavior
for those who really want it, because while you can teach the new
behavior, if you can't prevent the old behavior, you're creating
operational headaches for yourself.

Robert Treat
conjecture: xzilla.net
consulting: omniti.com

On Mon, Oct 31, 2011 at 5:23 PM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Mon, Oct 31, 2011 at 7:38 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>
>>> In 9.2 the presence of recovery.conf can and therefore should continue
>>> to act as it does in 9.1.
>>
>> This means that recovery.conf is renamed to recovery.done at the end of
>> recovery. IOW, all settings in recovery.conf are reset when recovery ends.
>> Then if you run "pg_ctl reload" after recovery, you'll get something like
>> the following error message and the reload will always fail;
>>
>>   LOG:  parameter "standby_mode" cannot be changed without restarting
>> the server
>
>> To resolve this issue,
>
> This issue exists whether or not we have recovery.conf etc., so yes,
> we must solve the problem.

No. If we don't have recovery.conf, all parameters exist in postgresql.conf.
The above issue would not occur unless a user makes a mistake, e.g.,
change the value of the parameter which cannot be changed without
the server restart.

>> I think that we need to introduce new GUC flag
>> indicating parameters are used only during recovery, and need to define
>> recovery parameters with that flag. Whenever "pg_ctl reload" is executed,
>> all the processes check whether recovery is in progress, and ignore
>> silently the parameters with that flag if not. I'm not sure how easy we
>> can implement this. In addition to introducing that flag, we might need to
>> change some processes which cannot access to the shared memory so that
>> they can. Otherwise, they cannot know whether recovery is in progress.
>> Or we might need to change them so that they always ignore recovery
>> parameters.
>
> The postmaster knows whether its in recovery or not without checking
> shared memory. Various postmaster states describe this. If not
> postmaster, other backends can run recoveryinprogress() as normal.

AFAIR archiver and syslogger cannot access to the shared memory, i.e.,
they cannot run RecoveryInProgress(). They don't use any recovery
parameters for now, so we can change them so that they always ignore
those parameters. Though I'm not inclined to add the process-specific code
like the following into the GUC mechanism as much as possible.

if (I am postmaster)
{
if (recovery is NOT in progress)
reset the recovery parameters;
}
else if (I am archiver or syslogger)
/* always ignore */
else
{
if (recovery is NOT in progress)
reset the recovery parameters;
}

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center

On Tue, Nov 1, 2011 at 5:59 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
> On Mon, Oct 31, 2011 at 5:23 PM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
>> On Mon, Oct 31, 2011 at 7:38 AM, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>>
>>>> In 9.2 the presence of recovery.conf can and therefore should continue
>>>> to act as it does in 9.1.
>>>
>>> This means that recovery.conf is renamed to recovery.done at the end of
>>> recovery. IOW, all settings in recovery.conf are reset when recovery ends.
>>> Then if you run "pg_ctl reload" after recovery, you'll get something like
>>> the following error message and the reload will always fail;
>>>
>>>   LOG:  parameter "standby_mode" cannot be changed without restarting
>>> the server
>>
>>> To resolve this issue,
>>
>> This issue exists whether or not we have recovery.conf etc., so yes,
>> we must solve the problem.
>
> No. If we don't have recovery.conf, all parameters exist in postgresql.conf.
> The above issue would not occur unless a user makes a mistake, e.g.,
> change the value of the parameter which cannot be changed without
> the server restart.

I don't understand what you are saying. You seem to be suggesting that
it would be OK for someone to set standby_mode = on and reload the
config and for that to go completely unremarked. If we are adding new
parameters to postgresql.conf then its clear that some people will
misconfigure them and we need to have error messages for that.

If you change a parameter that only has effect during recovery then
must get an error if it is changed during normal running.

That is the reason we need to mark the recovery parameters with a new
flag, so that we can ignore any errors caused by changing them.

That has nothing at all to do with recovery.conf - you need it even if
you put everything in postgresql.conf.

>>> I think that we need to introduce new GUC flag
>>> indicating parameters are used only during recovery, and need to define
>>> recovery parameters with that flag. Whenever "pg_ctl reload" is executed,
>>> all the processes check whether recovery is in progress, and ignore
>>> silently the parameters with that flag if not. I'm not sure how easy we
>>> can implement this. In addition to introducing that flag, we might need to
>>> change some processes which cannot access to the shared memory so that
>>> they can. Otherwise, they cannot know whether recovery is in progress.
>>> Or we might need to change them so that they always ignore recovery
>>> parameters.
>>
>> The postmaster knows whether its in recovery or not without checking
>> shared memory. Various postmaster states describe this. If not
>> postmaster, other backends can run recoveryinprogress() as normal.
>
> AFAIR archiver and syslogger cannot access to the shared memory, i.e.,
> they cannot run RecoveryInProgress(). They don't use any recovery
> parameters for now, so we can change them so that they always ignore
> those parameters. Though I'm not inclined to add the process-specific code
> like the following into the GUC mechanism as much as possible.
>
>    if (I am postmaster)
>    {
>        if (recovery is NOT in progress)
>            reset the recovery parameters;
>    }
>    else if (I am archiver or syslogger)
>        /* always ignore */
>    else
>    {
>        if (recovery is NOT in progress)
>            reset the recovery parameters;
>    }
>

I don't see the problem. The code above could easily be simplified and
only needs to exist in one place, not copied around for each GUC.

When we had recovery.conf and postgresql.conf you knew which
parameters took effects at specific times. That metadata needs to be
added back into the system so we can report errors properly.

Considering the amount of code we will be removing, a couple of extra
lines seems trivial.

AFAICS we need to reset all recovery parameters at the end of recovery
anyway. Having SHOW recovery_target_xid return a value other than 0 is
not appropriate during normal running, same for standby_mode and the
other parameters.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Tue, Nov 1, 2011 at 7:46 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> If you change a parameter that only has effect during recovery then
> must get an error if it is changed during normal running.

I don't see why. If you're in normal running and someone changes a
parameter that is irrelevant during normal running, that should be a
no-op, not an error.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Tue, Nov 1, 2011 at 12:06 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> On Tue, Nov 1, 2011 at 7:46 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
>> If you change a parameter that only has effect during recovery then
>> must get an error if it is changed during normal running.
>
> I don't see why.  If you're in normal running and someone changes a
> parameter that is irrelevant during normal running, that should be a
> no-op, not an error.

How will it be made into a no-op, except by having a specific flag to
show that it is irrelevant during normal running?

Fujii is saying we only need to mark GUCs if we keep recovery.conf. I
am saying we need to mark them whatever we do elsewhere.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Tue, Nov 1, 2011 at 8:14 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Tue, Nov 1, 2011 at 12:06 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
>> On Tue, Nov 1, 2011 at 7:46 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
>>> If you change a parameter that only has effect during recovery then
>>> must get an error if it is changed during normal running.
>>
>> I don't see why.  If you're in normal running and someone changes a
>> parameter that is irrelevant during normal running, that should be a
>> no-op, not an error.
>
> How will it be made into a no-op, except by having a specific flag to
> show that it is irrelevant during normal running?

By default, changing a GUC just updates the value of some global
variable inside every backend. But unless there's some code that
makes use of that global variable for some purpose, it doesn't have
any practical effect. Apart from whatever complexities may be imposed
by our choice of implementation, I don't see how this would be any
different from setting maintenance_work_mem in a particular session
and then not running any CREATE INDEX or VACUUM commands in that
session.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Tue, Nov 1, 2011 at 1:23 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> On Tue, Nov 1, 2011 at 8:14 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
>> On Tue, Nov 1, 2011 at 12:06 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
>>> On Tue, Nov 1, 2011 at 7:46 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
>>>> If you change a parameter that only has effect during recovery then
>>>> must get an error if it is changed during normal running.
>>>
>>> I don't see why.  If you're in normal running and someone changes a
>>> parameter that is irrelevant during normal running, that should be a
>>> no-op, not an error.
>>
>> How will it be made into a no-op, except by having a specific flag to
>> show that it is irrelevant during normal running?
>
> By default, changing a GUC just updates the value of some global
> variable inside every backend.  But unless there's some code that
> makes use of that global variable for some purpose, it doesn't have
> any practical effect.  Apart from whatever complexities may be imposed
> by our choice of implementation, I don't see how this would be any
> different from setting maintenance_work_mem in a particular session
> and then not running any CREATE INDEX or VACUUM commands in that
> session.

Why do we have this log message then, if it is OK to ignore changes
that have no effect?

LOG: parameter "shared_buffers" cannot be changed without restarting the server

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Tue, Nov 1, 2011 at 9:45 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> Why do we have this log message then, if it is OK to ignore changes
> that have no effect?
>
> LOG:  parameter "shared_buffers" cannot be changed without restarting the server

I believe we're logging the fact that we were unable to make the
change, not the fact that it didn't have any effect. Certainly, it
*would* have an effect, if we were able to make it. But we can't,
without a restart, so we tell that to the user.

But, for example, the hot_standby GUC - which already exists - does
not do anything in normal running. We don't need to (and don't)
complain if the user tries to change the value in normal running,
though: they're presumably just hoping it will take effect the next
time they start up, which it will. And the autovacuum parameter does
not do anything during hot standby, but we don't need to (and don't)
complain if the user changes it them; it just takes effect when we
enter normal running.

The only time I think we need to complain about an effort to change a
GUC is when the GUC won't take effect as soon as the user might
normally expect.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Tue, Nov 1, 2011 at 2:04 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> On Tue, Nov 1, 2011 at 9:45 AM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
>> Why do we have this log message then, if it is OK to ignore changes
>> that have no effect?
>>
>> LOG:  parameter "shared_buffers" cannot be changed without restarting the server
>
> I believe we're logging the fact that we were unable to make the
> change, not the fact that it didn't have any effect.  Certainly, it
> *would* have an effect, if we were able to make it.  But we can't,
> without a restart, so we tell that to the user.
>
> But, for example, the hot_standby GUC - which already exists - does
> not do anything in normal running.  We don't need to (and don't)
> complain if the user tries to change the value in normal running,
> though: they're presumably just hoping it will take effect the next
> time they start up, which it will.

If there is precedence then we should follow it. So no error messages.

The only reason this point has any importance is that Fujii is
suggesting the code will be much more complicated if we retain
recovery.conf compatibility, since we need to mark GUCs with a flag as
to whether they can take effect during recovery. I don't think that's
a lot of work to add, and would make the code clearer than it is now.

> And the autovacuum parameter does
> not do anything during hot standby, but we don't need to (and don't)
> complain if the user changes it them; it just takes effect when we
> enter normal running.

That one needs to be set on a standby, in case it becomes a primary.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

Robert,

> In most cases we either break backwards compatibility or require some
> type of switch to turn on backwards compatibility for those who want
> it. While the above plan tries to do one better, it leaves me feeling
> that the thing I don't like about this is that it sounds like you are
> forcing backwards compatibility on people who would much rather just
> do things the new way. Given that, I foresee a whole new generation
> of
> confused users who end up setting their configs one way only to have
> someone else set the same config in the other file, or some tool dump
> out some config file, overriding what was really intended. This will
> also make things *harder* for those tool providers you are trying to
> help, as they will be forced to support the behavior *both ways*. I'd
> much rather see some type of switch which turns on the old behavior
> for those who really want it, because while you can teach the new
> behavior, if you can't prevent the old behavior, you're creating
> operational headaches for yourself.

This is a good point. There's also the second drawback, which is complexity of code, which I believe that Tom Lane has brought up before; having two separate-but-equal paths for configuration is liable to lead to a lot of bugs.

So, we have four potential paths regarding recovery.conf:

1) Break backwards compatibility entirely, and stop supporting recovery.conf as a trigger file at all.

2) Offer backwards compatibility only if "recovery_conf='filename'" is set in postgresql.conf, then behave like Simon's compromise.

3) Simon's compromise.

4) Don't ever change how recovery.conf works.

The only two of the above I see as being real options are (1) and (2). (3) would, as Robert points out, cause DBAs to have unpleasant surprises when some third-party tool creates a recovery.conf they weren't expecting. So:

(1) pros:
* new, clean API
* makes everyone update their tools
* no confusion on "how to do failover"
* code simplicity
cons:
* breaks a bunch of 3rd-party tools
* or forces them to maintain separate 9.1 and 9.2 branches

(2) pros:
* allows people to use only new API if they want
* allows gradual update of tools
* can also lump in relocatable recovery.conf as feature
cons:
* puts off the day when vendors pay attention to the new API
(and even more kicking & screaming when that day comes)
* confusion about "how to do failover"
* code complexity

On Tue, Nov 1, 2011 at 5:11 PM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:

> So, we have four potential paths regarding recovery.conf:
>
> 1) Break backwards compatibility entirely, and stop supporting recovery.conf as a trigger file at all.

Note that is exactly what I have suggested when using "standby" mode
from pg_ctl.

But you already know that, since you said "If it's possible to run a
replica without having a recovery.conf file,
then I'm fine with your solution", and I already confirmed back to you
that would be possible.

> 2) Offer backwards compatibility only if "recovery_conf='filename'" is set in postgresql.conf, then behave like Simon's compromise.
>
> 3) Simon's compromise.

See above. Calling it a compromise in this way implies nobody has been
given exactly what they ask for, but that is not the case.

> 4) Don't ever change how recovery.conf works.
>
> The only two of the above I see as being real options are (1) and (2).  (3) would, as Robert points out, cause DBAs to have unpleasant surprises when some third-party tool creates a recovery.conf they weren't expecting. So:

Please read my proposal again. I'll be happy to answer questions if
you have any.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Tue, Nov 1, 2011 at 1:34 PM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Tue, Nov 1, 2011 at 5:11 PM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:
>
>> So, we have four potential paths regarding recovery.conf:
>>
>> 1) Break backwards compatibility entirely, and stop supporting recovery.conf as a trigger file at all.
>
> Note that is exactly what I have suggested when using "standby" mode
> from pg_ctl.
>
> But you already know that, since you said "If it's possible to run a
> replica without having a recovery.conf file,
> then I'm fine with your solution", and I already confirmed back to you
> that would be possible.
>

"It's possible to run a replica without having a recovery.conf file"
is not the same thing as "If someone makes a recovery.conf file, it
won't break my operations". AIUI, you are not supporting the latter.

Robert Treat
conjecture: xzilla.net
consulting: omniti.com

On Tue, Nov 1, 2011 at 6:12 PM, Robert Treat <rob(at)xzilla(dot)net> wrote:
> On Tue, Nov 1, 2011 at 1:34 PM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
>> On Tue, Nov 1, 2011 at 5:11 PM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:
>>
>>> So, we have four potential paths regarding recovery.conf:
>>>
>>> 1) Break backwards compatibility entirely, and stop supporting recovery.conf as a trigger file at all.
>>
>> Note that is exactly what I have suggested when using "standby" mode
>> from pg_ctl.
>>
>> But you already know that, since you said "If it's possible to run a
>> replica without having a recovery.conf file,
>> then I'm fine with your solution", and I already confirmed back to you
>> that would be possible.
>>
>
> "It's possible to run a replica without having a recovery.conf file"
> is not the same thing as "If someone makes a recovery.conf file, it
> won't break my operations". AIUI, you are not supporting the latter.

Yes, that is part of the "combined proposal", which allows both old
and new APIs.

New API

pg_ctl standby
will startup a server in standby mode, do not implicitly include
recovery.conf and disallow recovery_target parameters in
postgresql.conf
(you may, if you wish, explicitly have "include recovery.conf" in
your postgresql.conf, should you desire that)

Old API

pg_ctl start
and a recovery.conf has been created
will startup a server in PITR and/or replication, recovery.conf
will be read automatically (as now)
so the presence of the recovery.conf acts as a trigger, only if we
issue "start"

So the existing syntax works exactly as now, but a new API has been
created to simplify things in exactly the way requested. The old and
the new API don't mix, so there is no confusion between them.

You must still use the old API when you wish to perform a PITR, as
explained by me, following comments by Peter.

There is no significant additional code or complexity required to do
this, but it adds considerable usefulness.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On 11/1/11 10:34 AM, Simon Riggs wrote:
> On Tue, Nov 1, 2011 at 5:11 PM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:
>
>> So, we have four potential paths regarding recovery.conf:
>>
>> 1) Break backwards compatibility entirely, and stop supporting recovery.conf as a trigger file at all.
>
> Note that is exactly what I have suggested when using "standby" mode
> from pg_ctl.

I wasn't clear on that from the description of your proposal. So are
you suggesting that, if we start postgresql with "pg_ctl standby" then
recovery.conf would not behave as a trigger file?

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Tue, Nov 1, 2011 at 6:36 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
> On 11/1/11 10:34 AM, Simon Riggs wrote:
>> On Tue, Nov 1, 2011 at 5:11 PM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:
>>
>>> So, we have four potential paths regarding recovery.conf:
>>>
>>> 1) Break backwards compatibility entirely, and stop supporting recovery.conf as a trigger file at all.
>>
>> Note that is exactly what I have suggested when using "standby" mode
>> from pg_ctl.
>
> I wasn't clear on that from the description of your proposal.  So are
> you suggesting that, if we start postgresql with "pg_ctl standby" then
> recovery.conf would not behave as a trigger file?

Yes

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Tue, Nov 1, 2011 at 2:34 PM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
> On Tue, Nov 1, 2011 at 6:12 PM, Robert Treat <rob(at)xzilla(dot)net> wrote:
>> On Tue, Nov 1, 2011 at 1:34 PM, Simon Riggs <simon(at)2ndquadrant(dot)com> wrote:
>>> On Tue, Nov 1, 2011 at 5:11 PM, Joshua Berkus <josh(at)agliodbs(dot)com> wrote:
>>>
>>>> So, we have four potential paths regarding recovery.conf:
>>>>
>>>> 1) Break backwards compatibility entirely, and stop supporting recovery.conf as a trigger file at all.
>>>
>>> Note that is exactly what I have suggested when using "standby" mode
>>> from pg_ctl.
>>>
>>> But you already know that, since you said "If it's possible to run a
>>> replica without having a recovery.conf file,
>>> then I'm fine with your solution", and I already confirmed back to you
>>> that would be possible.
>>>
>>
>> "It's possible to run a replica without having a recovery.conf file"
>> is not the same thing as "If someone makes a recovery.conf file, it
>> won't break my operations". AIUI, you are not supporting the latter.
>
> Yes, that is part of the "combined proposal", which allows both old
> and new APIs.
>
> New API
>
> pg_ctl standby
>    will startup a server in standby mode, do not implicitly include
> recovery.conf and disallow recovery_target parameters in
> postgresql.conf
>    (you may, if you wish, explicitly have "include recovery.conf" in
> your postgresql.conf, should you desire that)
>
> Old API
>
> pg_ctl start
> and a recovery.conf has been created
>   will startup a server in PITR and/or replication, recovery.conf
> will be read automatically (as now)
>   so the presence of the recovery.conf acts as a trigger, only if we
> issue "start"
>
> So the existing syntax works exactly as now, but a new API has been
> created to simplify things in exactly the way requested. The old and
> the new API don't mix, so there is no confusion between them.
>
> You must still use the old API when you wish to perform a PITR, as
> explained by me, following comments by Peter.
>

Ah, thanks for clarifying, your earlier proposal didn't read that way
to me. It still doesn't solve the problem for tool makers of needing
to be able to deal with two possible implementation methods, but it
should be easier for them to make a choice. One thing though, I think
it would be better to have this work the other way around. ISTM we're
going to end up telling people to avoid using pg_ctl start and instead
use pg_ctl standby, which doesn't feel like the right answer. Ie.
"Starting in 9.2, you should use pg_ctl standby to launch your
database for normal operations and/or in cases where you are writing
init scripts to control your production databases. For backwards
compatibility, if you require the old behavior of using a
recovery.conf, we would recommend you use pg_ctl start instead".

Robert Treat
conjecture: xzilla.net
consulting: omniti.com

On 11/1/11 12:29 PM, Robert Treat wrote:
> "Starting in 9.2, you should use pg_ctl standby to launch your
> database for normal operations and/or in cases where you are writing
> init scripts to control your production databases. For backwards
> compatibility, if you require the old behavior of using a
> recovery.conf, we would recommend you use pg_ctl start instead".

Gah.

There is no way we're getting distro packagers to switch from pg_ctl
start. Also, a lot of distros use the "postgres" command rather than
pg_ctl anything.

Messing with pg_ctl is not really a solution for this, since few people
in production environments call it directly. Nobody I know, anyway.

So Simon's suggested compromise still puts backwards compatibility ahead
of promoting the new API. This would result in nobody supporting the
new API until the day we remove the old one from the code.

I think adding "recovery_conf_location = ''" to postgresql.conf is a
much better compromise. Assuming we can stand the code complexity ...

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com

On Tue, Nov 1, 2011 at 9:11 PM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:
> On 11/1/11 12:29 PM, Robert Treat wrote:
>> "Starting in 9.2, you should use pg_ctl standby to launch your
>> database for normal operations and/or in cases where you are writing
>> init scripts to control your production databases. For backwards
>> compatibility, if you require the old behavior of using a
>> recovery.conf, we would recommend you use pg_ctl start instead".
>
> Gah.
>
> There is no way we're getting distro packagers to switch from pg_ctl
> start.  Also, a lot of distros use the "postgres" command rather than
> pg_ctl anything.
>
> Messing with pg_ctl is not really a solution for this, since few people
> in production environments call it directly.  Nobody I know, anyway.
>
> So Simon's suggested compromise still puts backwards compatibility ahead
> of promoting the new API.  This would result in nobody supporting the
> new API until the day we remove the old one from the code.

Which will never happen, since part of the proposal is that PITR will
only be supported using the old method.

> I think adding "recovery_conf_location = ''" to postgresql.conf is a
> much better compromise.  Assuming we can stand the code complexity ...

I think that might have some possibilities. But how does that work in
detail? If you set it to empty, then the recovery_* parameters are
just GUCs, I suppose: which seems fine. But if you set it to a
non-empty value then what happens, exactly? The recovery.conf
settings clobber anything in postgresql.conf, and when we exit
recovery we reload the config, discarding any settings we got from
recovery.conf? That might not be too bad.

I think we need to back up and figure out what problem we're trying to
solve here. IMV, the answer is "setting up a standby is too
complicated and requiring yet another configuration file to do it
makes it even more complicated". If the mechanism we introduce to
"solve" that problem is more complicated than what we have now, it
might end up being a net regression in terms of usability.

I feel like changing everything that's currently in recovery.conf to
GUCs and implementing SET PERSISTENT would give everyone what they
need, admittedly without perfect backward compatibility, but perhaps
close enough for government work, and a step forward overall.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

On Wed, Nov 2, 2011 at 1:45 AM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:

> I think that might have some possibilities.  But how does that work in
> detail?

My thoughts also. I want to see the detail on an alternate proposal so
we can decide things sensibly.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Wed, Nov 2, 2011 at 1:11 AM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:

> There is no way we're getting distro packagers to switch from pg_ctl
> start.  Also, a lot of distros use the "postgres" command rather than
> pg_ctl anything.

So backwards compatibility is important for downstream software.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

On Wed, Nov 2, 2011 at 1:11 AM, Josh Berkus <josh(at)agliodbs(dot)com> wrote:

> There is no way we're getting distro packagers to switch from pg_ctl
> start.  Also, a lot of distros use the "postgres" command rather than
> pg_ctl anything.

So backwards compatibility is important for downstream software.

--
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

RH, Simon,

> I think that might have some possibilities. But how does that work in
> detail? If you set it to empty, then the recovery_* parameters are
> just GUCs, I suppose: which seems fine. But if you set it to a
> non-empty value then what happens, exactly? The recovery.conf
> settings clobber anything in postgresql.conf, and when we exit
> recovery we reload the config, discarding any settings we got from
> recovery.conf? That might not be too bad.

Yeah, that's what I was picturing. By tying backwards-compatibility to
a setting in pg.conf, you eliminate a lot of changes for a DBA
accidentally enabling it. This also then supports re-locating the
recovery.conf file, which has been an issue for a long time.

> I think we need to back up and figure out what problem we're trying to
> solve here. IMV, the answer is "setting up a standby is too
> complicated and requiring yet another configuration file to do it
> makes it even more complicated". If the mechanism we introduce to
> "solve" that problem is more complicated than what we have now, it
> might end up being a net regression in terms of usability.

Well, as someone who sets up and admins replication for a bunch of
clients, here's what I'd like to see:

1. no more using a configuration file as a trigger
2. ability to put replication configuration in postgresql.conf or in a
manually designated include file
3. having replication configuration show up in pg_settings

The three settings above would make my life as a contract DBA much
easier ... and I presume help a lot of our users like me. Among other
things, fixing the 3 things above would make replication integrate a lot
better with configuration management systems and monitoring.

> I feel like changing everything that's currently in recovery.conf to
> GUCs and implementing SET PERSISTENT would give everyone what they
> need, admittedly without perfect backward compatibility, but perhaps
> close enough for government work, and a step forward overall.

Is anyone working on SET PERSISTENT? I thought that got bike-shedded to
death.

> So backwards compatibility is important for downstream software.
>

If it wasn't, we wouldn't be having this discussion. However, backwards
compatibility is not necessarily the *most* important consideration.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com