Reword fsync and full_page_writes docs to be clearer about when to turn

them off.

Josh Berkus, with slight wording changes by me.

doc/src/sgml/config.sgml

@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.279 2010/05/26 23:49:18 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.280 2010/05/31 15:50:48 momjian Exp $ -->
 
 <chapter Id="runtime-config">
   <title>Server Configuration</title>
@@ -1413,34 +1413,23 @@ SET ENABLE_SEQSCAN TO OFF;
        </para>
 
        <para>
-        However, using <varname>fsync</varname> results in a
+        While turning off <varname>fsync</varname> is often a performance
-        performance penalty: when a transaction is committed,
+        benefit, this can result in unrecoverable data corruption in
-        <productname>PostgreSQL</productname> must wait for the
+        the event of an unexpected system shutdown or crash.  Thus it
-        operating system to flush the write-ahead log to disk.  When
+        is only advisable to turn off  <varname>fsync</varname> if
-        <varname>fsync</varname> is disabled, the operating system is
+        you can easily recreate your entire database from external
-        allowed to do its best in buffering, ordering, and delaying
+        data.
-        writes. This can result in significantly improved performance.
-        However, if the system crashes, the results of the last few
-        committed transactions might be completely lost, or worse,
-        might appear partially committed, leaving the database in an
-        inconsistent state. In the
-        worst case, unrecoverable data corruption might occur.
-        (Crashes of the database software itself are <emphasis>not</>
-        a risk factor here.  Only an operating-system-level crash
-        creates a risk of corruption.)
        </para>
 
        <para>
-        Due to the risks involved, there is no universally correct
+        Examples of safe circumstances for turning off
-        setting for <varname>fsync</varname>. Some administrators
+        <varname>fsync</varname> include the initial loading a new
-        always disable <varname>fsync</varname>, while others only
+        database cluster from a backup file, using a database cluster
-        turn it off during initial bulk data loads, where there is a clear
+        for processing statistics on an hourly basis which is then
-        restart point if something goes wrong.  Others
+        recreated, or for a reporting read-only database clone which
-        always leave <varname>fsync</varname> enabled. The default is
+        gets recreated frequently and is not used for failover.  High
-        to enable <varname>fsync</varname>, for maximum reliability.
+        quality hardware alone is not a sufficient justification for
-        If you trust your operating system, your hardware, and your
+        turning off <varname>fsync</varname>.
-        utility company (or your battery backup), you can consider
-        disabling <varname>fsync</varname>.
        </para>
 
        <para>
@@ -1572,12 +1561,10 @@ SET ENABLE_SEQSCAN TO OFF;
 
        <para>
         Turning this parameter off speeds normal operation, but
-        might lead to a corrupt database after an operating system crash
+        might lead to either unrecoverable data corruption, or silent
-        or power failure. The risks are similar to turning off
+        data corruption, after a system failure. The risks are similar to turning off
-        <varname>fsync</>, though smaller.  It might be safe to turn off
+        <varname>fsync</varname>, though smaller, and it should be turned off
-        this parameter if you have hardware (such as a battery-backed disk
+        only based on the same circumstances recommended for that parameter.
-        controller) or file-system software that reduces
-        the risk of partial page writes to an acceptably low level (e.g., ZFS).
        </para>
 
        <para>