diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml index 1e7419de4f..e771edf9c4 100644 --- a/doc/src/sgml/high-availability.sgml +++ b/doc/src/sgml/high-availability.sgml @@ -1,4 +1,4 @@ - + High Availability, Load Balancing, and Replication @@ -38,10 +38,12 @@ Some solutions deal with synchronization by allowing only one server to modify the data. Servers that can modify data are - called read/write or "master" servers. Servers that can reply - to read-only queries are called "slave" servers. Servers that - cannot be accessed until they are changed to master servers are - called "standby" servers. + called read/write, master or primary servers. + Servers that track changes in the master are called standby + or slave servers. A standby server that cannot be connected + to until it is promoted to a master server is called a warm + standby server, and one that can accept connections and serves read-only + queries is called a hot standby server. @@ -144,16 +146,16 @@ protocol to make nodes agree on a serializable transactional order. Warm and hot standby servers can be kept current by reading a stream of write-ahead log (WAL) - records. If the main server fails, the warm standby contains + records. If the main server fails, the standby contains almost all of the data of the main server, and can be quickly made the new master database server. This is asynchronous and can only be done for the entire database server. - A PITR standby server can be kept more up-to-date using streaming - replication.; see . For - warm standby information, see , and - for hot standby, see . + A PITR standby server can be implemented using file-based log shipping + () or streaming replication (see + ), or a combination of both. For + information on hot standby, see . @@ -613,10 +615,9 @@ protocol to make nodes agree on a serializable transactional order. Standby mode is exited and the server switches to normal operation, - when a trigger file is found (trigger_file). Before failover, it will - restore any WAL available in the archive or in pg_xlog, but won't try - to connect to the master or wait for files to become available in the - archive. + when a trigger file is found (trigger_file). Before failover, + any WAL immediately available in the archive or in pg_xlog will be + restored, but no attempt is made to connect to the master. @@ -710,6 +711,15 @@ trigger_file = '/path/to/trigger_file' replication, make sure you set max_wal_senders high enough in the primary to allow them to be connected simultaneously. + + + If you're using a WAL archive, its size can be minimized using + the restartpoint_command option to remove files that are no + no longer required by the standby server. Note however, that if you're + using the archive for backup purposes, you need to retain files needed + to recover from at least the latest base backup, even if they're no + longer needed by the standby. + @@ -737,15 +747,14 @@ trigger_file = '/path/to/trigger_file' - Streaming replication relies on file-based continuous archiving for - making the base backup and for allowing the standby to catch up if it is - disconnected from the primary for long enough for the primary to - delete old WAL files still required by the standby. It is possible - to use streaming replication without WAL archiving, but if a standby - falls behind too much, the primary will delete old WAL files still - needed by the standby, and the standby will have to be manually restored - from a base backup. You can control how long the primary retains old WAL - segments using the wal_keep_segments setting. + If you use streaming replication without file-based continuous + archiving, you have to set wal_keep_segments in the master + to a value high enough to ensure that old WAL segments are not recycled + too early, while the standby might still need them to catch up. If the + standby falls behind too much, it needs to be reinitialized from a new + base backup. If you set up a WAL archive that's accessible from the + standby, wal_keep_segments is not required as the standby can always + use the archive to catch up. @@ -881,6 +890,14 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass' rigorous testing. + + PostgreSQL does not provide the system + software required to identify a failure on the primary and notify + the standby database server. Many such tools exist and are well + integrated with the operating system facilities required for + successful failover, such as IP address migration. + + Once failover to the standby occurs, there is only a single server in operation. This is known as a degenerate state. @@ -921,7 +938,7 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass' An alternative to the built-in standby mode described in the previous - sections is to use a restore_command that polls the archive location. + sections is to use a restore_command that polls the archive location. This was the only option available in versions 8.4 and below. In this setup, set standby_mode off, because you are implementing the polling required for standby operation yourself. See @@ -932,9 +949,9 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass' Note that in this mode, the server will apply WAL one file at a time, so if you use the standby server for queries (see Hot Standby), - there is a bigger delay between an action in the master and when the + there is a delay between an action in the master and when the action becomes visible in the standby, corresponding the time it takes - to fill up the WAL file. archive_timeout can be used to make that delay + to fill up the WAL file. archive_timeout can be used to make that delay shorter. Also note that you can't combine streaming replication with this method. @@ -991,14 +1008,6 @@ if (!triggered) configurations and environments. - - PostgreSQL does not provide the system - software required to identify a failure on the primary and notify - the standby database server. Many such tools exist and are well - integrated with the operating system facilities required for - successful failover, such as IP address migration. - - The method for triggering failover is an important part of planning and design. One potential option is the restore_command @@ -1015,20 +1024,12 @@ if (!triggered) creation of a trigger file is ideal, if this can be arranged. - - The size of the WAL archive can be minimized by using the %r - option of the restore_command. This option specifies the - last archive file name that needs to be kept to allow the recovery to - restart correctly. This can be used to truncate the archive once - files are no longer required, assuming the archive is writable from the - standby server. - - Implementation - The short procedure for configuring a standby server is as follows. For + The short procedure for configuring a standby server using this alternative + method is as follows. For full details of each step, refer to previous sections as noted. @@ -1086,9 +1087,10 @@ if (!triggered) Record-based Log Shipping - PostgreSQL directly supports file-based - log shipping as described above. It is also possible to implement - record-based log shipping, though this requires custom development. + It is also possible to implement record-based log shipping using this + alternative method, though this requires custom development, and changes + will still only becomes visible to hot standby queries after a full WAL + file has been shipped. @@ -1573,9 +1575,9 @@ if (!triggered) Three-way deadlocks are possible between AccessExclusiveLocks arriving from the primary, cleanup WAL records that require buffer cleanup locks, and - user requests that are waiting behind replayed AccessExclusiveLocks. Deadlocks - are resolved immediately, should they occur, though they are thought to be - rare in practice. + user requests that are waiting behind replayed AccessExclusiveLocks. + Deadlocks are resolved automatically after deadlock_timeout + seconds, though they are thought to be rare in practice. @@ -1684,8 +1686,10 @@ LOG: database system is ready to accept read only connections themselves. Users will still write large sort temporary files and re-generate relcache info files, so no part of the database is truly read-only during hot standby mode. - Note also that writes to remote databases will still be possible, - even though the transaction is read-only locally. + Note also that writes to remote databases using + dblink module, and other operations outside the + database using PL functions will still be possible, even though the + transaction is read-only locally. @@ -1940,7 +1944,7 @@ LOG: database system is ready to accept read only connections - In a warm standby configuration, it is possible to offload the expense of + In a standby configuration, it is possible to offload the expense of taking periodic base backups from the primary server; instead base backups can be made by backing up a standby server's files. This concept is generally known as