Stephen Frost <sfrost@snowman.net> wrote:
>> Our grace period for active backends after unclean exit of one
>> of their peers is low, milliseconds to seconds. Our grace
>> period for active backends after unclean exit of the postmaster
>> is unconstrained. At least one of those policies has to be
>> wrong. Like Andres and Robert, I pick the second one.
>
> Ditto for me.
+1
In fact, I would say that is slightly understated. The grace
period for active backends after unclean exit of one of their peers
is low, milliseconds to seconds, *unless the postmaster has also
crashed* -- in which case it is unconstrained. Why is the crash of
a backend less serious if the postmaster has also crashed?
Certainly it can't be considered to be surprising that if the
postmaster is crashing that other backends might be also crashing
around the same time?
--
Kevin Grittner
EDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company