Re: PostgreSQL's handling of fsync() errors is unsafe and risks data loss at least on XFS

> On Apr 8, 2018, at 15:29, Bruce Momjian <bruce@momjian.us> wrote:
> I think the big problem is that we don't have any way of stopping
> Postgres at the time the kernel reports the errors to the kernel log, so
> we are then returning potentially incorrect results and committing
> transactions that might be wrong or lost.

Yeah, it's bad.  In the short term, the best advice to installations is to monitor their kernel logs for errors (which
veryfew do right now), and make sure they have a backup strategy which can encompass restoring from an error like this.
Even Craig's smart fix of patching the backup label to recover from a previous checkpoint doesn't do much good if we
don'thave WAL records back that far (or one of the required WAL records also took a hit). 

In the longer term... O_DIRECT seems like the most plausible way out of this, but that might be popular with people
runningon file systems or OSes that don't have this issue.  (Setting aside the daunting prospect of implementing that.) 

--
-- Christophe Pettus
   xof@thebuild.com