On Wed, 2010-05-26 at 19:55 +0300, Heikki Linnakangas wrote:
> Now you want to set up a temporary replica of the master at a
> development server, for testing purposes. If you set quorum to 2, your
> development server becomes critical infrastructure, which is not what
> you want.
That's a good argument for standby relays. Nobody hooks in a disposable
test machine into a critical production config without expecting it to
have some effect.
> If you set quorum to 1, it also becomes critical
> infrastructure, because it's possible that a transaction has been
> replicated to the test server but not the real production standby, and
> a meteor strikes.
Why would you not want to use the test server? If its the only thing
left protecting you, and you wish to be protected, then it sounds very
cool to me. In my proposal this test server only gets data ahead of
other things if the "real production standby" responds too slowly.
It scares the **** out of people that a DBA can take down a server and
suddenly the sync protection you thought you had is turned off. That way
of doing things means an application never knows the protection level
any piece of data has had. App designers want to be able to marks things
"handle with care" or "just do it quick, don't care much". It's a real
pain to have to handle all your data the same, and for that to be
selectable only by administrators, who may or may not have everything
configured correctly/available.
-- Simon Riggs www.2ndQuadrant.com