Josh,
* Josh Berkus (josh@agliodbs.com) wrote:
> > I'm aware, my point was simply that we should state, up-front in
> > 25.2.7.3 *and* where we document synchronous_standby_names, that it
> > requires at least three servers to be involved to be a workable
> > solution.
>
> It's a workable solution with 2 servers. That's a "low-availability,
> high-integrity" solution; the user has chosen to double their risk of
> not accepting writes against never losing a write. That's a perfectly
> valid configuration, and I believe that NTT runs several applications
> this way.
I really don't agree with that when the standby going offline can take
out the master. Note that I didn't say we shouldn't allow it, but I
don't think we should accept that it's a real-world solution.
> I really think that demand for auto-degrade is coming from users who
> don't know what sync rep is for in the first place. The fact that other
> vendors are offering auto-degrade as a feature instead of the ginormous
> foot-gun it is adds to the confusion, but we can't help that.
Do you really feel that a WARNING and increasing the docs to point
out that three systems are necessary, particularly under the 'high
availability' documentation and options, is a bad idea? I fail to see
how that does anything but clarify the use-case for our users.
Thanks,
Stephen