On 10/08/2010 04:38 PM, Tom Lane wrote:
> Markus Wanner <markus@bluegap.ch> writes:
>> IIUC you seem to assume that the master node keeps its master role. But
>> users who value availability a lot certainly want automatic fail-over,
>
> Huh? Surely loss of the slaves shouldn't force a failover. Maybe the
> slaves really are all dead.
I think we are talking across each other. I'm speaking about the need to
be able to fail-over to a standby in case the master fails.
In case of a full-cluster crash after such a fail-over, you need to take
care you don't enter split brain. Some kind of STONITH, lamport clock,
or what not. Figuring out which node has been the most recent (and thus
most up to date) master is far from trivial.
(See also my mail in answer to Dimitri a few minutes ago).
Regards
Markus Wanner