On 01/01/2011 05:28 PM, Dimitri Fontaine wrote:
> Stefan Kaltenbrunner<stefan@kaltenbrunner.cc> writes:
>> well you keep saying that but to be honest I cannot really even see a
>> usecase for me - what is "only a random one of a set of servers is sync at
>> any time and I don't really know which one".
>
> It looks easy enough to get to know which one it is. Surely the primary
> knows and could update something visible through a system view for
> users? This as been asked for before and I was thinking there was a
> consensus on this.
well as jeff janes already said - anything that requires the master to
still exist is not useful for a desaster. Consider the now often
mentioned 2 sync standby scenario with one standby in the same location
and one in a secondary location.
If you have a desaster(fire,water,explosion,admin fail,...) at the
primary location and you have no access to either the master or the
standby you will never be sure that the standby on the secondary
location is actually "in sync" - it could be but you will never know if
you lost that 1B$ invoice just commited on the master and the closeby
standby and therefor confirmed to the client...
Most of my requirements have very hard requirements on the integrity of
the data, very high requirements on the read-only availability and
somewhat high requirements on the availability of a master for writes,
but data integrity will always trump that.
Stefan