Robert Haas <robertmhaas@gmail.com> wrote:
> Simon Riggs <simon@2ndquadrant.com> wrote:
>> No, only in the case where you choose not to failover to the
>> standby when you crash, which would be a fairly strange choice
>> after the effort to set up the standby. In a correctly configured
>> and operated cluster what I say above is fully correct and needs
>> no addendum.
> what do you do if a meteor hits the synchronous standby and at the
> same time you lose power to the master? No amount of
> configuration will save you from coming back on line with a
> visible-but-unreplicated transaction.
You don't even need to postulate an extreme condition like that; we
prefer to have a DBA pull the trigger on a failover, rather than
trust the STONITH call to software. This is particularly true when
the master is local to its primary users and the replica is remote
to them.
-Kevin