All:
(this thread concerns argument (F) whether or not admins need a way to
disable ALTER SYSTEM SET)
On 08/01/2013 04:03 PM, Dimitri Fontaine wrote:> If only we could
trigger some actions when a command is about to be
> executed, in a way that it's easy for the user to implement whatever
> policy he fancies…
>
> Oh, maybe I should finish preparing those patches for Event Triggers to
> be fully usable in 9.4 then ;)
I don't see this as a solution at all. "Mr. Sysadmin, we've given the
DBAs a new tool which allows them to override your version-controlled
database parameter settings. You can turn it off, though, by using this
incredibly complicated, brand-new Event Trigger tool which requires
writing lots of SQL code to make work."
Per Stephen Frost's arguments, some system owners are going to be
opposed to allowing ALTER SYSTEM SET at all because it can mess systems
up and cause downtime. Yes, that's already true of ALTER ROLE and ALTER
DATABASE, but ALTER SYSTEM SET expands this the ability of the DBA to
change setting substantially. That's obviously its benefit, but it's
also clearly a misfeature for some system owners. Also, to be blunt,
most DBAs/DEVs don't *know* about ALTER ROLE/DATABASE.
I don't think this is a small thing. I really think we'll get a LOT of
blowback from sysadmins -- and maybe even refusals to upgrade -- if we
add ALTER SYSTEM SET in 9.4.0 with no easy way to disable it. Having an
easy way to disable ALTER SYSTEM SET is *also* a good way to get out of
the whole situation of "I set shared_buffers to 100GB using ALTER SYSTEM
SET and now PostgreSQL won't start" problem.
As I've said before, I think the disable switch can be a follow-up patch
to the main ALTER SYSTEM SET patch.
--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com