On Thu, Oct 7, 2010 at 10:24 PM, Fujii Masao <masao.fujii@gmail.com> wrote:
> On Wed, Oct 6, 2010 at 6:00 PM, Heikki Linnakangas
> <heikki.linnakangas@enterprisedb.com> wrote:
>> In general, salvaging the WAL that was not sent to the standby yet is
>> outright impossible. You can't achieve zero data loss with asynchronous
>> replication at all.
>
> No. That depends on the type of failure. Unless the disk in the master has
> been corrupted, we might be able to salvage WAL.
So I guess another way to say this is that zero data loss is
unachievable, period. Greg Smith made a flip comment about having
been so silly as to only put his redundant servers in adjacent states
on different power grids, and yet still having an outage due to the
Northeast blackouts. So what would he have had to do to completely
rule out a correlated failure?
Answer: It can't be done. If a massive asteroid comes zooming into
the inner solar system tomorrow and hits the earth, obliterating all
life, you're toast. Or likewise if nuclear war ensues. You could put
your redundant server on the moon or, better yet, on a moon of one of
the outer planets, but the hosting costs are pretty high and the ping
times suck.
So the point is that the question is not whether or not a correlated
failure can happen, but whether you can imagine a scenario where a
correlated failure has occurred yet you still wish you had your data.
Different people will, obviously, draw that line in different places.
Let's start by doing something simple that covers SOME of the cases
people want, get it committed, and then move on from there.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise Postgres Company