On Tue, Jun 19, 2018 at 1:01 PM, Andres Freund <andres@anarazel.de> wrote:
> On 2018-06-19 10:45:04 -0400, Robert Haas wrote:
>> On Tue, Jun 19, 2018 at 2:30 AM, Andres Freund <andres@anarazel.de> wrote:
>> > This should be a PANIC imo.
>>
>> -1. As a developer, I would prefer PANIC. But as an end-user, I
>> would much rather have replay continue (with possible problems) than
>> have it stopped cold in its tracks with absolutely nothing that I as
>> the administrator can do to fix it. We should be building this
>> product for end users.
>
> Except that that just means the end-user will have an undebuggable
> problem at their hand. Which will affect them as well.
I agree, but my guess is that a PANIC will affect them more.
> And they could just restart with hot_standby=off, and restart again. Or
> even just restart without the GUC change, because that will rebuild the
> locking state from a later state / start becoming ready for query at a
> later stage.
True, but that can still be a sufficient operational problem.
I don't expect you to agree with my vote, but I stand by it.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company