>>Would you use a kill operation in the way you describe above
>>if you knew
>>that it had, say, a 1% chance of causing a database-wide PANIC
>>each time
>>you used it?
Seems there's the need for some connection killing functionality. If
it's not present, the whole cluster needs to be shut down, which makes
it unavailable with 100 % chance.
If there's a .00001 % chance it *corrupts* the cluster, the function is
not acceptable. But iff it's a good chance to keep the cluster running,
it's worth having it (and should be used sensibly).
Regards,
Andreas