Skip to content

Commit 87eadd7

Browse files
committed
Force default wal_sync_method to be fdatasync on Linux.
Recent versions of the Linux system header files cause xlogdefs.h to believe that open_datasync should be the default sync method, whereas formerly fdatasync was the default on Linux. open_datasync is a bad choice, first because it doesn't actually outperform fdatasync (in fact the reverse), and second because we try to use O_DIRECT with it, causing failures on certain filesystems (e.g., ext4 with data=journal option). This part of the patch is largely per a proposal from Marti Raudsepp. More extensive changes are likely to follow in HEAD, but this is as much change as we want to back-patch. Also clean up confusing code and incorrect documentation surrounding the fsync_writethrough option. Those changes shouldn't result in any actual behavioral change, but I chose to back-patch them anyway to keep the branches looking similar in this area. In 9.0 and HEAD, also do some copy-editing on the WAL Reliability documentation section. Back-patch to all supported branches, since any of them might get used on modern Linux versions.
1 parent 799d0b4 commit 87eadd7

File tree

7 files changed

+120
-73
lines changed

7 files changed

+120
-73
lines changed

doc/src/sgml/config.sgml

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1459,18 +1459,19 @@ SET ENABLE_SEQSCAN TO OFF;
14591459
<para>
14601460
While turning off <varname>fsync</varname> is often a performance
14611461
benefit, this can result in unrecoverable data corruption in
1462-
the event of an unexpected system shutdown or crash. Thus it
1463-
is only advisable to turn off <varname>fsync</varname> if
1462+
the event of a power failure or system crash. Thus it
1463+
is only advisable to turn off <varname>fsync</varname> if
14641464
you can easily recreate your entire database from external
14651465
data.
14661466
</para>
14671467

14681468
<para>
14691469
Examples of safe circumstances for turning off
1470-
<varname>fsync</varname> include the initial loading a new
1470+
<varname>fsync</varname> include the initial loading of a new
14711471
database cluster from a backup file, using a database cluster
1472-
for processing statistics on an hourly basis which is then
1473-
recreated, or for a reporting read-only database clone which
1472+
for processing a batch of data after which the database
1473+
will be thrown away and recreated,
1474+
or for a read-only database clone which
14741475
gets recreated frequently and is not used for failover. High
14751476
quality hardware alone is not a sufficient justification for
14761477
turning off <varname>fsync</varname>.
@@ -1553,12 +1554,12 @@ SET ENABLE_SEQSCAN TO OFF;
15531554
</listitem>
15541555
<listitem>
15551556
<para>
1556-
<literal>fsync_writethrough</> (call <function>fsync()</> at each commit, forcing write-through of any disk write cache)
1557+
<literal>fsync</> (call <function>fsync()</> at each commit)
15571558
</para>
15581559
</listitem>
15591560
<listitem>
15601561
<para>
1561-
<literal>fsync</> (call <function>fsync()</> at each commit)
1562+
<literal>fsync_writethrough</> (call <function>fsync()</> at each commit, forcing write-through of any disk write cache)
15621563
</para>
15631564
</listitem>
15641565
<listitem>
@@ -1568,16 +1569,15 @@ SET ENABLE_SEQSCAN TO OFF;
15681569
</listitem>
15691570
</itemizedlist>
15701571
<para>
1571-
Not all of these choices are available on all platforms.
15721572
The <literal>open_</>* options also use <literal>O_DIRECT</> if available.
1573+
Not all of these choices are available on all platforms.
15731574
The default is the first method in the above list that is supported
1574-
by the platform. The default is not necessarily ideal; it might be
1575+
by the platform, except that <literal>fdatasync</> is the default on
1576+
Linux. The default is not necessarily ideal; it might be
15751577
necessary to change this setting or other aspects of your system
15761578
configuration in order to create a crash-safe configuration or
15771579
achieve optimal performance.
15781580
These aspects are discussed in <xref linkend="wal-reliability">.
1579-
The utility <filename>src/tools/fsync</> in the PostgreSQL source tree
1580-
can do performance testing of various fsync methods.
15811581
This parameter can only be set in the <filename>postgresql.conf</>
15821582
file or on the server command line.
15831583
</para>

doc/src/sgml/wal.sgml

Lines changed: 83 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
</para>
2828

2929
<para>
30-
While forcing data periodically to the disk platters might seem like
30+
While forcing data to the disk platters periodically might seem like
3131
a simple operation, it is not. Because disk drives are dramatically
3232
slower than main memory and CPUs, several layers of caching exist
3333
between the computer's main memory and the disk platters.
@@ -48,7 +48,7 @@
4848
some later time. Such caches can be a reliability hazard because the
4949
memory in the disk controller cache is volatile, and will lose its
5050
contents in a power failure. Better controller cards have
51-
<firstterm>battery-backed unit</> (<acronym>BBU</>) caches, meaning
51+
<firstterm>battery-backup units</> (<acronym>BBU</>s), meaning
5252
the card has a battery that
5353
maintains power to the cache in case of system power loss. After power
5454
is restored the data will be written to the disk drives.
@@ -57,54 +57,85 @@
5757
<para>
5858
And finally, most disk drives have caches. Some are write-through
5959
while some are write-back, and the same concerns about data loss
60-
exist for write-back drive caches as exist for disk controller
60+
exist for write-back drive caches as for disk controller
6161
caches. Consumer-grade IDE and SATA drives are particularly likely
62-
to have write-back caches that will not survive a power failure,
63-
though <acronym>ATAPI-6</> introduced a drive cache flush command
64-
(<command>FLUSH CACHE EXT</>) that some file systems use, e.g.
65-
<acronym>ZFS</>, <acronym>ext4</>. (The SCSI command
66-
<command>SYNCHRONIZE CACHE</> has long been available.) Many
67-
solid-state drives (SSD) also have volatile write-back caches, and
68-
many do not honor cache flush commands by default.
69-
</para>
70-
71-
<para>
72-
To check write caching on <productname>Linux</> use
73-
<command>hdparm -I</>; it is enabled if there is a <literal>*</> next
74-
to <literal>Write cache</>; <command>hdparm -W</> to turn off
75-
write caching. On <productname>FreeBSD</> use
76-
<application>atacontrol</>. (For SCSI disks use <ulink
77-
url="http://sg.danny.cz/sg/sdparm.html"><application>sdparm</></ulink>
78-
to turn off <literal>WCE</>.) On <productname>Solaris</> the disk
79-
write cache is controlled by <ulink
80-
url="http://www.sun.com/bigadmin/content/submitted/format_utility.jsp"><literal>format
81-
-e</></ulink>. (The Solaris <acronym>ZFS</> file system is safe with
82-
disk write-cache enabled because it issues its own disk cache flush
83-
commands.) On <productname>Windows</> if <varname>wal_sync_method</>
84-
is <literal>open_datasync</> (the default), write caching is disabled
85-
by unchecking <literal>My Computer\Open\{select disk
86-
drive}\Properties\Hardware\Properties\Policies\Enable write caching on
87-
the disk</>. Also on Windows, <literal>fsync</> and
88-
<literal>fsync_writethrough</> never do write caching. The
89-
<literal>fsync_writethrough</> option can also be used to disable
90-
write caching on <productname>MacOS X</>.
91-
</para>
92-
93-
<para>
94-
Many file systems that use write barriers (e.g. <acronym>ZFS</>,
95-
<acronym>ext4</>) internally use <command>FLUSH CACHE EXT</> or
96-
<command>SYNCHRONIZE CACHE</> commands to flush data to the platters on
97-
write-back-enabled drives. Unfortunately, such write barrier file
98-
systems behave suboptimally when combined with battery-backed unit
62+
to have write-back caches that will not survive a power failure. Many
63+
solid-state drives (SSD) also have volatile write-back caches.
64+
</para>
65+
66+
<para>
67+
These caches can typically be disabled; however, the method for doing
68+
this varies by operating system and drive type:
69+
</para>
70+
71+
<itemizedlist>
72+
<listitem>
73+
<para>
74+
On <productname>Linux</>, IDE drives can be queried using
75+
<command>hdparm -I</command>; write caching is enabled if there is
76+
a <literal>*</> next to <literal>Write cache</>. <command>hdparm -W</>
77+
can be used to turn off write caching. SCSI drives can be queried
78+
using <ulink url="http://sg.danny.cz/sg/sdparm.html"><application>sdparm</></ulink>.
79+
Use <command>sdparm --get=WCE</command> to check
80+
whether the write cache is enabled and <command>sdparm --clear=WCE</>
81+
to disable it.
82+
</para>
83+
</listitem>
84+
85+
<listitem>
86+
<para>
87+
On <productname>FreeBSD</>, IDE drives can be queried using
88+
<command>atacontrol</command>, and SCSI drives using
89+
<command>sdparm</command>.
90+
</para>
91+
</listitem>
92+
93+
<listitem>
94+
<para>
95+
On <productname>Solaris</>, the disk write cache is controlled by
96+
<ulink url="http://www.sun.com/bigadmin/content/submitted/format_utility.jsp"><literal>format -e</></ulink>.
97+
(The Solaris <acronym>ZFS</> file system is safe with disk write-cache
98+
enabled because it issues its own disk cache flush commands.)
99+
</para>
100+
</listitem>
101+
102+
<listitem>
103+
<para>
104+
On <productname>Windows</>, if <varname>wal_sync_method</> is
105+
<literal>open_datasync</> (the default), write caching can be disabled
106+
by unchecking <literal>My Computer\Open\<replaceable>disk drive</>\Properties\Hardware\Properties\Policies\Enable write caching on the disk</>.
107+
Alternatively, set <varname>wal_sync_method</varname> to
108+
<literal>fsync</> or <literal>fsync_writethrough</>, which prevent
109+
write caching.
110+
</para>
111+
</listitem>
112+
113+
<listitem>
114+
<para>
115+
On <productname>Mac OS X</productname>, write caching can be prevented by
116+
setting <varname>wal_sync_method</> to <literal>fsync_writethrough</>.
117+
</para>
118+
</listitem>
119+
</itemizedlist>
120+
121+
<para>
122+
Recent SATA drives (those following <acronym>ATAPI-6</> or later)
123+
offer a drive cache flush command (<command>FLUSH CACHE EXT</>),
124+
while SCSI drives have long supported a similar command
125+
<command>SYNCHRONIZE CACHE</>. These commands are not directly
126+
accessible to <productname>PostgreSQL</>, but some file systems
127+
(e.g., <acronym>ZFS</>, <acronym>ext4</>) can use them to flush
128+
data to the platters on write-back-enabled drives. Unfortunately, such
129+
file systems behave suboptimally when combined with battery-backup unit
99130
(<acronym>BBU</>) disk controllers. In such setups, the synchronize
100-
command forces all data from the BBU to the disks, eliminating much
101-
of the benefit of the BBU. You can run the utility
131+
command forces all data from the controller cache to the disks,
132+
eliminating much of the benefit of the BBU. You can run the utility
102133
<filename>src/tools/fsync</> in the PostgreSQL source tree to see
103134
if you are affected. If you are affected, the performance benefits
104-
of the BBU cache can be regained by turning off write barriers in
135+
of the BBU can be regained by turning off write barriers in
105136
the file system or reconfiguring the disk controller, if that is
106137
an option. If write barriers are turned off, make sure the battery
107-
remains active; a faulty battery can potentially lead to data loss.
138+
remains functional; a faulty battery can potentially lead to data loss.
108139
Hopefully file system and disk controller designers will eventually
109140
address this suboptimal behavior.
110141
</para>
@@ -117,6 +148,8 @@
117148
ensure data integrity. Avoid disk controllers that have non-battery-backed
118149
write caches. At the drive level, disable write-back caching if the
119150
drive cannot guarantee the data will be written before shutdown.
151+
If you use SSDs, be aware that many of these do not honor cache flush
152+
commands by default.
120153
You can test for reliable I/O subsystem behavior using <ulink
121154
url="http://brad.livejournal.com/2116715.html"><filename>diskchecker.pl</filename></ulink>.
122155
</para>
@@ -126,16 +159,17 @@
126159
operations themselves. Disk platters are divided into sectors,
127160
commonly 512 bytes each. Every physical read or write operation
128161
processes a whole sector.
129-
When a write request arrives at the drive, it might be for 512 bytes,
130-
1024 bytes, or 8192 bytes, and the process of writing could fail due
162+
When a write request arrives at the drive, it might be for some multiple
163+
of 512 bytes (<productname>PostgreSQL</> typically writes 8192 bytes, or
164+
16 sectors, at a time), and the process of writing could fail due
131165
to power loss at any time, meaning some of the 512-byte sectors were
132-
written, and others were not. To guard against such failures,
166+
written while others were not. To guard against such failures,
133167
<productname>PostgreSQL</> periodically writes full page images to
134168
permanent WAL storage <emphasis>before</> modifying the actual page on
135169
disk. By doing this, during crash recovery <productname>PostgreSQL</> can
136-
restore partially-written pages. If you have a battery-backed disk
170+
restore partially-written pages from WAL. If you have a battery-backed disk
137171
controller or file-system software that prevents partial page writes
138-
(e.g., ZFS), you can turn off this page imaging by turning off the
172+
(e.g., ZFS), you can safely turn off this page imaging by turning off the
139173
<xref linkend="guc-full-page-writes"> parameter.
140174
</para>
141175
</sect1>

src/backend/storage/file/fd.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -257,12 +257,13 @@ static void RemovePgTempFilesInDir(const char *tmpdirname);
257257
int
258258
pg_fsync(int fd)
259259
{
260-
#ifndef HAVE_FSYNC_WRITETHROUGH_ONLY
261-
if (sync_method != SYNC_METHOD_FSYNC_WRITETHROUGH)
262-
return pg_fsync_no_writethrough(fd);
260+
/* #if is to skip the sync_method test if there's no need for it */
261+
#if defined(HAVE_FSYNC_WRITETHROUGH) && !defined(FSYNC_WRITETHROUGH_IS_FSYNC)
262+
if (sync_method == SYNC_METHOD_FSYNC_WRITETHROUGH)
263+
return pg_fsync_writethrough(fd);
263264
else
264265
#endif
265-
return pg_fsync_writethrough(fd);
266+
return pg_fsync_no_writethrough(fd);
266267
}
267268

268269

src/backend/utils/misc/postgresql.conf.sample

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@
157157
#wal_sync_method = fsync # the default is the first option
158158
# supported by the operating system:
159159
# open_datasync
160-
# fdatasync
160+
# fdatasync (default on Linux)
161161
# fsync
162162
# fsync_writethrough
163163
# open_sync

src/include/access/xlogdefs.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -123,12 +123,12 @@ typedef uint32 TimeLineID;
123123
#endif
124124
#endif
125125

126-
#if defined(OPEN_DATASYNC_FLAG)
126+
#if defined(PLATFORM_DEFAULT_SYNC_METHOD)
127+
#define DEFAULT_SYNC_METHOD PLATFORM_DEFAULT_SYNC_METHOD
128+
#elif defined(OPEN_DATASYNC_FLAG)
127129
#define DEFAULT_SYNC_METHOD SYNC_METHOD_OPEN_DSYNC
128130
#elif defined(HAVE_FDATASYNC)
129131
#define DEFAULT_SYNC_METHOD SYNC_METHOD_FDATASYNC
130-
#elif defined(HAVE_FSYNC_WRITETHROUGH_ONLY)
131-
#define DEFAULT_SYNC_METHOD SYNC_METHOD_FSYNC_WRITETHROUGH
132132
#else
133133
#define DEFAULT_SYNC_METHOD SYNC_METHOD_FSYNC
134134
#endif

src/include/port/linux.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,11 @@
1212
* to have a kernel version test here.
1313
*/
1414
#define HAVE_LINUX_EIDRM_BUG
15+
16+
/*
17+
* Set the default wal_sync_method to fdatasync. With recent Linux versions,
18+
* xlogdefs.h's normal rules will prefer open_datasync, which (a) doesn't
19+
* perform better and (b) causes outright failures on ext4 data=journal
20+
* filesystems, because those don't support O_DIRECT.
21+
*/
22+
#define PLATFORM_DEFAULT_SYNC_METHOD SYNC_METHOD_FDATASYNC

src/include/port/win32.h

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,18 @@
3434
/* Must be here to avoid conflicting with prototype in windows.h */
3535
#define mkdir(a,b) mkdir(a)
3636

37-
#define HAVE_FSYNC_WRITETHROUGH
38-
#define HAVE_FSYNC_WRITETHROUGH_ONLY
3937
#define ftruncate(a,b) chsize(a,b)
38+
39+
/* Windows doesn't have fsync() as such, use _commit() */
40+
#define fsync(fd) _commit(fd)
41+
4042
/*
41-
* Even though we don't support 'fsync' as a wal_sync_method,
42-
* we do fsync() a few other places where _commit() is just fine.
43+
* For historical reasons, we allow setting wal_sync_method to
44+
* fsync_writethrough on Windows, even though it's really identical to fsync
45+
* (both code paths wind up at _commit()).
4346
*/
44-
#define fsync(fd) _commit(fd)
47+
#define HAVE_FSYNC_WRITETHROUGH
48+
#define FSYNC_WRITETHROUGH_IS_FSYNC
4549

4650
#define USES_WINSOCK
4751

0 commit comments

Comments
 (0)