Clamp autovacuum launcher sleep time to 5 minutes

This avoids the problem that it might go to sleep for an unreasonable
amount of time in unusual conditions like the server clock moving
backwards an unreasonable amount of time.

(Simply moving the server clock forward again doesn't solve the problem
unless you wake up the autovacuum launcher manually, say by sending it
SIGHUP).

Per trouble report from Prakash Itnal in
https://www.postgresql.org/message-id/CAHC5u79-UqbapAABH2t4Rh2eYdyge0Zid-X=Xz-ZWZCBK42S0Q@mail.gmail.com

Analyzed independently by Haribabu Kommi and Tom Lane.

diff --git a/src/backend/postmaster/autovacuum.c b/src/backend/postmaster/autovacuum.c
index aa4f6636e614c5564f633f5f8b79c6f45e326531..e31d454d0197e76738030213ceabfa2efc7df77f 100644 (file)
--- a/src/backend/postmaster/autovacuum.c
+++ b/src/backend/postmaster/autovacuum.c
@@ -120,6 +120,7 @@ int                 Log_autovacuum_min_duration = -1;
 
 /* the minimum allowed time between two awakenings of the launcher */
 #define MIN_AUTOVAC_SLEEPTIME 100.0            /* milliseconds */
+#define MAX_AUTOVAC_SLEEPTIME 300              /* seconds */
 
 /* Flags to tell if we are in an autovacuum process */
 static bool am_autovacuum_launcher = false;
@@ -863,6 +864,15 @@ launcher_determine_sleep(bool canlaunch, bool recursing, struct timeval * nap)
                nap->tv_sec = 0;
                nap->tv_usec = MIN_AUTOVAC_SLEEPTIME * 1000;
        }
+
+       /*
+        * If the sleep time is too large, clamp it to an arbitrary maximum (plus
+        * any fractional seconds, for simplicity).  This avoids an essentially
+        * infinite sleep in strange cases like the system clock going backwards a
+        * few years.
+        */
+       if (nap->tv_sec > MAX_AUTOVAC_SLEEPTIME)
+               nap->tv_sec = MAX_AUTOVAC_SLEEPTIME;
 }
 
 /*