Remove files signaling a standby promotion request at postmaster startup

This commit makes postmaster forcibly remove the files signaling
a standby promotion request. Otherwise, the existence of those files
can trigger a promotion too early, whether a user wants that or not.

This removal of files is usually unnecessary because they can exist
only during a few moments during a standby promotion. However
there is a race condition: if pg_ctl promote is executed and creates
the files during a promotion, the files can stay around even after
the server is brought up to new master. Then, if new standby starts
by using the backup taken from that master, the files can exist
at the server startup and should be removed in order to avoid
an unexpected promotion.

Back-patch to 9.1 where promote signal file was introduced.

Problem reported by Feike Steenbergen.
Original patch by Michael Paquier, modified by me.

Discussion: 20150528100705.4686.91426@wrigleys.postgresql.org

diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index ea1af8ccbba2ec8b5400d3c91b8140d7ef92c4c1..0397686f5a4ab8ce2ab1ddc60a364d77aff3c8aa 100644 (file)
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -10981,6 +10981,15 @@ CheckForStandbyTrigger(void)
        return false;
 }
 
+/*
+ * Remove the files signaling a standby promotion request.
+ */
+void
+RemovePromoteSignalFiles(void)
+{
+       unlink(PROMOTE_SIGNAL_FILE);
+}
+
 /*
  * Check to see if a promote request has arrived. Should be
  * called by postmaster after receiving SIGUSR1.

diff --git a/src/backend/postmaster/postmaster.c b/src/backend/postmaster/postmaster.c
index aff9a5e1159a788f427d24747fbb047c441089ff..dd87e430434845b087c67b17bd9db286dbf9cf00 100644 (file)
--- a/src/backend/postmaster/postmaster.c
+++ b/src/backend/postmaster/postmaster.c
@@ -1087,6 +1087,27 @@ PostmasterMain(int argc, char *argv[])
         */
        RemovePgTempFiles();
 
+       /*
+        * Forcibly remove the files signaling a standby promotion
+        * request. Otherwise, the existence of those files triggers
+        * a promotion too early, whether a user wants that or not.
+        *
+        * This removal of files is usually unnecessary because they
+        * can exist only during a few moments during a standby
+        * promotion. However there is a race condition: if pg_ctl promote
+        * is executed and creates the files during a promotion,
+        * the files can stay around even after the server is brought up
+        * to new master. Then, if new standby starts by using the backup
+        * taken from that master, the files can exist at the server
+        * startup and should be removed in order to avoid an unexpected
+        * promotion.
+        *
+        * Note that promotion signal files need to be removed before
+        * the startup process is invoked. Because, after that, they can
+        * be used by postmaster's SIGUSR1 signal handler.
+        */
+       RemovePromoteSignalFiles();
+
        /*
         * If enabled, start up syslogger collection subprocess
         */

diff --git a/src/include/access/xlog.h b/src/include/access/xlog.h
index e35aecc3495e12e298e1d997f4f62a97cf5aa2a1..5fcbf5006507027242392ce45c76fe574dc7c378 100644 (file)
--- a/src/include/access/xlog.h
+++ b/src/include/access/xlog.h
@@ -321,6 +321,7 @@ extern XLogRecPtr GetInsertRecPtr(void);
 extern XLogRecPtr GetFlushRecPtr(void);
 extern void GetNextXidAndEpoch(TransactionId *xid, uint32 *epoch);
 extern TimeLineID GetRecoveryTargetTLI(void);
+extern void RemovePromoteSignalFiles(void);
 
 extern bool CheckPromoteSignal(void);
 extern void WakeupRecovery(void);