On Tue, Jun 19, 2018 at 1:01 PM, Andres Freund <and...@anarazel.de> wrote: > On 2018-06-19 10:45:04 -0400, Robert Haas wrote: >> On Tue, Jun 19, 2018 at 2:30 AM, Andres Freund <and...@anarazel.de> wrote: >> > This should be a PANIC imo. >> >> -1. As a developer, I would prefer PANIC. But as an end-user, I >> would much rather have replay continue (with possible problems) than >> have it stopped cold in its tracks with absolutely nothing that I as >> the administrator can do to fix it. We should be building this >> product for end users. > > Except that that just means the end-user will have an undebuggable > problem at their hand. Which will affect them as well.
I agree, but my guess is that a PANIC will affect them more. > And they could just restart with hot_standby=off, and restart again. Or > even just restart without the GUC change, because that will rebuild the > locking state from a later state / start becoming ready for query at a > later stage. True, but that can still be a sufficient operational problem. I don't expect you to agree with my vote, but I stand by it. -- Robert Haas EnterpriseDB: http://www.enterprisedb.com The Enterprise PostgreSQL Company