Have pg_rewind run crash recovery before rewinding

If we don't do this, the rewind fails if the server wasn't cleanly shut
down, which seems unhelpful serving no purpose.

Also provide a new option --no-ensure-shutdown to suppress this
behavior, for alleged advanced usage that prefers to avoid the crash
recovery.

Authors: Paul Guo, Jimmy Yih, Ashwin Agrawal
Reviewed-by: Álvaro Herrera
Discussion: https://postgr.es/m/CAEET0ZEffUkXc48pg2iqARQgGRYDiiVxDu+yYek_bTwJF+q=Uw@mail.gmail.com

diff --git a/doc/src/sgml/ref/pg_rewind.sgml b/doc/src/sgml/ref/pg_rewind.sgml
index ac142d22fcd11ad5d1022c0ea6ccacf87bbf790a..a06e5ac5e11b8b0ff716370c5077acaa7f74aac5 100644 (file)
--- a/doc/src/sgml/ref/pg_rewind.sgml
+++ b/doc/src/sgml/ref/pg_rewind.sgml
@@ -165,6 +165,21 @@ PostgreSQL documentation
       </listitem>
      </varlistentry>
 
+     <varlistentry>
+      <term><option>--no-ensure-shutdown</option></term>
+      <listitem>
+       <para>
+        <application>pg_rewind</application> verifies that the target server
+        is cleanly shutdown before rewinding; by default, if it isn't, it
+        starts the server in single-user mode to complete crash recovery.
+        By passing this option, <application>pg_rewind</application> skips
+        this and errors out immediately if the server is not cleanly shut
+        down.  Users are expected to handle the situation themselves in that
+        case.
+       </para>
+      </listitem>
+     </varlistentry>
+
      <varlistentry>
       <term><option>-n</option></term>
       <term><option>--dry-run</option></term>

diff --git a/src/bin/pg_rewind/pg_rewind.c b/src/bin/pg_rewind/pg_rewind.c
index 15e3eab55050c6328a82e4f01f42f11254fdf321..8cb0d726cfeef5a552c1385ae508735ebd1c7192 100644 (file)
--- a/src/bin/pg_rewind/pg_rewind.c
+++ b/src/bin/pg_rewind/pg_rewind.c
@@ -40,6 +40,7 @@ static void digestControlFile(ControlFileData *ControlFile, char *source,
 static void syncTargetDirectory(void);
 static void sanityChecks(void);
 static void findCommonAncestorTimeline(XLogRecPtr *recptr, int *tliIndex);
+static void ensureCleanShutdown(const char *argv0);
 
 static ControlFileData ControlFile_target;
 static ControlFileData ControlFile_source;
@@ -79,6 +80,7 @@ usage(const char *progname)
        printf(_("  -N, --no-sync                  do not wait for changes to be written\n"
                         "                                 safely to disk\n"));
        printf(_("  -P, --progress                 write progress messages\n"));
+       printf(_("      --no-ensure-shutdown       do not automatically fix unclean shutdown\n"));
        printf(_("      --debug                    write a lot of debug messages\n"));
        printf(_("  -V, --version                  output version information, then exit\n"));
        printf(_("  -?, --help                     show this help, then exit\n"));
@@ -94,6 +96,7 @@ main(int argc, char **argv)
                {"target-pgdata", required_argument, NULL, 'D'},
                {"source-pgdata", required_argument, NULL, 1},
                {"source-server", required_argument, NULL, 2},
+               {"no-ensure-shutdown", no_argument, NULL, 44},
                {"version", no_argument, NULL, 'V'},
                {"dry-run", no_argument, NULL, 'n'},
                {"no-sync", no_argument, NULL, 'N'},
@@ -110,6 +113,7 @@ main(int argc, char **argv)
        XLogRecPtr      chkptredo;
        size_t          size;
        char       *buffer;
+       bool            no_ensure_shutdown = false;
        bool            rewind_needed;
        XLogRecPtr      endrec;
        TimeLineID      endtli;
@@ -169,6 +173,9 @@ main(int argc, char **argv)
                        case 2:                         /* --source-server */
                                connstr_source = pg_strdup(optarg);
                                break;
+                       case 4:
+                               no_ensure_shutdown = true;
+                               break;
                }
        }
 
@@ -241,6 +248,24 @@ main(int argc, char **argv)
        digestControlFile(&ControlFile_target, buffer, size);
        pg_free(buffer);
 
+       /*
+        * If the target instance was not cleanly shut down, run a single-user
+        * postgres session really quickly and reload the control file to get the
+        * new state. Note if no_ensure_shutdown is specified, pg_rewind won't do
+        * that automatically. That means users need to do themselves in advance,
+        * else pg_rewind will soon quit, see sanityChecks().
+        */
+       if (!no_ensure_shutdown &&
+               ControlFile_target.state != DB_SHUTDOWNED &&
+               ControlFile_target.state != DB_SHUTDOWNED_IN_RECOVERY)
+       {
+               ensureCleanShutdown(argv[0]);
+
+               buffer = slurpFile(datadir_target, "global/pg_control", &size);
+               digestControlFile(&ControlFile_target, buffer, size);
+               pg_free(buffer);
+       }
+
        buffer = fetchFile("global/pg_control", &size);
        digestControlFile(&ControlFile_source, buffer, size);
        pg_free(buffer);
@@ -748,3 +773,58 @@ syncTargetDirectory(void)
 
        fsync_pgdata(datadir_target, PG_VERSION_NUM);
 }
+
+/*
+ * Ensure clean shutdown of target instance by launching single-user mode
+ * postgres to do crash recovery.
+ */
+static void
+ensureCleanShutdown(const char *argv0)
+{
+       int                     ret;
+#define MAXCMDLEN (2 * MAXPGPATH)
+       char            exec_path[MAXPGPATH];
+       char            cmd[MAXCMDLEN];
+
+       /* locate postgres binary */
+       if ((ret = find_other_exec(argv0, "postgres",
+                                                          PG_BACKEND_VERSIONSTR,
+                                                          exec_path)) < 0)
+       {
+               char            full_path[MAXPGPATH];
+
+               if (find_my_exec(argv0, full_path) < 0)
+                       strlcpy(full_path, progname, sizeof(full_path));
+
+               if (ret == -1)
+                       pg_fatal("The program \"%s\" is needed by %s but was\n"
+                                        "not found in the same directory as \"%s\".\n"
+                                        "Check your installation.",
+                                        "postgres", progname, full_path);
+               else
+                       pg_fatal("The program \"%s\" was found by \"%s\" but was\n"
+                                        "not the same version as %s.\n"
+                                        "Check your installation.",
+                                        "postgres", full_path, progname);
+       }
+
+       pg_log_info("executing \"%s\" for target server to complete crash recovery",
+                               exec_path);
+
+       /*
+        * Skip processing if requested, but only after ensuring presence of
+        * postgres.
+        */
+       if (dry_run)
+               return;
+
+       /* finally run postgres in single-user mode */
+       snprintf(cmd, MAXCMDLEN, "\"%s\" --single -D \"%s\" template1 < \"%s\"",
+                        exec_path, datadir_target, DEVNULL);
+
+       if (system(cmd) != 0)
+       {
+               pg_log_error("postgres single-user mode of target instance failed");
+               pg_fatal("Command was: %s", cmd);
+       }
+}