5.10. Failover and Failback

Specifies a user command to run when a PostgreSQL backend node gets detached. Pgpool-II replaces the following special characters with the backend specific information.

A complete failover_command example can be found in Section 8.2.

This parameter can be changed by reloading the Pgpool-II configurations.

Specifies a user command to run when a PostgreSQL backend node gets attached to Pgpool-II. Pgpool-II replaces the following special characters with the backend specific information. before executing the command.

This parameter can be changed by reloading the Pgpool-II configurations.

Specifies a user command to run after failover on the primary node failover. In case of standby node failover, the command will not be executed. This command also runs if a node promote request is issued by pcp_promote_node command. This works only in streaming replication mode.

Since the command is executed within a child process forked off by Pgpool-II after failover is completed, execution of follow primary command does not block the service of Pgpool-II. Here is a pseud code to illustrate how the command is executed:

for each backend node
{
    if (the node is not the new primary)
        set down node status to shared memory status
        memorize that follow primary command is needed to execute
}
if (we need to executed follow primary command)
{
    fork a child process
    (within the child process)

    for each backend node
    {
        if (the node status in shared memory is down)
            execute follow primary command
    }
}
      

Pgpool-II replaces the following special characters with the backend specific information before executing the command.

Typically follow_primary_command command is used to recover the standby from the new primary by calling the pcp_recovery_node command. In the follow_primary_command, it is recommended to check whether target PostgreSQL node is running or not using pg_ctl since already stopped node usually has a reason to be stopped: for example, it's broken by hardware problems or administrator is maintaining the node. If the node is stopped, skip the node. If the node is running, stop the node first and recovery it. Although it is possible to recover by directly executing pg_basebackup or other commands instead of pcp_recovery_node, you need to execute pcp_attach_node to notice Pgpool-II that the standby server is ready to use. Otherwise the standby server remains in down status. (Since pcp_recovery_node internally executes pcp_attach_node, you don't need to execute pcp_attach_node after recovering. A complete follow_primary_command example can be found in Section 8.2.

This parameter can be changed by reloading the Pgpool-II configurations.

When set to on, Pgpool-II detects a backend shutdown event by checking particular error code 57P01 and 57P02 on a session established between the client and backend. If it detects those error codes, a failover is triggered on that node. When this is set to off, Pgpool-II only report an error and disconnect the session in case of such errors. The default is off.

If no client is connected, Pgpool-II will not detect the event even if the parameter is on.

In addition, in the streaming replication mode, shutting down of PostgreSQL does not trigger a failover, if the node is a standby node and is not the load balance node even if failover_on_backend_shutdown is on. In order to find which node is the load balance node, you can use SHOW POOL NODES.

Please note that 57P01 is not only sent at a shutdown event, but also sent when the backend currently connected is killed by pg_terminate_backend or SIGTERM signal. This is annoying because it results in unwanted failover. To avoid this, turn off this parameter.

This parameter is available in Pgpool-II 4.3 or later. This parameter can be changed by reloading the Pgpool-II configurations.

When set to on, Pgpool-II considers the reading/writing errors on the PostgreSQL backend connection as the backend node failure and trigger the failover on that node after disconnecting the current session. When this is set to off, Pgpool-II only report an error and disconnect the session in case of such errors.

This parameter can be changed by reloading the Pgpool-II configurations.

Specifies the maximum amount of time in seconds to search for the primary node when a failover scenario occurs. Pgpool-II will give up looking for the primary node if it is not found with-in this configured time. Default is 300 and Setting this parameter to 0 means keep trying forever.

This parameter is only applicable in the streaming replication mode.

This parameter can be changed by reloading the Pgpool-II configurations.

If set to on, detach false primary node. The default is off. This parameter is only valid in streaming replication mode and for PostgreSQL 9.6 or after since this feature uses pg_stat_wal_receiver. If PostgreSQL 9.5.x or older version is used, no error is raised, just the feature is ignored.

If there's no primary node, no checking will be performed.

If there's no standby node, and there's only one primary node, no checking will be performed.

If there's no standby node, and there's multiple primary nodes, leave the primary node which has the youngest node id and detach rest of primary nodes.

If there are one or more primaries and one or more standbys, check the connectivity between primary and standby nodes by using pg_stat_wal_receiver if PostgreSQL 9.6 or after. In this case if a primary node connects to all standby nodes, the primary is regarded as "true" primary. Other primaries are regarded as "false" primary and the false primaries will be detached if detach_false_primary is true. If no "true" primary is found, nothing will happen.

When Pgpool-II starts, the checking of false primaries are performed only once in the Pgpool-II main process. If sr_check_period is greater than 0, the false primaries checking will be performed at the same timing of streaming replication delay checking.

This parameter is only applicable in the streaming replication mode.

This parameter can be changed by reloading the Pgpool-II configurations.

When set to on, standby node be automatically failback, if the node status is down but streaming replication works normally. This is useful when standby node is degenerated by pgpool because of the temporary network failure.

To use this feature, streaming replication check (see Section 5.12 for more details) must be enabled, and PostgreSQL 9.1 or later is required as backend nodes. This feature uses pg_stat_replication on primary node. The automatic failback is performed on standby node only. Note that failback_command will be executed as well if failback_command is not empty. If you plan to detach standby node for maintenance, set this parameter to off beforehand. Otherwise it's possible that standby node is reattached against your intention.

The default is off. This parameter can be changed by reloading the Pgpool-II configurations.

Specifies the minimum amount of time in seconds for execution interval of auto failback. Next auto failback won't execute until that specified time have passed after previous auto failback. When Pgpool-II frequently detect backend down because of network error for example, you may avoid repeating failover and failback by setting this parameter to large enough value. The default is 60. Setting this parameter to 0 means that auto failback don't wait.