Here is a patch to add some information about the systemd RemoveIPC issue to the documentation, sort of in the spirit of the OOM discussion nearby.
-- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
>From eaf0eda3f4c402a2e8b7f2f2395a8536f38aafbc Mon Sep 17 00:00:00 2001 From: Peter Eisentraut <pete...@gmx.net> Date: Tue, 27 Dec 2016 12:00:00 -0500 Subject: [PATCH] doc: Add advice about systemd RemoveIPC --- doc/src/sgml/runtime.sgml | 82 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml index 787cfce987..fee0d65d90 100644 --- a/doc/src/sgml/runtime.sgml +++ b/doc/src/sgml/runtime.sgml @@ -1165,6 +1165,88 @@ <title><systemitem class="osname">System V</> <acronym>IPC</> Parameters</title> </sect2> + <sect2 id="systemd-removeipc"> + <title>systemd RemoveIPC</title> + + <indexterm> + <primary>systemd</primary> + <secondary>RemoveIPC</secondary> + </indexterm> + + <caution> + <para> + If <productname>systemd</productname> is in use, the advice in this + section must be followed, or your PostgreSQL server will be very + unreliable. + </para> + </caution> + + <para> + If <productname>systemd</productname> is in use, special care must be + taken that IPC resources (shared memory and semaphores) are not + prematurely removed by the operating system. Although the issues + described here are most commonly known to happen if the PostgreSQL server + is started through a <productname>systemd</productname> service unit, they + can also happen in other setups. + </para> + + <para> + The setting <literal>RemoveIPC</literal> + in <filename>logind.conf</filename> controls whether IPC objects are + removed when a user fully logs out. System users are exempt. This + setting defaults to on in stock <productname>systemd</productname>, but + some operating system distributions default it to off. + </para> + + <para> + A typical observed effect when this setting is on is that the semaphore + objects used by a PostgreSQL server are removed at apparently random + times, leading to the server crashing with log messages like +<screen> +LOG: semctl(1234567890, 0, IPC_RMID, ...) failed: Invalid argument +</screen> + Different types of IPC objects (shared memory vs. semaphores, System V + vs. POSIX) are treated slightly differently + by <productname>systemd</productname>, so one might observe that some IPC + resources are not removed in the same way as others. But it is not + advisable to rely on these subtle differences. + </para> + + <para> + A <quote>user logging out</quote> might happen as part of a maintenance + job or manually when an administrator logs in as + the <literal>postgres</literal> user or similar, so it is hard to prevent + in general. + </para> + + <para> + What is a <quote>system user</quote> is determined + at <productname>systemd</productname> compile time from + the <symbol>SYS_UID_MAX</symbol> setting + in <filename>/etc/login.defs</filename>. + </para> + + <para> + It is recommended to set +<programlisting> +RemoveIPC=no +</programlisting> + on all server hosts used for PostgreSQL. + </para> + + <para> + Also, packaging and deployment scripts should be careful to create + the <literal>postgres</literal> user as a system user by + using <literal>useradd -r</literal>, <literal>adduser --system</literal>, + or equivalent. + </para> + + <para> + <emphasis>At least one of these two things have to be ensured, or the + PostgreSQL server will be very unreliable.</emphasis> + </para> + </sect2> + <sect2> <title>Resource Limits</title> -- 2.11.0
-- Sent via pgsql-hackers mailing list (email@example.com) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers