Here is a patch to add some information about the systemd RemoveIPC
issue to the documentation, sort of in the spirit of the OOM discussion

Peter Eisentraut    
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
>From eaf0eda3f4c402a2e8b7f2f2395a8536f38aafbc Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <>
Date: Tue, 27 Dec 2016 12:00:00 -0500
Subject: [PATCH] doc: Add advice about systemd RemoveIPC

 doc/src/sgml/runtime.sgml | 82 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index 787cfce987..fee0d65d90 100644
--- a/doc/src/sgml/runtime.sgml
+++ b/doc/src/sgml/runtime.sgml
@@ -1165,6 +1165,88 @@ <title><systemitem class="osname">System V</> <acronym>IPC</> Parameters</title>
+  <sect2 id="systemd-removeipc">
+   <title>systemd RemoveIPC</title>
+   <indexterm>
+    <primary>systemd</primary>
+    <secondary>RemoveIPC</secondary>
+   </indexterm>
+   <caution>
+    <para>
+     If <productname>systemd</productname> is in use, the advice in this
+     section must be followed, or your PostgreSQL server will be very
+     unreliable.
+    </para>
+   </caution>
+   <para>
+    If <productname>systemd</productname> is in use, special care must be
+    taken that IPC resources (shared memory and semaphores) are not
+    prematurely removed by the operating system.  Although the issues
+    described here are most commonly known to happen if the PostgreSQL server
+    is started through a <productname>systemd</productname> service unit, they
+    can also happen in other setups.
+   </para>
+   <para>
+    The setting <literal>RemoveIPC</literal>
+    in <filename>logind.conf</filename> controls whether IPC objects are
+    removed when a user fully logs out.  System users are exempt.  This
+    setting defaults to on in stock <productname>systemd</productname>, but
+    some operating system distributions default it to off.
+   </para>
+   <para>
+    A typical observed effect when this setting is on is that the semaphore
+    objects used by a PostgreSQL server are removed at apparently random
+    times, leading to the server crashing with log messages like
+LOG: semctl(1234567890, 0, IPC_RMID, ...) failed: Invalid argument
+    Different types of IPC objects (shared memory vs. semaphores, System V
+    vs. POSIX) are treated slightly differently
+    by <productname>systemd</productname>, so one might observe that some IPC
+    resources are not removed in the same way as others.  But it is not
+    advisable to rely on these subtle differences.
+   </para>
+   <para>
+    A <quote>user logging out</quote> might happen as part of a maintenance
+    job or manually when an administrator logs in as
+    the <literal>postgres</literal> user or similar, so it is hard to prevent
+    in general.
+   </para>
+   <para>
+    What is a <quote>system user</quote> is determined
+    at <productname>systemd</productname> compile time from
+    the <symbol>SYS_UID_MAX</symbol> setting
+    in <filename>/etc/login.defs</filename>.
+   </para>
+   <para>
+    It is recommended to set
+    on all server hosts used for PostgreSQL.
+   </para>
+   <para>
+    Also, packaging and deployment scripts should be careful to create
+    the <literal>postgres</literal> user as a system user by
+    using <literal>useradd -r</literal>, <literal>adduser --system</literal>,
+    or equivalent.
+   </para>
+   <para>
+    <emphasis>At least one of these two things have to be ensured, or the
+    PostgreSQL server will be very unreliable.</emphasis>
+   </para>
+  </sect2>
    <title>Resource Limits</title>

Sent via pgsql-hackers mailing list (
To make changes to your subscription:

Reply via email to