July 5, 2023 - It has sometimes been referred to as "fsyncgate 2018". ... As of this PostgreSQL 12 commit, PostgreSQL will now PANIC on fsync() failure. It was backpatched to PostgreSQL 11, 10, 9.6, 9.5 and 9.4.

Postgres expected the OS to retry flushing data from the cache to disk if an error occurred during the previous fsync call.

April 15, 2023 - We can blame Postgres for not handling this case properly, but I think the design of fsync bears just as much blame here. A write completion callback (as suggested upthread) would be a much more sensible and intuitive way to pass write errors back to the database.

On May 22, 2015, the PostgreSQL project released a set of updates to all supported versions of PostgreSQL. One of the fixes included in this batch of updates forced fsyncing of all PostgreSQL files on a restart after a crash.

February 14, 2019 - I patched my own systems (wrap the calls in a loop as per standard practice) and then proceeded to run literally hundreds of thousands of PostgreSQL instances on NFS for many more years with no problems · The patch was eventually integrated it seems but I never found out why because I lost ...

February 10, 2024 - The reason is that writes to storage from the page cache are completely managed by the kernel, and not by PostgreSQL. This could still be fine if the next fsync retries flushing of the dirty page. But, in reality, the data is discarded from the page cache upon an error with fsync.

April 18, 2018 - Craig Ringer first reported the problem to the pgsql-hackers mailing list at the end of March. In short, PostgreSQL assumes that a successful call to fsync() indicates that all data written since the last successful call made it safely to persistent storage. But that is not what the kernel ...

July 21, 2019 - because the disk was idle), and something went wrong, that error would be lost; that bug has since been fixed, in Linux 4.13. Once that was fixed, the main remaining issue that affected PostgreSQL (and is also relevant for a few other programs, like dpkg, which are trying to allow for write failures in some other program) is that its "open, write, close, open, fsync, close" strategy failed because fsync() only reported errors that occurred since the file was opened (which IMO is a reasonable API, but some of the PostgreSQL developers disagreed).

April 6, 2026 - PostgreSQL assumed the data was safely persisted, proceeded to truncate the WAL -- and the data was lost. Craig Ringer’s conclusion was straightforward: Pg should PANIC on fsync() EIO return.

April 24, 2018 - But then we retried the checkpoint, which retried the fsync(). The retry succeeded, because the prior fsync() cleared the AS_EIO bad page flag." More replies ... Because many things people assume to be safe would be broken otherwise. Take Andres's example of untaring a database backup and then running sync to make sure everything is persisted on disk. Maybe people, including the PostgreSQL team, need to change their expectations for what works when there are IO errors, but I also suspect that we need more convenient kernel APIs.

August 31, 2025 - This means that when PG retries the checkpointing process, the fsync operation returns back a success response. This results in an error where the checkpointing returns back a success response without actually writing the data to the disk, thus ...

May 24, 2018 - This is ok when everything goes well because the writes since the last checkpoints are protected by the Write Ahead Logging, where fsync() occurs for each writes at commit (if you didn’t change the default parameters for WAL). But when a problem occurs, such as power outage, some writes may be lost, or partially lost, and that’s not easy to detect at checkpoint time with fsync().

Some time ago I ran into an issue where a user encountered data corruption after a storage error. PostgreSQL played a part in that corruption by allowing checkpoint what should've been a fatal error. TL;DR: Pg should PANIC on fsync() EIO return. Retrying fsync() is not OK at least on Linux.

Some time ago I ran into an issue where a user encountered data corruption after a storage error. PostgreSQL played a part in that corruption by allowing checkpoint what should've been a fatal error. TL;DR: Pg should PANIC on fsync() EIO return. Retrying fsync() is not OK at least on Linux.

February 15, 2019 - Bug reference: 15636 Logged by: John Klann Email address: jk7255(at)gmail(dot)com PostgreSQL version: 11.1 Operating system: Red Hat Enterprise Linux Server release 7.5 Description: Issue: - PostgreSQL 11.1 pg_basebackup and pg_dump parallel database backup to a CIFS destination throws fsync error at the very end of the backup.

Thirdly I'll try to sum up what postgres needs to change. == Current Situation == The fundamental problem is that postgres assumed that any IO error would be reported at fsync time, and that the error would be reported until resolved.

April 2, 2018 - Keep dirty buffers in the application and redo the writes on fsync failure (meaning all writes need to be buffered twice). PostgreSQL should in theory be able to rebuild the writes from WAL, but that sounds like a mess.

April 2, 2018 - The discussion is a little clearer about a successful retried fsync not writing out those newly "clean" pages, either, leaving them to flutter away, too. There really isn't anything an app can do with 100% reliability in this situation. That's why the only option seems to be panic, or rely on the OS to panic (e.g. by making the file system read only). If it was a transient error, PostgreSQL can recover using the WAL.

February 26, 2019 - Or an early recap of the "fsyncgate" issue in textual form: https://lwn.net/Articles/752063/ · Related (also listed by Tomas Vondra): Linux's IO errors reporting https://youtu.be/74c19hwY2oE