July 5, 2023 - It has sometimes been referred to as "fsyncgate 2018". ... As of this PostgreSQL 12 commit, PostgreSQL will now PANIC on fsync() failure. It was backpatched to PostgreSQL 11, 10, 9.6, 9.5 and 9.4.

April 15, 2023 - We can blame Postgres for not handling this case properly, but I think the design of fsync bears just as much blame here. A write completion callback (as suggested upthread) would be a much more sensible and intuitive way to pass write errors back to the database.

On May 22, 2015, the PostgreSQL project released a set of updates to all supported versions of PostgreSQL. One of the fixes included in this batch of updates forced fsyncing of all PostgreSQL files on a restart after a crash.

February 14, 2019 - I patched my own systems (wrap the calls in a loop as per standard practice) and then proceeded to run literally hundreds of thousands of PostgreSQL instances on NFS for many more years with no problems · The patch was eventually integrated it seems but I never found out why because I lost ...

February 10, 2024 - The reason is that writes to storage from the page cache are completely managed by the kernel, and not by PostgreSQL. This could still be fine if the next fsync retries flushing of the dirty page. But, in reality, the data is discarded from the page cache upon an error with fsync.

Postgres expected the OS to retry flushing data from the cache to disk if an error occurred during the previous fsync call.

April 18, 2018 - Craig Ringer first reported the problem to the pgsql-hackers mailing list at the end of March. In short, PostgreSQL assumes that a successful call to fsync() indicates that all data written since the last successful call made it safely to persistent storage. But that is not what the kernel ...

July 21, 2019 - because the disk was idle), and something went wrong, that error would be lost; that bug has since been fixed, in Linux 4.13. Once that was fixed, the main remaining issue that affected PostgreSQL (and is also relevant for a few other programs, like dpkg, which are trying to allow for write failures in some other program) is that its "open, write, close, open, fsync, close" strategy failed because fsync() only reported errors that occurred since the file was opened (which IMO is a reasonable API, but some of the PostgreSQL developers disagreed).

Thirdly I'll try to sum up what postgres needs to change. == Current Situation == The fundamental problem is that postgres assumed that any IO error would be reported at fsync time, and that the error would be reported until resolved.

Some time ago I ran into an issue where a user encountered data corruption after a storage error. PostgreSQL played a part in that corruption by allowing checkpoint what should've been a fatal error. TL;DR: Pg should PANIC on fsync() EIO return. Retrying fsync() is not OK at least on Linux.

Some time ago I ran into an issue where a user encountered data corruption after a storage error. PostgreSQL played a part in that corruption by allowing checkpoint what should've been a fatal error. TL;DR: Pg should PANIC on fsync() EIO return. Retrying fsync() is not OK at least on Linux.

May 24, 2018 - This is ok when everything goes well because the writes since the last checkpoints are protected by the Write Ahead Logging, where fsync() occurs for each writes at commit (if you didn’t change the default parameters for WAL). But when a problem occurs, such as power outage, some writes may be lost, or partially lost, and that’s not easy to detect at checkpoint time with fsync().

August 31, 2025 - This means that when PG retries the checkpointing process, the fsync operation returns back a success response. This results in an error where the checkpointing returns back a success response without actually writing the data to the disk, thus ...

While turning off fsync is often a performance benefit, this can result in unrecoverable data corruption in the event of a power failure or system crash. Thus it is only advisable to turn off fsync if you can easily recreate your entire database ...

March 28, 2018 - Some time ago I ran into an issue where a user encountered data corruption after a storage error. PostgreSQL played a part in that corruption by allowing checkpoint what should've been a fatal error. TL;DR: Pg should PANIC on fsync() EIO return. Retrying fsync() is not OK at least on Linux.

January 1, 2012 - However, using fsync results in a performance penalty: when a transaction is committed, PostgreSQL must wait for the operating system to flush the write-ahead log to disk. When fsync is disabled, the operating system is allowed to do its best ...

April 24, 2018 - But then we retried the checkpoint, which retried the fsync(). The retry succeeded, because the prior fsync() cleared the AS_EIO bad page flag." More replies ... Because many things people assume to be safe would be broken otherwise. Take Andres's example of untaring a database backup and then running sync to make sure everything is persisted on disk. Maybe people, including the PostgreSQL team, need to change their expectations for what works when there are IO errors, but I also suspect that we need more convenient kernel APIs.

February 11, 2014 - Bug reference: 9190 Logged by: David Vitek Email address: dvitek(at)grammatech(dot)com PostgreSQL version: 9.2.4 Operating system: Windows 8 Description: We had a postgres panic a few weeks ago. Here is a relevant fragment of the postgres log: [2014-01-27 04:57:37 EST 3756] WARNING: pgstat wait timeout ... ... ... [2014-01-27 04:55:36 EST 5804] ERROR: could not access status of transaction 0 [2014-01-27 04:55:42 EST 5804] DETAIL: Could not fsync file "pg_clog/0000": Bad file descriptor.

I'm trying to test a small PostgreSQL setup, so I cobbled together a quick local install. However, when I'm trying to create my personal db with createdb, it chokes on errors like this (notably, it starts with base/16384 the first time, and increments each time I run it).