Re: Re: ALTER SYSTEM SET command to change postgresql.conf parameters (RE: Proposal for Allow postgresql.conf values to be changed via SQL [review])

On Saturday, August 03, 2013 12:53 AM Tom Lane wrote:
> Stephen Frost <sfrost(at)snowman(dot)net> writes:
> > * Josh Berkus (josh(at)agliodbs(dot)com) wrote:
> >> A much simpler solution to the issue Stephen proposes is to have a
> way
> >> to start up the server with all settings from ALTER SYSTEM SET
> disabled,
> >> just like some software allows you to start it up in "safe mode".
>
> > See above for why I'm not thrilled wih this approach, unless it was
> set
> > up to happen automatically, but you couldn't simply ignore *all* the
> > ALTER SYSTEM SET parameters because then you might not be able to
> > connect in due to some ALTER SYSTEM SET parameter being necessary for
> > remote connectivity or authentication.
>
> Yeah, this approach is a nonstarter because there's no reason to assume
> that a postmaster started with default parameters will start
> successfully,
> or will be connectable-to if it does start. Maybe there's another
> postmaster hogging the default port, for instance.

Okay, but user will always have option to start server with different value
of parameter (pg_ctl -o "-p 5434").

Now as a summarization we have below ways to move forward:

1. Provide a way for user to start server if not able to start due to
in-appropriate value of unsafe parameter
a. already user has an option that he can mention value of any particular
parameter with which sever can start
b. keep one backup copy of parameters, so that user can option to start
with that copy, else if that also doesn't work he
can use point 'a'.

2. Don't allow unsafe parameters to be modified by ALTER SYSTEM
a. List of un-safe parameters
b. mechanism so that ALTER SYSTEM throws error for non-modifiable
parameters
c. user can view non-modifiable parameters (may be in pg_settings)
d. some way such that if user wants to take risk of server not getting
started, he should allow to modify such parameters.
may be server is started with some specific option. This can reduce
the fear Josh had regarding this command to be not of much use.

I think if we choose Option-2, then one of the initial difficulty will be to
get an agreement on list of un-safe parameters.
I believe even if we want to go with Option-2, then in first cut the work
should be minimized.

With Regards,
Amit Kapila.