From 87a53d0dc0e2118c553110813209eba55174bb1e Mon Sep 17 00:00:00 2001
From: David Steele <david@pgmasters.net>
Date: Wed, 20 Mar 2019 16:16:37 +0400
Subject: [PATCH] Add exclusive backup deprecation notes to documentation.

Update the exclusive backup documentation to explain the limitations of
the exclusive backup mode and make it clear that the feature is
deprecated.

Update the log message when the backup_label is found but recovery
cannot proceed.
---
 doc/src/sgml/backup.sgml          | 46 +++++++++++++++++++++++++++++++
 src/backend/access/transam/xlog.c | 10 +++++--
 2 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/doc/src/sgml/backup.sgml b/doc/src/sgml/backup.sgml
index a73fd4d044..ab5c81d382 100644
--- a/doc/src/sgml/backup.sgml
+++ b/doc/src/sgml/backup.sgml
@@ -948,6 +948,17 @@ SELECT * FROM pg_stop_backup(false, true);
    </sect3>
    <sect3 id="backup-lowlevel-base-backup-exclusive">
     <title>Making an exclusive low level backup</title>
+
+    <note>
+     <para>
+      The exclusive backup method is deprecated and should be avoided in favor
+      of the non-exclusive backup method, e.g.
+      <application>pg_basebackup</application>.  This method is deprecated
+      because it has serious risks which are enumerated at the end of this
+      section.
+     </para>
+    </note>
+
     <para>
      The process for an exclusive backup is mostly the same as for a
      non-exclusive one, but it differs in a few key steps. This type of backup
@@ -1054,6 +1065,41 @@ SELECT pg_stop_backup();
    </listitem>
   </orderedlist>
     </para>
+
+    <note>
+     <para>
+      The primary issue with the exclusive method is that the
+      <filename>backup_label</filename> file is written into the data directory
+      when <function>pg_start_backup</function> is called and remains until
+      <function>pg_stop_backup</function> is called.  If
+      <productname>PostgreSQL</productname> or the host terminates abnormally,
+      then <filename>backup_label</filename> will be left in the data directory
+      and <productname>PostgreSQL</productname> probably will not start. A log
+      message recommends that <filename>backup_label</filename> be removed if
+      not restoring from a backup.
+     </para>
+
+     <para>
+      However, if <filename>backup_label</filename> is present because a restore
+      is actually in progress, then removing it will result in corruption.  For
+      this reason it is not recommended to automate the removal of
+      <filename>backup_label</filename>.
+     </para>
+
+     <para>
+      Another issue with exclusive backup mode is that it will continue until
+      <function>pg_stop_backup</function> is called, even if the calling process
+      is no longer performing the backup.  The next time
+      <function>pg_start_backup</function> is called it will fail unless
+      <function>pg_stop_backup</function> is called manually first.
+     </para>
+
+     <para>
+      Finally, only one exclusive backup may be run at a time.  However, it is
+      possible to run an exclusive backup at the same time as any number of
+      non-exclusive backups.
+     </para>
+    </note>
    </sect3>
    <sect3 id="backup-lowlevel-base-backup-data">
    <title>Backing up the data directory</title>
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index ad12ebc426..3bb1e406e1 100644
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -6365,14 +6365,20 @@ StartupXLOG(void)
 				if (!ReadRecord(xlogreader, checkPoint.redo, LOG, false))
 					ereport(FATAL,
 							(errmsg("could not find redo location referenced by checkpoint record"),
-							 errhint("If you are not restoring from a backup, try removing the file \"%s/backup_label\".", DataDir)));
+							 errhint("If you are restoring from a backup, touch \"%s/recovery.signal\" and add required recovery options.\n"
+							 "If you are not restoring from a backup, try removing the file \"%s/backup_label\".\n"
+							 "Be careful: removing \"%s/backup_label\" will result in a corrupt cluster if restoring from a backup.",
+							 DataDir, DataDir, DataDir)));
 			}
 		}
 		else
 		{
 			ereport(FATAL,
 					(errmsg("could not locate required checkpoint record"),
-					 errhint("If you are not restoring from a backup, try removing the file \"%s/backup_label\".", DataDir)));
+					 errhint("If you are restoring from a backup, touch \"%s/recovery.signal\" and add required recovery options.\n"
+							 "If you are not restoring from a backup, try removing the file \"%s/backup_label\".\n"
+							 "Be careful: removing \"%s/backup_label\" will result in a corrupt cluster if restoring from a backup.",
+							 DataDir, DataDir, DataDir)));
 			wasShutdown = false;	/* keep compiler quiet */
 		}
 
-- 
2.17.2 (Apple Git-113)