"Mikheev, Vadim" <vmikheev@SECTORBASE.COM> writes:
>> That'll be true in any case, unless we refuse to start up at all upon
>> detecting xlog corruption (which doesn't seem like the way to fly).
>> Not sure what we can do about that.
> What I would refuse in the event of log corruption is continuing
> normal database operations.
Hmm. We could do that if we had some notion of a read-only operating
mode, perhaps. But we don't have one now and I don't want to add it
for 7.1. Can we agree to look at this more for 7.2?
If we did have that, it would make sense to scan the rest of the log
(after the last valid XLOG record) to see if we find any more records.
If we do then --- whether they're valid or not --- we have a corrupted
DB and we should go into the read-only state. But for the moment I
think it's best not to make such a scan.
regards, tom lane