Comment by hadlock | Hacker News Reader

Comment by hadlock | Hacker News Reader

One thing that's sorely needed in the official documentation is a "best practice" for backup/restore from "cold and dark" where you lose your main db in a fire and are now restoring from offsite backups for business continuity. Particularly in the 100-2TB range where probably most businesses lie, and backup/restore can take anywhere from 6 to 72 hours, often in less than ideal conditions. Like many things with SQL there's many ways to do it, but an official roadmap for order of operations would be very useful for backup/restore of roles/permissions, schema etc. You will figure it out eventually, but in my experience the dev and prod db size delta is so large many things that "just work" in the sub-1gb scale really trip you up over 200-500gb. Finding out you did one step out of order (manually, or badly written script) halfway through the restore process can mean hours and hours of rework. Heaven help you if you didn't start a screen session on your EC2 instance when you logged in.

What we do, is automated restores. We have a _hourly and an _daily restore that just happens via shell script.

We encourage staff to play with both, and they can play with impunity since it's a copy that will get replaced soon-ish.

This makes it important that both work reliably, which means we know when our backups stop working.

We haven't had a disaster recovery situation yet(hopefully never), but I feel fairly confident that getting the DB back shouldn't be a big deal.

Yes but did you have to write your own, or did you pull it from an official repo? I'm all for customizing things but we're a long, long ways from pg8.0, something besides the bare bones official pgdump and pgrestore binaries with their very agnostic and vanilla man pages would be tremendously useful.

Agreed. We use barman[0] and some shell.

0: https://pgbarman.org

Ideally off-site replica you fail over too and don't need to restore.

pg_restore will handle roles, indexes, etc assuming you didn't switch the flags around to disable them

If you're on EC2, hopefully you're using disk snapshots and WAL archiving.

Of course that’s preferable, but OP is specifically asking about the cold restore case, which tends to pose different problems, and is just as important to maintain and test.

Offsite replica is only applicable if the cause is a failure of the primary. What if I’m restoring a backup because someone accidentally dropped the wrong table?

I would hope dropping a table on a production database is something that is code reviewed

nah, on a long enough timeline everything will go wrong. blaming the person who managed to drop the table finally is dumb: if you can't fix literally everything that could happen to it, it's not done.

Isn't the entirety of disaster recovery about situations that aren't supposed to happen?

High availability is different from disaster recovery

You can PITR on a replica which would be much faster than restoring a full backup of a large DB

DROP DATABASE :-)

Postgres is not great with off-site replicas, unless not many writes are done. Replication protocol is very chatty. One of the reasons Uber mentioned when moving to mysql in their engineering blog.

> One of the reasons Uber mentioned when moving to mysql in their engineering blog

If I'm not mistaken, this was in 2016 (that's 10 years next year, time flies when you're having fun) -- which is practically an eternity in IT. I'm no DBA but I'm fairly sure many changes have been made to Postgres since then, including logical replication (which can be selective), parallel apply of large transactions in v16, and so on.

I'm not saying this means their points are invalid, I don't know Postgres well enough for that, but any point made almost 10 years ago against one of the most popular and most actively developed options in its field should probably be taken with a pinch of salt.

> I'm not saying this means their points are invalid, I don't know Postgres well enough for that, but any point made almost 10 years ago against one of the most popular and most actively developed options in its field should probably be taken with a pinch of salt.

Heh, I remember the countless articles after that debacle back then pointing out all the reasons why their migration was entirely pointless and could've been summed up to "devs not knowing the tools they're working with" before starting multi million projects to fuel their cv driven development.

So even if you aren't willing to do so, their rational for the migration was fully debunked even back then

This is oft quoted but if you read the posts, Uber discovered they didn't want SQL (or apparently transactions etc), and implemented a nosql that happened to use mysql as a backend, and that was a much bigger change than moving off PG.

If you can have a secondary database (at another site or on the cloud) being updated with streaming replication, you can switch over very quickly and with little fuss.

Which is what you must do if minimizing downtime is critical.

And, of course, your disaster recovery plan is incomplete until you've tested it (at scale). You don't want to be looking up Postgres documentation when you need to restore from a cold backup, you want to be following the checklist you have in your recovery plan and already verified.

Sure, but there are lots of failure modes where the failure goes with the streaming replication and all instances are trashed.

There needs to be a DBA version of the saying, "RAID is not a backup"

Just expand RAID to "Replicas At Independent Datacenters".

While I totally agree here, replication/raid vs backups, I must say that having some weak (in terms of HW resources) replica somewhere in the closet is much much better than system with just single master.

It's not, but they complement each other nicely.

> in the 100-2TB range where probably most businesses lie

Assuming you mean that range to start at 100GB, I've worked with databases that size multiple times but as a freelancer it's definitely not been "most" businesses in that range.

What then? My 10 year old SaaS is only at about 200MB compressed.

It’s one of the area where Postgres docs are light.

I don’t remember they have a similar doc for setting up HA.

Reply on news.ycombinator.com