Fix recently-understood problems with handling of XID freezing, particularly

in PITR scenarios.  We now WAL-log the replacement of old XIDs with
FrozenTransactionId, so that such replacement is guaranteed to propagate to
PITR slave databases.  Also, rather than relying on hint-bit updates to be
preserved, pg_clog is not truncated until all instances of an XID are known to
have been replaced by FrozenTransactionId.  Add new GUC variables and
pg_autovacuum columns to allow management of the freezing policy, so that
users can trade off the size of pg_clog against the amount of freezing work
done.  Revise the already-existing code that forces autovacuum of tables
approaching the wraparound point to make it more bulletproof; also, revise the
autovacuum logic so that anti-wraparound vacuuming is done per-table rather
than per-database.  initdb forced because of changes in pg_class, pg_database,
and pg_autovacuum catalogs.  Heikki Linnakangas, Simon Riggs, and Tom Lane.

src/backend/utils/init/flatfiles.c

@@ -23,7 +23,7 @@
  * Portions Copyright (c) 1996-2006, PostgreSQL Global Development Group
  * Portions Copyright (c) 1994, Regents of the University of California
  *
- * $PostgreSQL: pgsql/src/backend/utils/init/flatfiles.c,v 1.21 2006/07/14 14:52:25 momjian Exp $
+ * $PostgreSQL: pgsql/src/backend/utils/init/flatfiles.c,v 1.22 2006/11/05 22:42:09 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -163,7 +163,7 @@ name_okay(const char *str)
 /*
  * write_database_file: update the flat database file
  *
- * A side effect is to determine the oldest database's datminxid
+ * A side effect is to determine the oldest database's datfrozenxid
  * so we can set or update the XID wrap limit.
  */
 static void
@@ -177,7 +177,7 @@ write_database_file(Relation drel)
 	HeapScanDesc scan;
 	HeapTuple	tuple;
 	NameData	oldest_datname;
-	TransactionId oldest_datminxid = InvalidTransactionId;
+	TransactionId oldest_datfrozenxid = InvalidTransactionId;
 
 	/*
 	 * Create a temporary filename to be renamed later.  This prevents the
@@ -208,27 +208,23 @@ write_database_file(Relation drel)
 		char	   *datname;
 		Oid			datoid;
 		Oid			dattablespace;
-		TransactionId datminxid,
-					datvacuumxid;
+		TransactionId datfrozenxid;
 
 		datname = NameStr(dbform->datname);
 		datoid = HeapTupleGetOid(tuple);
 		dattablespace = dbform->dattablespace;
-		datminxid = dbform->datminxid;
-		datvacuumxid = dbform->datvacuumxid;
+		datfrozenxid = dbform->datfrozenxid;
 
 		/*
-		 * Identify the oldest datminxid, ignoring databases that are not
-		 * connectable (we assume they are safely frozen).	This must match
+		 * Identify the oldest datfrozenxid.  This must match
 		 * the logic in vac_truncate_clog() in vacuum.c.
 		 */
-		if (dbform->datallowconn &&
-			TransactionIdIsNormal(datminxid))
+		if (TransactionIdIsNormal(datfrozenxid))
 		{
-			if (oldest_datminxid == InvalidTransactionId ||
-				TransactionIdPrecedes(datminxid, oldest_datminxid))
+			if (oldest_datfrozenxid == InvalidTransactionId ||
+				TransactionIdPrecedes(datfrozenxid, oldest_datfrozenxid))
 			{
-				oldest_datminxid = datminxid;
+				oldest_datfrozenxid = datfrozenxid;
 				namestrcpy(&oldest_datname, datname);
 			}
 		}
@@ -244,14 +240,14 @@ write_database_file(Relation drel)
 		}
 
 		/*
-		 * The file format is: "dbname" oid tablespace minxid vacuumxid
+		 * The file format is: "dbname" oid tablespace frozenxid
 		 *
 		 * The xids are not needed for backend startup, but are of use to
 		 * autovacuum, and might also be helpful for forensic purposes.
 		 */
 		fputs_quote(datname, fp);
-		fprintf(fp, " %u %u %u %u\n",
-				datoid, dattablespace, datminxid, datvacuumxid);
+		fprintf(fp, " %u %u %u\n",
+				datoid, dattablespace, datfrozenxid);
 	}
 	heap_endscan(scan);
 
@@ -272,10 +268,10 @@ write_database_file(Relation drel)
 						tempname, filename)));
 
 	/*
-	 * Set the transaction ID wrap limit using the oldest datminxid
+	 * Set the transaction ID wrap limit using the oldest datfrozenxid
 	 */
-	if (oldest_datminxid != InvalidTransactionId)
-		SetTransactionIdLimit(oldest_datminxid, &oldest_datname);
+	if (oldest_datfrozenxid != InvalidTransactionId)
+		SetTransactionIdLimit(oldest_datfrozenxid, &oldest_datname);
 }
 
 

src/backend/utils/init/postinit.c

@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/utils/init/postinit.c,v 1.171 2006/10/04 00:30:02 momjian Exp $
+ *	  $PostgreSQL: pgsql/src/backend/utils/init/postinit.c,v 1.172 2006/11/05 22:42:09 tgl Exp $
  *
  *
  *-------------------------------------------------------------------------
@@ -77,7 +77,7 @@ FindMyDatabase(const char *name, Oid *db_id, Oid *db_tablespace)
 	char	   *filename;
 	FILE	   *db_file;
 	char		thisname[NAMEDATALEN];
-	TransactionId dummyxid;
+	TransactionId db_frozenxid;
 
 	filename = database_getflatfilename();
 	db_file = AllocateFile(filename, "r");
@@ -87,8 +87,7 @@ FindMyDatabase(const char *name, Oid *db_id, Oid *db_tablespace)
 				 errmsg("could not open file \"%s\": %m", filename)));
 
 	while (read_pg_database_line(db_file, thisname, db_id,
-								 db_tablespace, &dummyxid,
-								 &dummyxid))
+								 db_tablespace, &db_frozenxid))
 	{
 		if (strcmp(thisname, name) == 0)
 		{

src/backend/utils/misc/guc.c

@@ -10,7 +10,7 @@
  * Written by Peter Eisentraut <peter_e@gmx.net>.
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.357 2006/10/19 18:32:47 tgl Exp $
+ *	  $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.358 2006/11/05 22:42:09 tgl Exp $
  *
  *--------------------------------------------------------------------
  */
@@ -1330,6 +1330,15 @@ static struct config_int ConfigureNamesInt[] =
 		0, 0, INT_MAX, NULL, NULL
 	},
 
+	{
+		{"vacuum_freeze_min_age", PGC_USERSET, CLIENT_CONN_STATEMENT,
+			gettext_noop("Minimum age at which VACUUM should freeze a table row."),
+			NULL
+		},
+		&vacuum_freeze_min_age,
+		100000000, 0, 1000000000, NULL, NULL
+	},
+
 	{
 		{"max_fsm_relations", PGC_POSTMASTER, RESOURCES_FSM,
 			gettext_noop("Sets the maximum number of tables and indexes for which free space is tracked."),
@@ -1576,6 +1585,15 @@ static struct config_int ConfigureNamesInt[] =
 		&autovacuum_anl_thresh,
 		250, 0, INT_MAX, NULL, NULL
 	},
+	{
+		/* see varsup.c for why this is PGC_POSTMASTER not PGC_SIGHUP */
+		{"autovacuum_freeze_max_age", PGC_POSTMASTER, AUTOVACUUM,
+			gettext_noop("Age at which to autovacuum a table to prevent transacion ID wraparound."),
+			NULL
+		},
+		&autovacuum_freeze_max_age,
+		200000000, 100000000, 2000000000, NULL, NULL
+	},
 
 	{
 		{"tcp_keepalives_idle", PGC_USERSET, CLIENT_CONN_OTHER,

src/backend/utils/misc/postgresql.conf.sample

@@ -373,6 +373,8 @@
 					# vacuum
 #autovacuum_analyze_scale_factor = 0.1	# fraction of rel size before 
 					# analyze
+#autovacuum_freeze_max_age = 200000000	# maximum XID age before forced vacuum
+					# (change requires restart)
 #autovacuum_vacuum_cost_delay = -1	# default vacuum cost delay for 
 					# autovacuum, -1 means use 
 					# vacuum_cost_delay
@@ -394,6 +396,7 @@
 #default_transaction_isolation = 'read committed'
 #default_transaction_read_only = off
 #statement_timeout = 0			# 0 is disabled
+#vacuum_freeze_min_age = 100000000
 
 # - Locale and Formatting -
 

src/backend/utils/time/tqual.c

@@ -32,7 +32,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/utils/time/tqual.c,v 1.98 2006/10/04 00:30:04 momjian Exp $
+ *	  $PostgreSQL: pgsql/src/backend/utils/time/tqual.c,v 1.99 2006/11/05 22:42:09 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -1099,9 +1099,11 @@ HeapTupleSatisfiesVacuum(HeapTupleHeader tuple, TransactionId OldestXmin,
 	{
 		/*
 		 * "Deleting" xact really only locked it, so the tuple is live in any
-		 * case.  However, we must make sure that either XMAX_COMMITTED or
-		 * XMAX_INVALID gets set once the xact is gone; otherwise it is unsafe
-		 * to recycle CLOG status after vacuuming.
+		 * case.  However, we should make sure that either XMAX_COMMITTED or
+		 * XMAX_INVALID gets set once the xact is gone, to reduce the costs
+		 * of examining the tuple for future xacts.  Also, marking dead
+		 * MultiXacts as invalid here provides defense against MultiXactId
+		 * wraparound (see also comments in heap_freeze_tuple()).
 		 */
 		if (!(tuple->t_infomask & HEAP_XMAX_COMMITTED))
 		{