http://www.slony.info/bugzilla/show_bug.cgi?id=335

           Summary: Disable node on failed node event
           Product: Slony-I
           Version: devel
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: enhancement
          Priority: low
         Component: slon
        AssignedTo: slony1-bugs at lists.slony.info
        ReportedBy: janwieck at yahoo.com
                CC: slony1-bugs at lists.slony.info
   Estimated Hours: 0.0


Currently there is a possibility that a failed node can process the FAILED_NODE
event for itself and even make it to the DROP_NODE, in which case it will drop
it's own Slony schema. This can contain vital information like missing sl_log
data that hadn't replicated.

The current proposal is to disable the node by setting no_active=False on
FAILED_NODE processing, then terminate slon. slon checks that flag (or should
do so) and refuses to start if it is set.

We further should add a unique identifier like a UUID to sl_node. The remote
listener will check on startup that the value in the for it's entry in the
event provider is the same and refuse to work if it is not. This will prevent
that a temporary failed node will process bogus data after a "DROP NODE, STORE
NODE" sequence had happened while it was failed if it never received any of
those or the FAILED_NODE event.

-- 
Configure bugmail: http://www.slony.info/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
You are the assignee for the bug.