Don't intercept SIGQUIT as a signal to trigger failover; that's what

hlinnaka · hlinnaka · commit 47ce59550229 · 2009-03-18T19:27:28.000Z
postmaster uses for immediate shutdown. Trap SIGUSR1 as the preferred
signal for that.

Per report by Fujii Masao and subsequent discussion on -hackers.
diff --git a/contrib/pg_standby/pg_standby.c b/contrib/pg_standby/pg_standby.c
@@ -1,5 +1,5 @@
 /*
- * $PostgreSQL: pgsql/contrib/pg_standby/pg_standby.c,v 1.18 2009/02/27 09:30:21 petere Exp $ 
+ * $PostgreSQL: pgsql/contrib/pg_standby/pg_standby.c,v 1.19 2009/03/18 19:27:28 heikki Exp $ 
  *
  *
  * pg_standby.c
@@ -463,6 +463,15 @@ sighandler(int sig)
 	signaled = true;
 }
 
+/* We don't want SIGQUIT to core dump */
+static void
+sigquit_handler(int sig)
+{
+	signal(SIGINT, SIG_DFL);
+	kill(getpid(), SIGINT);
+}
+
+
 /*------------ MAIN ----------------------------------------*/
 int
 main(int argc, char **argv)
@@ -485,8 +494,21 @@ main(int argc, char **argv)
 		}
 	}
 
-	(void) signal(SIGINT, sighandler);
-	(void) signal(SIGQUIT, sighandler);
+	/*
+	 * You can send SIGUSR1 to trigger failover.
+	 *
+	 * Postmaster uses SIGQUIT to request immediate shutdown. The default
+	 * action is to core dump, but we don't want that, so trap it and
+	 * commit suicide without core dump.
+	 *
+	 * We used to use SIGINT and SIGQUIT to trigger failover, but that
+	 * turned out to be a bad idea because postmaster uses SIGQUIT to
+	 * request immediate shutdown. We still trap SIGINT, but that may
+	 * change in a future release.
+	 */
+	(void) signal(SIGUSR1, sighandler);
+	(void) signal(SIGINT, sighandler); /* deprecated, use SIGUSR1 */
+	(void) signal(SIGQUIT, sigquit_handler);
 
 	while ((c = getopt(argc, argv, "cdk:lr:s:t:w:")) != -1)
 	{
