So… it’s not durable? Durable doesn’t mean “survives a process restart”, it means “durably saved to persistent storage”. For example, this “durable” mode wouldn’t survive power loss.
Pretty much... paranoid() seems to be the real durable() which isn't a great look for a database project.
Being able to recover a db without corruption beyound losing the last few writes is a pretty useful feature, and buys a lot of performance, but it would be better to label that clearly, as a reasonable expectation on the durable() preset would be for it to be Durable.
As of a couple years ago, mmap actually has a MAP_SYNC flag that makes it durable in the DB sense. The caveat is that it requires DAX on the file and so comes with a whole bunch of restrictions w.r.t. filesystem, storage media and even CPU architecture.
You're right, that mode provides process crash recovery, not power-loss durability. The benchmark compares it against fjall’s equivalent buffered-WAL mode.
Word choice matters. Defaults matter. People will go "well it says durable right here" and while arguably, yes, they should RTFM, it would still be great if tool-builders did not set the shotgun's default state to State::AT_FOOT. It would be nice if every paragraph of technical writing that I have to do need not be burdened by a thousand asterisks of "durable in this context means something other than durable".
Agreed. Good design is when the things do what you expect them to do without reading the manual, don't reuse wording with other meaning in the wrong way. That way if you do encounter nee wording, you know you should read the manual.
Indeed, a common enough pattern for etcd is to run it backed by a RAMdisk and have multi-az availability + periodic backups + tolerance at a business level to be OK losing some recent data.
I give a little leeway to distributed systems that replicate and don't flush since there's a bit of middle ground assuming they're in different fault domains. Garage object storage defaults to that
However, this doesn't appear to be the case here...
Unsurprisingly, performance goes to crap when sync is enabled.
Absolutely. If they just dirty some pages in memory and return back to the client the benchmarks will look "insanely fast".
I have nothing against this being a non-default option in a db/kv engine but anything advertising to be durable and not fsyncing by default is something I would stay away from. To me it's like a litmus test of how well the author knows/cares data durability and not destroying users data.
durable() syncs periodically on flush, WAL rotation, and clean close; paranoid() is the sync-before-ack mode. This is clarified in the README, and the benchmarks report all three modes separately. Other KV-stores that you see on the market, do this too. It's a performance tradeoff most applications make. Sync on every write kills every optimization. See the benchmark table for example.
Is fsync needed for every write in all projects?
I am willing to trade database speed for the loss of the last written data within a 1-10ms window once or twice a year for non-financial and other non-critical data. So, power loss shouldn't be such a frequent event when there are active transactions at that moment, right?
> Appended to the WAL without a per-write sync
So… it’s not durable? Durable doesn’t mean “survives a process restart”, it means “durably saved to persistent storage”. For example, this “durable” mode wouldn’t survive power loss.