<p>This user guide is intended to be followed sequentially from beginning to end &mdash; each section depends on the last. For example the <linkpage="#backup">Backup</link> section relies on setup that is performed in the <linkpage="#quickstart">Quick Start</link> section. Once you have <backrest/> up and running it possible to skip around but it is recommended to follow the user guide in order the first time through.</p>
<p>Although the examples are targeted at Ubuntu and <postgres/> 9.4 they will also work fine on Debian and it should be fairly easy to apply this guide to any Unix distribution and <postgres/> version. The only OS-specific commands are those to create, start, stop, and drop <postgres/> clusters. The <backrest/> commands will be the same on any Unix system though the locations to install Perl libraries and executables may vary. Configuring archiving is different on <postgres/> versions &lt;= 8.4 and configuration information can be found in the <postgres/> documentation.</p>
<p>A somewhat novel approach is taken to documentation in this user guide. Each command is run on a virtual machine when the documentation is built from the XML source. This means you can have a high confidence that the commands work correctly in the order presented. Output is captured and displayed below the command when appropriate. If the output is not included it is because it was deemed not relevant or was considered a distraction from the narrative.</p>
<p>All commands are intended to be run as an unprivileged user that has sudo privileges for both the <user>root</user> and <user>postgres</user> users. It's also possible to run the commands directly as their respective users without modification though in that case you can also strip off the <cmd>sudo</cmd> commands if you like.</p>
</section>
<!-- SECTION => CONCEPTS -->
<sectionid="concept">
<title>Concepts</title>
<p>The following concepts are defined as they are relevant to <backrest/>, <postgres/>, and this user guide.</p>
<!-- SECTION => CONCEPTS - BACKUP -->
<sectionid="backup">
<title>Backup</title>
<p>A backup is a consistent copy of a database cluster that can be restored to recover from a hardware failure, to perform Point-In-Time Recovery, or to bring up a new replica.</p>
<p><b>Full Backup</b>: <backrest/> copies the entire contents of the database cluster to the backup server. The first backup of the database cluster is always a Full Backup. <backrest/> is always able to restore a full backup directly. The full backup does not depend on any files outside of the full backup for consistency.</p>
<p><b>Differential Backup</b>: <backrest/> copies only those database cluster files that have changed since the last full backup. <backrest/> restores a differential backup by copying all of the files in the chosen differential backup and the appropriate unchanged files from the previous full backup. The advantage of a differential backup is that it requires less disk space than a full backup, however, the differential backup and the full backup must both be valid to restore the differential backup.</p>
<p><b>Incremental Backup</b>: <backrest/> copies only those database cluster file that have changed since the last backup (which can be another incremental backup, a differential backup, or a full backup). As an incremental backup only includes those files changed since the prior backup, they are generally much smaller than full or differential backups. As with the differential backup, the incremental backup depends on other backups to be valid to restore the incremental backup. Since the incremental backup includes only those files since the last backup, all prior incremental backups back to the prior differential, the prior differential backup, and the prior full backup must all be valid to perform a restore of the incremental backup. If no differential backup exists then all prior incremental backups back to the prior full backup, which must exist, and the full backup itself must be valid to restore the incremental backup.</p>
</section>
<!-- SECTION => CONCEPTS - RESTORE -->
<sectionid="restore">
<title>Restore</title>
<p>A restore is the act of copying a backup to a system where it will be started as a live database cluster. A restore requires the backup files and one or more WAL segments in order to work correctly.</p>
</section>
<!-- SECTION => CONCEPTS - WAL -->
<sectionid="wal">
<title>Write Ahead Log (WAL)</title>
<p>WAL is the mechanism by which <postgres/> ensures that no committed changes are lost. Transactions are written sequentially to the WAL and a transaction is considered to be committed when those writes are flushed to disk. Afterwards, a background process writes the changes into the main database cluster files (also known as the heap). In the event of a crash, the WAL is replayed to make the database consistent.</p>
<p>WAL is conceptually infinite but in practice is broken up into individual 16MB files called segments. WAL segments follow the naming convention <id>0000000100000A1E000000FE</id> where the first 8 hexadecimal digits represent the timeline and the next 16 digits are the WAL segment sequence number.</p>
<p>A valid backup will always include <i>at least</i> one WAL segment even if no writes were made to the database between backups.</p>
</section>
</section>
<!-- SECTION => INSTALLATION -->
<sectionid="installation">
<title>Installation</title>
<p><backrest/> is written in Perl which is included with Ubuntu by default. A few additional modules are required which are all available as packages.</p>
<p><backrest/> should now be properly installed but it is best to check. If any dependencies were missed then you will get an error when running <backrest/> from the command line.</p>
<execute-list>
<title>Make sure the installation worked</title>
<execute>
<exe-cmd>{[backrest-exe]}</exe-cmd>
<exe-user>vagrant</exe-user>
<exe-output/>
</execute>
</execute-list>
</section>
<!-- SECTION => QUICKSTART -->
<sectionid="quickstart">
<title>Quick Start</title>
<p>The Quick Start section will cover basic configuration of <backrest/> and <postgres/> and introduce the <cmd>backup</cmd>, <cmd>restore</cmd>, and <cmd>info</cmd> commands.</p>
<p>You'll need to create a demo cluster to run the example commands in this user guide. This step is optional, but you may need to adjust commands in the user guide to work with your environment if you choose not to create the demo cluster.</p>
<p>Demo describes the purpose of this cluster accurately so that will also make a good stanza name.</p>
<p><backrest/> needs to know where the base data directory for the <postgres/> cluster is located. The path can be requested from <postgres/> directly but in a recovery scenario the <postgres/> process will not be available. During backups the value supplied to <backrest/> will be compared against the path that <postgres/> is running on and they must be equal or the backup will return an error. Make sure that <br-option>db-path</br-option> is exactly equal to <pg-option>data_directory</pg-option> in <file>postgresql.conf</file>.</p>
<p>By default Ubuntu stores clusters in <path>/var/lib/postgresql/[VERSION]/[CLUSTER-NAME]</path> so it is easy to determine the correct path for the data directory.</p>
<backrest-configfile="{[backrest-config-demo]}">
<title>Configure the <postgres/> cluster data directory</title>
<p>For this simple configuration the repository will be stored on the same host as the <postgres/> server. This is the simplest configuration and is useful in cases where external backup software is employed to backup the database host.</p>
<p>The <pg-option>wal_level</pg-option> setting must be set to <pg-setting>archive</pg-setting> at a minimum but <pg-setting>hot_standby</pg-setting> and <pg-setting>logical</pg-setting> also work fine for backups. Setting <pg-option>wal_level</pg-option> to <pg-setting>hot_standy</pg-setting> is a good idea even if you do not currently run a hot standby since one can be added later without restarting the primary cluster.</p>
<p>The <postgres/> cluster must be restarted after making these changes and before performing a backup.</p>
<execute-list>
<title>Restart the {[postgres-cluster-demo]} cluster</title>
<p>By default <backrest/> will attempt to perform an incremental backup. However, an incremental backup must be based on a full backup and since no full backup existed <backrest/> ran a full backup instead.</p>
<p>The <br-option>type</br-option> option can be used to specify and full or differential backup.</p>
<execute-list>
<title>Differential backup of the {[postgres-cluster-demo]} cluster</title>
<p>This time there was no warning because a full backup already existed. Like incremental backups, differential backups must be based on a full backup. An incremental backup can be performed by running the <cmd>backup</cmd> command with <br-setting>{[dash]}-type=incr</br-setting>.</p>
<p>Use the <cmd>info</cmd> command to get information about backups.</p>
<execute-list>
<title>Get info for the {[postgres-cluster-demo]} cluster</title>
<p>The oldest and newest backups are shown in the info output. The oldest backup will <i>always</i> be a full backup (indicated by an <id>F</id> at the end of the label) but the newest backup can be full, differential (ends with <id>D</id>), or incremental (ends with <id>I</id>).</p>
<p>More information about the <cmd>backup</cmd> command can be found in the <linkpage="#backup">Backup</link> section.</p>
</section>
<!-- SECTION => QUICKSTART - PERFORM RESTORE -->
<sectionid="perform-restore">
<title>Restore a Backup</title>
<p>Backups can protect you from a number of disaster scenarios, the most common of which are hardware failure and data corruption. The easiest way to simulate data corruption is to remove an important <postgres/> cluster file.</p>
<execute-list>
<title>Stop the {[postgres-cluster-demo]} cluster and delete the <file>pg_control</file> file</title>
<p>To restore a backup of the <postgres/> cluster run <backrest/> with the <cmd>restore</cmd> command. The cluster needs to be stopped (in this case it is already stopped) and all files must be removed from the <postgres/> data directory.</p>
<execute-list>
<title>Remove old files from {[postgres-cluster-demo]} cluster</title>
<p>By default <backrest/> will wait for the next regularly scheduled checkpoint before starting a backup. Depending on the <pg-option>checkpoint_timeout</pg-option> and <pg-option>checkpoint_segments</pg-option> settings in <postgres/> it may be quite some time before a checkpoint completes and the backup can begin.</p>
<execute-list>
<title>Incremental backup of the {[postgres-cluster-demo]} cluster with the regularly scheduled checkpoint</title>
<exe-highlight>backup begins after the next regular checkpoint completes</exe-highlight>
</execute>
</execute-list>
<p>By setting <br-setting>start-fast</br-setting> on the command-line or in <file>{[backrest-config-demo]}</file> an immediate checkpoint is requested and the backup will start more quickly. This is convenient for testing and for ad-hoc backups. For instance, if a backup is being taken at the beginning of a release window it makes no sense to wait for a checkpoint. Since regularly scheduled backups generally only happen once per day it is unlikely that enabling the <br-option>start-fast</br-option> in <file>{[backrest-config-demo]}</file> will negatively affect performance, however for high-volume transactional systems you may want to pass <br-setting>{[dash]}-start-fast</br-setting> on the command-line instead.</p>
<backrest-configfile="{[backrest-config-demo]}">
<title>Enable the <br-option>start-fast</br-option> option</title>
<exe-highlight>backup begins after the requested immediate checkpoint completes</exe-highlight>
</execute>
</execute-list>
</section>
<!-- SECTION => BACKUP - STOP-AUTO -->
<sectionid="option-stop-auto">
<title>Automatic Stop Option</title>
<p>Sometimes <backrest/> will exit unexpectedly and the backup in progress on the <postgres/> cluster will not be properly stopped. <backrest/> exits as quickly as possible when an error occurs so that the cause can be reported accurately and is not masked by another problem that could happen during a more extensive cleanup.</p>
<p>Here an error in intentionally caused by removing repository permissions.</p>
<execute-list>
<title>Revoke write privileges in the <backrest/> repository and attempt a backup</title>
<p>Even when the permissions are fixed <backrest/> will still be unable to perform a backup because the <postgres/> cluster is stuck in backup mode.</p>
<execute-list>
<title>Restore write privileges in the <backrest/> repository and attempt a backup</title>
<p>Enabling the <br-option>stop-auto</br-option> option allows <backrest/> to stop the current backup if it detects that no other <backrest/> backup process is running.</p>
<backrest-configfile="{[backrest-config-demo]}">
<title>Enable the <br-option>stop-auto</br-option> option</title>
<exe-highlight>cluster is already in backup mode|backup begins after the requested immediate checkpoint completes</exe-highlight>
</execute>
</execute-list>
<p>Although useful this feature may not be appropriate when another third-party backup solution is being used to take online backups as <backrest/> will not recognize that the other software is running and may terminate a backup started by that software. However, it would be unusual to run more than one third-party backup solution at the same time so this is not likely to be a problem.</p>
<p>Note that <id>pg_dump</id> and <id>pg_base_backup</id> do not take online backups so are not affected. It is safe to run them in conjunction with <backrest/>.</p>
<p>The <linkpage="#quickstart-perform-restore">restore example</link> in <linkpage="#quickstart">Quick Start</link> performed default recovery, which is to play all the way to the end of the WAL stream. In the case of a hardware failure this is probably the most appropriate action but for data corruption scenarios (whether machine or human in origin) there is a better alternative called Point-in-Time Recovery (PITR).</p>
<p>PITR allows the WAL to be played from the last backup to a specified time, transaction id, or recovery point. For common recovery scenarios time-based recovery is arguably the most useful. A common recovery scenario is to restore a table or data was accidentally dropped or deleted. Recovering a dropped table is more dramatic so that's the example given here but deleted data would be recovered in exactly the same way.</p>
<execute-list>
<title>Create table with very important data</title>
<execute>
<exe-cmd>
psql -c "begin;
create table important_table (message text);
insert into important_table values ('{[test-table-data]}');
<p>It is important to represent the time as reckoned by <postgres/> and to include timezone offsets. This reduces the possibility of unintended timezone conversions and an unexpected recovery result.</p>
<execute-list>
<title>Get time from <postgres/></title>
<execute>
<exe-cmd>
psql -Atc "select current_timestamp"
</exe-cmd>
<exe-var>time-recovery-timestamp</exe-var>
<exe-output/>
</execute>
</execute-list>
<p>Now that the time has been recorded the table is dropped. In practice finding the exact time that the table was dropped is a lot harder than in this example. It may not be possible to find the exact time, but some forensic work should be able to get you close.</p>
<execute-list>
<title>Drop the important table</title>
<execute>
<exe-cmd>psql -c "begin;
drop table important_table;
commit;
select * from important_table;"</exe-cmd>
<exe-output/>
<exe-highlight>does not exist</exe-highlight>
<exe-err-expect>1</exe-err-expect>
</execute>
</execute-list>
<p>Now the restore can be performed with time-based recovery to <id>{[time-recovery-timestamp]}</id> to bring back the missing table.</p>
<execute-list>
<title>Stop <postgres/>, restore the {[postgres-cluster-demo]} cluster to <id>{[time-recovery-timestamp]}</id>, and display <file>recovery.conf</file></title>
<p>The <file>recovery.conf</file> file has been automatically generated by <backrest/> so <postgres/> can be started immediately. Once <postgres/> has finished recovery the table will exist again and can be queried.</p>
<execute-list>
<title>Start <postgres/> and check that the important table exists</title>
<p>The <postgres/> log also contains valuable information. It will indicate the time and transaction where the recovery stopped and also give the time of the last transaction to be applied.</p>
<p>This example was rigged to give the correct result. If a backup after the required time is chosen then <postgres/> will not be able to recover the lost table. <postgres/> can only play forward, not backward. To demonstrate this the important table must be dropped (again).</p>
<execute-list>
<title>Drop the important table (again)</title>
<execute>
<exe-cmd>psql -c "begin;
drop table important_table;
commit;
select * from important_table;"</exe-cmd>
<exe-output/>
<exe-highlight>does not exist</exe-highlight>
<exe-err-expect>1</exe-err-expect>
</execute>
</execute-list>
<p>Now take a new backup and attempt the recovery from the new backup.</p>
<execute-list>
<title>Perform a backup then attempt recovery from that backup</title>
<exe-cmd>psql -c "select * from important_table"</exe-cmd>
<exe-output/>
<exe-highlight>does not exist</exe-highlight>
<exe-err-expect>1</exe-err-expect>
</execute>
</execute-list>
<p>Looking at the log output it's not obvious that recovery failed to restore the table. The key is to look for the presence of the "recovery stopping before..." and "last completed transaction..." log messages. If they are not present then the recovery to the specified point-in-time was not successful.</p>
<execute-list>
<title>Examine the <postgres/> log output to discover the recovery was not successful</title>
<p>Using an earlier backup will allow <postgres/> to play forward to the correct time again. The default behavior for restore is to use the most recent backup but an earlier backup can be specified with the <br-option>--set</br-option> option.</p>
<p>Now the the log output will contain the expected "recovery stopping before..." and "last completed transaction..." messages showing that the recovery was successful.</p>
<execute-list>
<title>Examine the <postgres/> log output for log messages indicating success</title>
