Finalize 4.0.5 release

We need to emphasise that the repmgr packages are only compatible
with packages based on the PGDG filesystem layout; 3rd party vendor
packages often put application and data directories elsewhere.
See e.g. GitHub #427.

FAQ.md

@@ -1,9 +1,7 @@
 FAQ - Frequently Asked Questions about repmgr
 =============================================
 
-The repmgr 4 FAQ is located here:
-
-    https://repmgr.org/docs/appendix-faq.html
+The repmgr 4 FAQ is located here: [repmgr FAQ (Frequently Asked Questions)](https://repmgr.org/docs/4.0/appendix-faq.html "repmgr FAQ")
 
 The repmgr 3.x FAQ can be found here:
 

HISTORY

@@ -1,3 +1,70 @@
+4.0.5   2018-05-02
+        repmgr: poll demoted primary after restart as a standby during a
+          switchover operation; GitHub #408 (Ian)
+        repmgr: add configuration parameter "config_directory"; GitHub #424 (Ian)
+        repmgr: add "dbname=replication" to all replication connection strings;
+          GitHub #421 (Ian)
+        repmgr: add sanity check if --upstream-node-id not supplied when executing
+          "standby register"; GitHub #395 (Ian)
+        repmgr: enable provision of "archive_cleanup_command" in recovery.conf;
+          GitHub #416 (Ian)
+        repmgr: actively check for node to rejoin cluster; GitHub #415 (Ian)
+        repmgr: enable pg_rewind to be used with PostgreSQL 9.3/9.4; GitHub #413 (Ian)
+        repmgr: fix minimum accepted value for "degraded_monitoring_timeout";
+          GitHub #411 (Ian)
+        repmgr: fix superuser password handling; GitHub #400 (Ian)
+        repmgr: fix parsing of "archive_ready_critical" configuration file
+          parameter; GitHub #426 (Ian)
+        repmgr: fix display of conninfo parsing error messages (Ian)
+        repmgr: fix "repmgr cluster crosscheck" output; GitHub #389 (Ian)
+        repmgrd: prevent standby connection handle from going stale (Ian)
+        repmgrd: fix memory leaks in witness code; GitHub #402 (AndrzejNowicki, Martín)
+        repmgrd: handle "pg_ctl promote" timeout; GitHub #425 (Ian)
+        repmgrd: handle failover situation with only two nodes in the primary
+          location, and at least one node in another location; GitHub #407 (Ian)
+        repmgrd: set "connect_timeout=2" when pinging a server (Ian)
+
+4.0.4   2018-03-09
+        repmgr: add "standby clone --recovery-conf-only" option; GitHub #382 (Ian)
+        repmgr: make "standby promote" timeout values configurable; GitHub #387 (Ian)
+        repmgr: improve replication slot warnings generated by "node status";
+          GitHub #385 (Ian)
+        repmgr: remove restriction on replication slots when cloning from
+          a Barman server; GitHub #379 (Ian)
+        repmgr: ensure "node rejoin" honours "--dry-run" option; GitHub #383 (Ian)
+        repmgr: fix --superuser handling when cloning a standby; GitHub #380 (Ian)
+        repmgr: update various help options; GitHub #391, #392 (hasegeli)
+        repmgrd: add event "repmgrd_shutdown"; GitHub #393 (Ian)
+        repmgrd: improve detection of status change from primary to standby (Ian)
+        repmgrd: improve log output in various situations (Ian)
+        repmgrd: improve reconnection to the local node after a failover (Ian)
+        repmgrd: ensure witness server connects to new primary after a failover (Ian)
+
+4.0.3   2018-02-15
+        repmgr: improve switchover handling when "pg_ctl" used to control the
+          server and logging output is not explicitly redirected (Ian)
+        repmgr: improve switchover log messages and exit code when old primary could
+          not be shut down cleanly (Ian)
+        repmgr: check demotion candidate can make a replication connection to the
+          promotion candidate before executing a switchover; GitHub #370 (Ian)
+        repmgr: add check for sufficient walsenders/replication slots before executing
+          a switchover; GitHub #371 (Ian)
+        repmgr: add --dry-run mode to "repmgr standby follow"; GitHub #368 (Ian)
+        repmgr: provide information about the primary node for "standby_register" and
+          "standby_follow" event notifications; GitHub #375 (Ian)
+        repmgr: add "standby_register_sync" event notification; GitHub #374 (Ian)
+        repmgr: output any connection error messages in "cluster show"'s list of
+          warnings; GitHub #369 (Ian)
+        repmgr: ensure an inactive data directory can be deleted; GitHub #366 (Ian)
+        repmgr: fix upstream node display in "repmgr node status"; GitHub #363 (fanf2)
+        repmgr: improve/clarify documentation and update --help output for
+          "primary unregister"; GitHub #373 (Ian)
+        repmgr: allow replication slots when Barman is configured; GitHub #379 (Ian)
+        repmgr: fix parsing of "pg_basebackup_options"; GitHub #376 (Ian)
+        repmgr: ensure "pg_subtrans" directory is created when cloning a standby in
+          Barman mode (Ian)
+        repmgr: fix primary node check in "witness register"; GitHub #377 (Ian)
+
 4.0.2   2018-01-18
         repmgr: add missing -W option to getopt_long() invocation; GitHub #350 (Ian)
         repmgr: automatically create slot name if missing; GitHub #343 (Ian)
@@ -21,7 +88,6 @@
           GitHub #344 (Ian)
         repmgr: delete any replication slots copied by pg_rewind; GitHub #334 (Ian)
         repmgr: fix configuration file sanity check; GitHub #342 (Ian)
-        Improve event notification documentation (Ian)
 
 4.0.0   2017-11-21
         Complete rewrite with many changes; for details see the repmgr 4.0.0 release

TODO.md

@@ -0,0 +1,20 @@
+TODO
+====
+
+This file contains a list of improvements which are desireable and/or have
+been requested, and which we aim to address/implement when time and resources
+permit.
+
+It is *not* a roadmap and there's no guarantee of any item being implemented
+within any given timeframe.
+
+
+Enable suspension of repmgrd failover
+-------------------------------------
+
+When performing maintenance, e.g. a switchover, it's necessary to stop all
+repmgrd nodes to prevent unintended failover; this is obviously inconvenient.
+We'll need to implement some way of notifying each repmgrd to suspend automatic
+failover until further notice.
+
+Requested in GitHub #410 ( https://github.com/2ndQuadrant/repmgr/issues/410 )

config.h.in

@@ -1,4 +1,2 @@
 /* config.h.in.  Generated from configure.in by autoheader.  */
 
-/* Only build repmgr for BDR */
-#undef BDR_ONLY

configfile.c

@@ -288,6 +288,7 @@ _parse_config(t_configuration_options *options, ItemList *error_list, ItemList *
 	memset(options->node_name, 0, sizeof(options->node_name));
 	memset(options->conninfo, 0, sizeof(options->conninfo));
 	memset(options->data_directory, 0, sizeof(options->data_directory));
+	memset(options->config_directory, 0, sizeof(options->data_directory));
 	memset(options->pg_bindir, 0, sizeof(options->pg_bindir));
 	options->replication_type = REPLICATION_TYPE_PHYSICAL;
 
@@ -303,7 +304,7 @@ _parse_config(t_configuration_options *options, ItemList *error_list, ItemList *
 	options->log_status_interval = DEFAULT_LOG_STATUS_INTERVAL;
 
 	/*-----------------------
-	 * standby action settings
+	 * standby clone settings
 	 *------------------------
 	 */
 	options->use_replication_slots = false;
@@ -314,9 +315,17 @@ _parse_config(t_configuration_options *options, ItemList *error_list, ItemList *
 	options->tablespace_mapping.tail = NULL;
 	memset(options->recovery_min_apply_delay, 0, sizeof(options->recovery_min_apply_delay));
 	options->recovery_min_apply_delay_provided = false;
+	memset(options->archive_cleanup_command, 0, sizeof(options->archive_cleanup_command));
 	options->use_primary_conninfo_password = false;
 	memset(options->passfile, 0, sizeof(options->passfile));
 
+	/*-----------------------
+	 * standby promote settings
+	 *------------------------
+	 */
+	options->promote_check_timeout = DEFAULT_PROMOTE_CHECK_TIMEOUT;
+	options->promote_check_interval = DEFAULT_PROMOTE_CHECK_INTERVAL;
+
 	/*-----------------
 	 * repmgrd settings
 	 *-----------------
@@ -337,6 +346,7 @@ _parse_config(t_configuration_options *options, ItemList *error_list, ItemList *
 	options->async_query_timeout = DEFAULT_ASYNC_QUERY_TIMEOUT;
 	options->primary_notification_timeout = DEFAULT_PRIMARY_NOTIFICATION_TIMEOUT;
 	options->primary_follow_timeout = DEFAULT_PRIMARY_FOLLOW_TIMEOUT;
+	options->standby_reconnect_timeout = DEFAULT_STANDBY_RECONNECT_TIMEOUT;
 
 	/*-------------
 	 * witness settings
@@ -455,6 +465,9 @@ _parse_config(t_configuration_options *options, ItemList *error_list, ItemList *
 			strncpy(options->conninfo, value, MAXLEN);
 		else if (strcmp(name, "data_directory") == 0)
 			strncpy(options->data_directory, value, MAXPGPATH);
+		else if (strcmp(name, "config_directory") == 0)
+			strncpy(options->config_directory, value, MAXPGPATH);
+
 		else if (strcmp(name, "replication_user") == 0)
 		{
 			if (strlen(value) < NAMEDATALEN)
@@ -500,15 +513,24 @@ _parse_config(t_configuration_options *options, ItemList *error_list, ItemList *
 			parse_time_unit_parameter(name, value, options->recovery_min_apply_delay, error_list);
 			options->recovery_min_apply_delay_provided = true;
 		}
+		else if (strcmp(name, "archive_cleanup_command") == 0)
+			strncpy(options->archive_cleanup_command, value, MAXLEN);
 		else if (strcmp(name, "use_primary_conninfo_password") == 0)
 			options->use_primary_conninfo_password = parse_bool(value, name, error_list);
 		else if (strcmp(name, "passfile") == 0)
 			strncpy(options->passfile, value, sizeof(options->passfile));
 
+		/* standby promote settings */
+		else if (strcmp(name, "promote_check_timeout") == 0)
+			options->promote_check_timeout = repmgr_atoi(value, name, error_list, 1);
+
+		else if (strcmp(name, "promote_check_interval") == 0)
+			options->promote_check_interval = repmgr_atoi(value, name, error_list, 1);
+
 		/* node check settings */
 		else if (strcmp(name, "archive_ready_warning") == 0)
 			options->archive_ready_warning = repmgr_atoi(value, name, error_list, 1);
-		else if (strcmp(name, "archive_ready_critcial") == 0)
+		else if (strcmp(name, "archive_ready_critical") == 0)
 			options->archive_ready_critical = repmgr_atoi(value, name, error_list, 1);
 		else if (strcmp(name, "replication_lag_warning") == 0)
 			options->replication_lag_warning = repmgr_atoi(value, name, error_list, 1);
@@ -549,13 +571,15 @@ _parse_config(t_configuration_options *options, ItemList *error_list, ItemList *
 		else if (strcmp(name, "monitoring_history") == 0)
 			options->monitoring_history = parse_bool(value, name, error_list);
 		else if (strcmp(name, "degraded_monitoring_timeout") == 0)
-			options->degraded_monitoring_timeout = repmgr_atoi(value, name, error_list, 1);
+			options->degraded_monitoring_timeout = repmgr_atoi(value, name, error_list, -1);
 		else if (strcmp(name, "async_query_timeout") == 0)
 			options->async_query_timeout = repmgr_atoi(value, name, error_list, 0);
 		else if (strcmp(name, "primary_notification_timeout") == 0)
 			options->primary_notification_timeout = repmgr_atoi(value, name, error_list, 0);
 		else if (strcmp(name, "primary_follow_timeout") == 0)
 			options->primary_follow_timeout = repmgr_atoi(value, name, error_list, 0);
+		else if (strcmp(name, "standby_reconnect_timeout") == 0)
+			options->standby_reconnect_timeout = repmgr_atoi(value, name, error_list, 0);
 
 		/* witness settings */
 		else if (strcmp(name, "witness_sync_interval") == 0)
@@ -671,7 +695,7 @@ _parse_config(t_configuration_options *options, ItemList *error_list, ItemList *
 		 * Raise an error if a known parameter is provided with an empty
 		 * value. Currently there's no reason why empty parameters are needed;
 		 * if we want to accept those, we'd need to add stricter default
-		 * checking, as currently e.g. an empty `node` value will be converted
+		 * checking, as currently e.g. an empty `node_id` value will be converted
 		 * to '0'.
 		 */
 		if (known_parameter == true && !strlen(value))
@@ -1028,7 +1052,7 @@ reload_config(t_configuration_options *orig_options)
 		return false;
 	}
 
-	if (strcmp(new_options.node_name, orig_options->node_name) != 0)
+	if (strncmp(new_options.node_name, orig_options->node_name, MAXLEN) != 0)
 	{
 		log_warning(_("\"node_name\" cannot be changed, keeping current configuration"));
 		return false;
@@ -1072,7 +1096,7 @@ reload_config(t_configuration_options *orig_options)
 	}
 
 	/* conninfo */
-	if (strcmp(orig_options->conninfo, new_options.conninfo) != 0)
+	if (strncmp(orig_options->conninfo, new_options.conninfo, MAXLEN) != 0)
 	{
 		/* Test conninfo string works */
 		conn = establish_db_connection(new_options.conninfo, false);
@@ -1099,7 +1123,7 @@ reload_config(t_configuration_options *orig_options)
 	}
 
 	/* event_notification_command */
-	if (strcmp(orig_options->event_notification_command, new_options.event_notification_command) != 0)
+	if (strncmp(orig_options->event_notification_command, new_options.event_notification_command, MAXLEN) != 0)
 	{
 		strncpy(orig_options->event_notification_command, new_options.event_notification_command, MAXLEN);
 		log_info(_("\"event_notification_command\" is now \"%s\""), new_options.event_notification_command);
@@ -1108,7 +1132,7 @@ reload_config(t_configuration_options *orig_options)
 	}
 
 	/* event_notifications */
-	if (strcmp(orig_options->event_notifications_orig, new_options.event_notifications_orig) != 0)
+	if (strncmp(orig_options->event_notifications_orig, new_options.event_notifications_orig, MAXLEN) != 0)
 	{
 		strncpy(orig_options->event_notifications_orig, new_options.event_notifications_orig, MAXLEN);
 		log_info(_("\"event_notifications\" is now \"%s\""), new_options.event_notifications_orig);
@@ -1128,7 +1152,7 @@ reload_config(t_configuration_options *orig_options)
 	}
 
 	/* follow_command */
-	if (strcmp(orig_options->follow_command, new_options.follow_command) != 0)
+	if (strncmp(orig_options->follow_command, new_options.follow_command, MAXLEN) != 0)
 	{
 		strncpy(orig_options->follow_command, new_options.follow_command, MAXLEN);
 		log_info(_("\"follow_command\" is now \"%s\""), new_options.follow_command);
@@ -1165,7 +1189,7 @@ reload_config(t_configuration_options *orig_options)
 
 
 	/* promote_command */
-	if (strcmp(orig_options->promote_command, new_options.promote_command) != 0)
+	if (strncmp(orig_options->promote_command, new_options.promote_command, MAXLEN) != 0)
 	{
 		strncpy(orig_options->promote_command, new_options.promote_command, MAXLEN);
 		log_info(_("\"promote_command\" is now \"%s\""), new_options.promote_command);
@@ -1205,18 +1229,18 @@ reload_config(t_configuration_options *orig_options)
 	 */
 
 	/* log_facility */
-	if (strcmp(orig_options->log_facility, new_options.log_facility) != 0)
+	if (strncmp(orig_options->log_facility, new_options.log_facility, MAXLEN) != 0)
 	{
-		strcpy(orig_options->log_facility, new_options.log_facility);
+		strncpy(orig_options->log_facility, new_options.log_facility, MAXLEN);
 		log_info(_("\"log_facility\" is now \"%s\""), new_options.log_facility);
 
 		log_config_changed = true;
 	}
 
 	/* log_file */
-	if (strcmp(orig_options->log_file, new_options.log_file) != 0)
+	if (strncmp(orig_options->log_file, new_options.log_file, MAXLEN) != 0)
 	{
-		strcpy(orig_options->log_file, new_options.log_file);
+		strncpy(orig_options->log_file, new_options.log_file, MAXLEN);
 		log_info(_("\"log_file\" is now \"%s\""), new_options.log_file);
 
 		log_config_changed = true;
@@ -1224,9 +1248,9 @@ reload_config(t_configuration_options *orig_options)
 
 
 	/* log_level */
-	if (strcmp(orig_options->log_level, new_options.log_level) != 0)
+	if (strncmp(orig_options->log_level, new_options.log_level, MAXLEN) != 0)
 	{
-		strcpy(orig_options->log_level, new_options.log_level);
+		strncpy(orig_options->log_level, new_options.log_level, MAXLEN);
 		log_info(_("\"log_level\" is now \"%s\""), new_options.log_level);
 
 		log_config_changed = true;
@@ -1600,31 +1624,109 @@ clear_event_notification_list(t_configuration_options *options)
 }
 
 
-bool
-parse_pg_basebackup_options(const char *pg_basebackup_options, t_basebackup_options *backup_options, int server_version_num, ItemList *error_list)
+int
+parse_output_to_argv(const char *string, char ***argv_array)
 {
 	int			options_len = 0;
 	char	   *options_string = NULL;
 	char	   *options_string_ptr = NULL;
+	int			c = 1,
+	   			argc_item = 1;
+	char	   *argv_item = NULL;
+	char	  **local_argv_array = NULL;
+	ItemListCell *cell;
 
 	/*
 	 * Add parsed options to this list, then copy to an array to pass to
 	 * getopt
 	 */
-	static ItemList option_argv = {NULL, NULL};
+	ItemList option_argv = {NULL, NULL};
 
-	char	   *argv_item = NULL;
-	int			c,
-				argc_item = 1;
+	options_len = strlen(string) + 1;
+	options_string = pg_malloc0(options_len);
+	options_string_ptr = options_string;
+
+	/* Copy the string before operating on it with strtok() */
+	strncpy(options_string, string, options_len);
+
+	/* Extract arguments into a list and keep a count of the total */
+	while ((argv_item = strtok(options_string_ptr, " ")) != NULL)
+	{
+		item_list_append(&option_argv, trim(argv_item));
+
+		argc_item++;
+
+		if (options_string_ptr != NULL)
+			options_string_ptr = NULL;
+	}
+
+	pfree(options_string);
+
+	/*
+	 * Array of argument values to pass to getopt_long - this will need to
+	 * include an empty string as the first value (normally this would be the
+	 * program name)
+	 */
+	local_argv_array = pg_malloc0(sizeof(char *) * (argc_item + 2));
+
+	/* Insert a blank dummy program name at the start of the array */
+	local_argv_array[0] = pg_malloc0(1);
+
+	/*
+	 * Copy the previously extracted arguments from our list to the array
+	 */
+	for (cell = option_argv.head; cell; cell = cell->next)
+	{
+		int			argv_len = strlen(cell->string) + 1;
+
+		local_argv_array[c] = (char *)pg_malloc0(argv_len);
+
+		strncpy(local_argv_array[c], cell->string, argv_len);
+
+		c++;
+	}
+
+	local_argv_array[c] = NULL;
+
+	item_list_free(&option_argv);
+
+	*argv_array = local_argv_array;
+
+	return argc_item;
+}
+
+
+void
+free_parsed_argv(char ***argv_array)
+{
+	char	  **local_argv_array = *argv_array;
+	int			i = 0;
+
+	while (local_argv_array[i] != NULL)
+	{
+		pfree((char *)local_argv_array[i]);
+		i++;
+	}
+
+	pfree((char **)local_argv_array);
+	*argv_array = NULL;
+}
+
+
+bool
+parse_pg_basebackup_options(const char *pg_basebackup_options, t_basebackup_options *backup_options, int server_version_num, ItemList *error_list)
+{
+	bool		backup_options_ok = true;
+
+	int			c = 0,
+				argc_item = 0;
 
 	char	  **argv_array = NULL;
-	ItemListCell *cell = NULL;
 
 	int			optindex = 0;
 
 	struct option *long_options = NULL;
 
-	bool		backup_options_ok = true;
 
 	/* We're only interested in these options */
 	static struct option long_options_9[] =
@@ -1650,56 +1752,12 @@ parse_pg_basebackup_options(const char *pg_basebackup_options, t_basebackup_opti
 	if (!strlen(pg_basebackup_options))
 		return backup_options_ok;
 
-	options_len = strlen(pg_basebackup_options) + 1;
-	options_string = pg_malloc(options_len);
-	options_string_ptr = options_string;
-
 	if (server_version_num >= 100000)
 		long_options = long_options_10;
 	else
 		long_options = long_options_9;
 
-	/* Copy the string before operating on it with strtok() */
-	strncpy(options_string, pg_basebackup_options, options_len);
-
-	/* Extract arguments into a list and keep a count of the total */
-	while ((argv_item = strtok(options_string_ptr, " ")) != NULL)
-	{
-		item_list_append(&option_argv, argv_item);
-
-		argc_item++;
-
-		if (options_string_ptr != NULL)
-			options_string_ptr = NULL;
-	}
-
-	/*
-	 * Array of argument values to pass to getopt_long - this will need to
-	 * include an empty string as the first value (normally this would be the
-	 * program name)
-	 */
-	argv_array = pg_malloc0(sizeof(char *) * (argc_item + 2));
-
-	/* Insert a blank dummy program name at the start of the array */
-	argv_array[0] = pg_malloc0(1);
-
-	c = 1;
-
-	/*
-	 * Copy the previously extracted arguments from our list to the array
-	 */
-	for (cell = option_argv.head; cell; cell = cell->next)
-	{
-		int			argv_len = strlen(cell->string) + 1;
-
-		argv_array[c] = pg_malloc0(argv_len);
-
-		strncpy(argv_array[c], cell->string, argv_len);
-
-		c++;
-	}
-
-	argv_array[c] = NULL;
+	argc_item = parse_output_to_argv(pg_basebackup_options, &argv_array);
 
 	/* Reset getopt's optind variable */
 	optind = 0;
@@ -1743,15 +1801,7 @@ parse_pg_basebackup_options(const char *pg_basebackup_options, t_basebackup_opti
 		backup_options_ok = false;
 	}
 
-	pfree(options_string);
-
-	{
-		int			i;
-
-		for (i = 0; i < argc_item + 2; i++)
-			pfree(argv_array[i]);
-	}
-	pfree(argv_array);
+	free_parsed_argv(&argv_array);
 
 	return backup_options_ok;
 }

configfile.h

@@ -73,6 +73,7 @@ typedef struct
 	char		conninfo[MAXLEN];
 	char		replication_user[NAMEDATALEN];
 	char		data_directory[MAXPGPATH];
+	char		config_directory[MAXPGPATH];
 	char		pg_bindir[MAXPGPATH];
 	int			replication_type;
 
@@ -82,16 +83,21 @@ typedef struct
 	char		log_file[MAXLEN];
 	int			log_status_interval;
 
-	/* standby action settings */
+	/* standby clone settings */
 	bool		use_replication_slots;
 	char		pg_basebackup_options[MAXLEN];
 	char		restore_command[MAXLEN];
 	TablespaceList tablespace_mapping;
 	char		recovery_min_apply_delay[MAXLEN];
 	bool		recovery_min_apply_delay_provided;
+	char		archive_cleanup_command[MAXLEN];
 	bool		use_primary_conninfo_password;
 	char		passfile[MAXPGPATH];
 
+	/* standby promote settings */
+	int			promote_check_timeout;
+	int			promote_check_interval;
+
 	/* node check settings */
 	int			archive_ready_warning;
 	int			archive_ready_critical;
@@ -115,6 +121,7 @@ typedef struct
 	int			async_query_timeout;
 	int			primary_notification_timeout;
 	int			primary_follow_timeout;
+	int			standby_reconnect_timeout;
 
 	/* BDR settings */
 	bool		bdr_local_monitoring_only;
@@ -153,11 +160,13 @@ typedef struct
 
 #define T_CONFIGURATION_OPTIONS_INITIALIZER { \
 		/* node information */ \
-		UNKNOWN_NODE_ID, "", "", "", "", "", REPLICATION_TYPE_PHYSICAL,	\
+		UNKNOWN_NODE_ID, "", "", "", "", "", "", REPLICATION_TYPE_PHYSICAL,	\
 		/* log settings */ \
 		"", "", "", DEFAULT_LOG_STATUS_INTERVAL,	\
-		/* standby action settings */ \
-		false, "", "", { NULL, NULL }, "", false, false, "",	\
+		/* standby clone settings */ \
+		false, "", "", { NULL, NULL }, "", false, "", false, "", \
+		/* standby promote settings */ \
+		DEFAULT_PROMOTE_CHECK_TIMEOUT, DEFAULT_PROMOTE_CHECK_INTERVAL, \
 		/* node check settings */ \
 		DEFAULT_ARCHIVE_READY_WARNING, DEFAULT_ARCHIVE_READY_CRITICAL, \
 		DEFAULT_REPLICATION_LAG_WARNING, DEFAULT_REPLICATION_LAG_CRITICAL, \
@@ -172,6 +181,7 @@ typedef struct
 		DEFAULT_ASYNC_QUERY_TIMEOUT, \
 		DEFAULT_PRIMARY_NOTIFICATION_TIMEOUT,	\
 		DEFAULT_PRIMARY_FOLLOW_TIMEOUT,	\
+		DEFAULT_STANDBY_RECONNECT_TIMEOUT,	\
 		/* BDR settings */ \
 		false, DEFAULT_BDR_RECOVERY_TIMEOUT, \
 		/* service settings */ \
@@ -248,7 +258,6 @@ typedef struct
 }
 
 
-
 void		set_progname(const char *argv0);
 const char *progname(void);
 
@@ -263,12 +272,15 @@ int repmgr_atoi(const char *s,
 			ItemList *error_list,
 			int minval);
 
-
 bool parse_pg_basebackup_options(const char *pg_basebackup_options,
 							t_basebackup_options *backup_options,
 							int server_version_num,
 							ItemList *error_list);
 
+int parse_output_to_argv(const char *string, char ***argv_array);
+void free_parsed_argv(char ***argv_array);
+
+
 /* called by repmgr-client and repmgrd */
 void		exit_with_cli_errors(ItemList *error_list);
 void		print_item_list(ItemList *item_list);

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for repmgr 4.0.2.
+# Generated by GNU Autoconf 2.69 for repmgr 4.0.5.
 #
 # Report bugs to <pgsql-bugs@postgresql.org>.
 #
@@ -582,8 +582,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='repmgr'
 PACKAGE_TARNAME='repmgr'
-PACKAGE_VERSION='4.0.2'
-PACKAGE_STRING='repmgr 4.0.2'
+PACKAGE_VERSION='4.0.5'
+PACKAGE_STRING='repmgr 4.0.5'
 PACKAGE_BUGREPORT='pgsql-bugs@postgresql.org'
 PACKAGE_URL='https://2ndquadrant.com/en/resources/repmgr/'
 
@@ -633,7 +633,6 @@ SHELL'
 ac_subst_files=''
 ac_user_opts='
 enable_option_checking
-with_bdr_only
 '
       ac_precious_vars='build_alias
 host_alias
@@ -1179,7 +1178,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures repmgr 4.0.2 to adapt to many kinds of systems.
+\`configure' configures repmgr 4.0.5 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1240,15 +1239,10 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of repmgr 4.0.2:";;
+     short | recursive ) echo "Configuration of repmgr 4.0.5:";;
    esac
   cat <<\_ACEOF
 
-Optional Packages:
-  --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
-  --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
-  --with-bdr-only         BDR-only build
-
 Some influential environment variables:
   PG_CONFIG   Location to find pg_config for target PostgreSQL (default PATH)
 
@@ -1319,7 +1313,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-repmgr configure 4.0.2
+repmgr configure 4.0.5
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1338,7 +1332,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by repmgr $as_me 4.0.2, which was
+It was created by repmgr $as_me 4.0.5, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -1694,20 +1688,6 @@ ac_config_headers="$ac_config_headers config.h"
 
 
 
-
-# Check whether --with-bdr_only was given.
-if test "${with_bdr_only+set}" = set; then :
-  withval=$with_bdr_only;
-fi
-
-if test "x$with_bdr_only" != "x"; then :
-
-$as_echo "#define BDR_ONLY \"1\"" >>confdefs.h
-
-
-fi
-
-
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5
 $as_echo_n "checking for a sed that does not truncate output... " >&6; }
 if ${ac_cv_path_SED+:} false; then :
@@ -2379,7 +2359,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by repmgr $as_me 4.0.2, which was
+This file was extended by repmgr $as_me 4.0.5, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -2442,7 +2422,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-repmgr config.status 4.0.2
+repmgr config.status 4.0.5
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

configure.in

@@ -1,4 +1,4 @@
-AC_INIT([repmgr], [4.0.2], [pgsql-bugs@postgresql.org], [repmgr], [https://2ndquadrant.com/en/resources/repmgr/])
+AC_INIT([repmgr], [4.0.5], [pgsql-bugs@postgresql.org], [repmgr], [https://2ndquadrant.com/en/resources/repmgr/])
 
 AC_COPYRIGHT([Copyright (c) 2010-2018, 2ndQuadrant Ltd.])
 
@@ -6,12 +6,6 @@ AC_CONFIG_HEADER(config.h)
 
 AC_ARG_VAR([PG_CONFIG], [Location to find pg_config for target PostgreSQL (default PATH)])
 
-AC_ARG_WITH([bdr_only], [AS_HELP_STRING([--with-bdr-only], [BDR-only build])])
-AS_IF([test "x$with_bdr_only" != "x"],
-    [AC_DEFINE([BDR_ONLY], ["1"], [Only build repmgr for BDR])]
-)
-
-
 AC_PROG_SED
 
 if test -z "$PG_CONFIG"; then

controldata.c

@@ -37,13 +37,8 @@ get_system_identifier(const char *data_directory)
 	uint64		system_identifier = UNKNOWN_SYSTEM_IDENTIFIER;
 
 	control_file_info = get_controlfile(data_directory);
+	system_identifier = control_file_info->system_identifier;
 
-	if (control_file_info->control_file_processed == true)
-		system_identifier = control_file_info->control_file->system_identifier;
-	else
-		system_identifier = UNKNOWN_SYSTEM_IDENTIFIER;
-
-	pfree(control_file_info->control_file);
 	pfree(control_file_info);
 
 	return system_identifier;
@@ -57,13 +52,8 @@ get_db_state(const char *data_directory)
 
 	control_file_info = get_controlfile(data_directory);
 
-	if (control_file_info->control_file_processed == true)
-		state = control_file_info->control_file->state;
-	else
-		/* if we were unable to parse the control file, assume DB is shut down */
-		state = DB_SHUTDOWNED;
+	state = control_file_info->state;
 
-	pfree(control_file_info->control_file);
 	pfree(control_file_info);
 
 	return state;
@@ -78,12 +68,8 @@ get_latest_checkpoint_location(const char *data_directory)
 
 	control_file_info = get_controlfile(data_directory);
 
-	if (control_file_info->control_file_processed == false)
-		return InvalidXLogRecPtr;
+	checkPoint = control_file_info->checkPoint;
 
-	checkPoint = control_file_info->control_file->checkPoint;
-
-	pfree(control_file_info->control_file);
 	pfree(control_file_info);
 
 	return checkPoint;
@@ -98,16 +84,8 @@ get_data_checksum_version(const char *data_directory)
 
 	control_file_info = get_controlfile(data_directory);
 
-	if (control_file_info->control_file_processed == false)
-	{
-		data_checksum_version = -1;
-	}
-	else
-	{
-		data_checksum_version = (int) control_file_info->control_file->data_checksum_version;
-	}
+	data_checksum_version = (int) control_file_info->data_checksum_version;
 
-	pfree(control_file_info->control_file);
 	pfree(control_file_info);
 
 	return data_checksum_version;
@@ -139,33 +117,109 @@ describe_db_state(DBState state)
 
 
 /*
- * we maintain our own version of get_controlfile() as we need cross-version
+ * We maintain our own version of get_controlfile() as we need cross-version
  * compatibility, and also don't care if the file isn't readable.
  */
 static ControlFileInfo *
 get_controlfile(const char *DataDir)
 {
 	ControlFileInfo *control_file_info;
-	int			fd;
+	FILE	   *fp = NULL;
+	int			fd, ret, version_num;
+	char		PgVersionPath[MAXPGPATH] = "";
 	char		ControlFilePath[MAXPGPATH] = "";
+	char		file_version_string[64] = "";
+	long		file_major, file_minor;
+	char	   *endptr = NULL;
+	void	   *ControlFileDataPtr = NULL;
+	int			expected_size = 0;
 
 	control_file_info = palloc0(sizeof(ControlFileInfo));
+
+	/* set default values */
 	control_file_info->control_file_processed = false;
-	control_file_info->control_file = palloc0(sizeof(ControlFileData));
+	control_file_info->system_identifier = UNKNOWN_SYSTEM_IDENTIFIER;
+	control_file_info->state = DB_SHUTDOWNED;
+	control_file_info->checkPoint = InvalidXLogRecPtr;
+	control_file_info->data_checksum_version = -1;
+
+	/*
+	 * Read PG_VERSION, as we'll need to determine which struct to read
+	 * the control file contents into
+	 */
+	snprintf(PgVersionPath, MAXPGPATH, "%s/PG_VERSION", DataDir);
+
+	fp = fopen(PgVersionPath, "r");
+
+	if (fp == NULL)
+	{
+		log_warning(_("could not open file \"%s\" for reading"),
+					PgVersionPath);
+		log_detail("%s", strerror(errno));
+		return control_file_info;
+	}
+
+	file_version_string[0] = '\0';
+
+	ret = fscanf(fp, "%63s", file_version_string);
+	fclose(fp);
+
+	if (ret != 1 || endptr == file_version_string)
+	{
+		log_warning(_("unable to determine major version number from PG_VERSION"));
+
+		return control_file_info;
+	}
+
+	file_major = strtol(file_version_string, &endptr, 10);
+	file_minor = 0;
+
+	if (*endptr == '.')
+		file_minor = strtol(endptr + 1, NULL, 10);
+
+	version_num = ((int) file_major * 10000) + ((int) file_minor * 100);
+
+	if (version_num < 90300)
+	{
+		log_warning(_("Data directory appears to be initialised for %s"), file_version_string);
+		return control_file_info;
+	}
+
 
 	snprintf(ControlFilePath, MAXPGPATH, "%s/global/pg_control", DataDir);
 
 	if ((fd = open(ControlFilePath, O_RDONLY | PG_BINARY, 0)) == -1)
 	{
-		log_debug("could not open file \"%s\" for reading: %s",
-				  ControlFilePath, strerror(errno));
+		log_warning(_("could not open file \"%s\" for reading"),
+					ControlFilePath);
+		log_detail("%s", strerror(errno));
 		return control_file_info;
 	}
 
-	if (read(fd, control_file_info->control_file, sizeof(ControlFileData)) != sizeof(ControlFileData))
+
+	if (version_num >= 90500)
 	{
-		log_debug("could not read file \"%s\": %s",
-				  ControlFilePath, strerror(errno));
+		expected_size = sizeof(ControlFileData95);
+		ControlFileDataPtr = palloc0(expected_size);
+	}
+	else if (version_num >= 90400)
+	{
+		expected_size = sizeof(ControlFileData94);
+		ControlFileDataPtr = palloc0(expected_size);
+	}
+	else if (version_num >= 90300)
+	{
+		expected_size = sizeof(ControlFileData93);
+		ControlFileDataPtr = palloc0(expected_size);
+	}
+
+
+	if (read(fd, ControlFileDataPtr, expected_size) != expected_size)
+	{
+		log_warning(_("could not read file \"%s\""),
+					ControlFilePath);
+		log_detail("%s", strerror(errno));
+
 		return control_file_info;
 	}
 
@@ -173,6 +227,33 @@ get_controlfile(const char *DataDir)
 
 	control_file_info->control_file_processed = true;
 
+	if (version_num >= 90500)
+	{
+		ControlFileData95 *ptr = (struct ControlFileData95 *)ControlFileDataPtr;
+		control_file_info->system_identifier = ptr->system_identifier;
+		control_file_info->state = ptr->state;
+		control_file_info->checkPoint = ptr->checkPoint;
+		control_file_info->data_checksum_version = ptr->data_checksum_version;
+	}
+	else if (version_num >= 90400)
+	{
+		ControlFileData94 *ptr = (struct ControlFileData94 *)ControlFileDataPtr;
+		control_file_info->system_identifier = ptr->system_identifier;
+		control_file_info->state = ptr->state;
+		control_file_info->checkPoint = ptr->checkPoint;
+		control_file_info->data_checksum_version = ptr->data_checksum_version;
+	}
+	else if (version_num >= 90300)
+	{
+		ControlFileData93 *ptr = (struct ControlFileData93 *)ControlFileDataPtr;
+		control_file_info->system_identifier = ptr->system_identifier;
+		control_file_info->state = ptr->state;
+		control_file_info->checkPoint = ptr->checkPoint;
+		control_file_info->data_checksum_version = ptr->data_checksum_version;
+	}
+
+	pfree(ControlFileDataPtr);
+
 	/*
 	 * We don't check the CRC here as we're potentially checking a pg_control
 	 * file from a different PostgreSQL version to the one repmgr was compiled

controldata.h

@@ -12,12 +12,261 @@
 #include "postgres_fe.h"
 #include "catalog/pg_control.h"
 
+/*
+ * A simplified representation of pg_control containing only those fields
+ * required by repmgr.
+ */
 typedef struct
 {
 	bool		control_file_processed;
-	ControlFileData *control_file;
+	uint64		system_identifier;
+	DBState		state;
+	XLogRecPtr	checkPoint;
+	uint32		data_checksum_version;
 } ControlFileInfo;
 
+
+
+/* Same for 9.3, 9.4 */
+typedef struct CheckPoint93
+{
+	XLogRecPtr	redo;			/* next RecPtr available when we began to
+								 * create CheckPoint (i.e. REDO start point) */
+	TimeLineID	ThisTimeLineID; /* current TLI */
+	TimeLineID	PrevTimeLineID; /* previous TLI, if this record begins a new
+								 * timeline (equals ThisTimeLineID otherwise) */
+	bool		fullPageWrites; /* current full_page_writes */
+	uint32		nextXidEpoch;	/* higher-order bits of nextXid */
+	TransactionId nextXid;		/* next free XID */
+	Oid			nextOid;		/* next free OID */
+	MultiXactId nextMulti;		/* next free MultiXactId */
+	MultiXactOffset nextMultiOffset;	/* next free MultiXact offset */
+	TransactionId oldestXid;	/* cluster-wide minimum datfrozenxid */
+	Oid			oldestXidDB;	/* database with minimum datfrozenxid */
+	MultiXactId oldestMulti;	/* cluster-wide minimum datminmxid */
+	Oid			oldestMultiDB;	/* database with minimum datminmxid */
+	pg_time_t	time;			/* time stamp of checkpoint */
+
+	TransactionId oldestActiveXid;
+} CheckPoint93;
+
+
+/* Same for 9.5, 9.6, 10, HEAD */
+typedef struct CheckPoint95
+{
+	XLogRecPtr	redo;			/* next RecPtr available when we began to
+								 * create CheckPoint (i.e. REDO start point) */
+	TimeLineID	ThisTimeLineID; /* current TLI */
+	TimeLineID	PrevTimeLineID; /* previous TLI, if this record begins a new
+								 * timeline (equals ThisTimeLineID otherwise) */
+	bool		fullPageWrites; /* current full_page_writes */
+	uint32		nextXidEpoch;	/* higher-order bits of nextXid */
+	TransactionId nextXid;		/* next free XID */
+	Oid			nextOid;		/* next free OID */
+	MultiXactId nextMulti;		/* next free MultiXactId */
+	MultiXactOffset nextMultiOffset;	/* next free MultiXact offset */
+	TransactionId oldestXid;	/* cluster-wide minimum datfrozenxid */
+	Oid			oldestXidDB;	/* database with minimum datfrozenxid */
+	MultiXactId oldestMulti;	/* cluster-wide minimum datminmxid */
+	Oid			oldestMultiDB;	/* database with minimum datminmxid */
+	pg_time_t	time;			/* time stamp of checkpoint */
+	TransactionId oldestCommitTsXid;	/* oldest Xid with valid commit
+										 * timestamp */
+	TransactionId newestCommitTsXid;	/* newest Xid with valid commit
+										 * timestamp */
+
+	TransactionId oldestActiveXid;
+} CheckPoint95;
+
+
+typedef struct ControlFileData93
+{
+	uint64		system_identifier;
+
+	uint32		pg_control_version;		/* PG_CONTROL_VERSION */
+	uint32		catalog_version_no;		/* see catversion.h */
+
+	DBState		state;			/* see enum above */
+	pg_time_t	time;			/* time stamp of last pg_control update */
+	XLogRecPtr	checkPoint;		/* last check point record ptr */
+	XLogRecPtr	prevCheckPoint; /* previous check point record ptr */
+
+	CheckPoint93	checkPointCopy; /* copy of last check point record */
+
+	XLogRecPtr	unloggedLSN;	/* current fake LSN value, for unlogged rels */
+
+	XLogRecPtr	minRecoveryPoint;
+	TimeLineID	minRecoveryPointTLI;
+	XLogRecPtr	backupStartPoint;
+	XLogRecPtr	backupEndPoint;
+	bool		backupEndRequired;
+
+	int			wal_level;
+	int			MaxConnections;
+	int			max_prepared_xacts;
+	int			max_locks_per_xact;
+
+	uint32		maxAlign;		/* alignment requirement for tuples */
+	double		floatFormat;	/* constant 1234567.0 */
+
+	uint32		blcksz;			/* data block size for this DB */
+	uint32		relseg_size;	/* blocks per segment of large relation */
+
+	uint32		xlog_blcksz;	/* block size within WAL files */
+	uint32		xlog_seg_size;	/* size of each WAL segment */
+
+	uint32		nameDataLen;	/* catalog name field width */
+	uint32		indexMaxKeys;	/* max number of columns in an index */
+
+	uint32		toast_max_chunk_size;	/* chunk size in TOAST tables */
+
+	/* flag indicating internal format of timestamp, interval, time */
+	bool		enableIntTimes; /* int64 storage enabled? */
+
+	/* flags indicating pass-by-value status of various types */
+	bool		float4ByVal;	/* float4 pass-by-value? */
+	bool		float8ByVal;	/* float8, int8, etc pass-by-value? */
+
+	/* Are data pages protected by checksums? Zero if no checksum version */
+	uint32		data_checksum_version;
+
+} ControlFileData93;
+
+
+/*
+ * Following fields added since 9.3:
+ *
+ * 	int			max_worker_processes;
+ *  int			max_prepared_xacts;
+ *  int			max_locks_per_xact;
+ *
+ */
+typedef struct ControlFileData94
+{
+	uint64		system_identifier;
+
+	uint32		pg_control_version;		/* PG_CONTROL_VERSION */
+	uint32		catalog_version_no;		/* see catversion.h */
+
+	DBState		state;			/* see enum above */
+	pg_time_t	time;			/* time stamp of last pg_control update */
+	XLogRecPtr	checkPoint;		/* last check point record ptr */
+	XLogRecPtr	prevCheckPoint; /* previous check point record ptr */
+
+	CheckPoint93	checkPointCopy; /* copy of last check point record */
+
+	XLogRecPtr	unloggedLSN;	/* current fake LSN value, for unlogged rels */
+
+	XLogRecPtr	minRecoveryPoint;
+	TimeLineID	minRecoveryPointTLI;
+	XLogRecPtr	backupStartPoint;
+	XLogRecPtr	backupEndPoint;
+	bool		backupEndRequired;
+
+	int			wal_level;
+	bool		wal_log_hints;
+	int			MaxConnections;
+	int			max_worker_processes;
+	int			max_prepared_xacts;
+	int			max_locks_per_xact;
+
+	uint32		maxAlign;		/* alignment requirement for tuples */
+	double		floatFormat;	/* constant 1234567.0 */
+
+	uint32		blcksz;			/* data block size for this DB */
+	uint32		relseg_size;	/* blocks per segment of large relation */
+
+	uint32		xlog_blcksz;	/* block size within WAL files */
+	uint32		xlog_seg_size;	/* size of each WAL segment */
+
+	uint32		nameDataLen;	/* catalog name field width */
+	uint32		indexMaxKeys;	/* max number of columns in an index */
+
+	uint32		toast_max_chunk_size;	/* chunk size in TOAST tables */
+	uint32		loblksize;		/* chunk size in pg_largeobject */
+
+	bool		enableIntTimes; /* int64 storage enabled? */
+
+	bool		float4ByVal;	/* float4 pass-by-value? */
+	bool		float8ByVal;	/* float8, int8, etc pass-by-value? */
+
+	/* Are data pages protected by checksums? Zero if no checksum version */
+	uint32		data_checksum_version;
+
+} ControlFileData94;
+
+
+
+/*
+ * Following field added since 9.4:
+ *
+ *	bool		track_commit_timestamp;
+ *
+ * Unchanged in 9.6
+ *
+ * In 10, following field appended *after* "data_checksum_version":
+ *
+ *	char		mock_authentication_nonce[MOCK_AUTH_NONCE_LEN];
+ *
+ * (but we don't care about that)
+ */
+
+typedef struct ControlFileData95
+{
+	uint64		system_identifier;
+
+	uint32		pg_control_version;		/* PG_CONTROL_VERSION */
+	uint32		catalog_version_no;		/* see catversion.h */
+
+	DBState		state;			/* see enum above */
+	pg_time_t	time;			/* time stamp of last pg_control update */
+	XLogRecPtr	checkPoint;		/* last check point record ptr */
+	XLogRecPtr	prevCheckPoint; /* previous check point record ptr */
+
+	CheckPoint95	checkPointCopy; /* copy of last check point record */
+
+	XLogRecPtr	unloggedLSN;	/* current fake LSN value, for unlogged rels */
+
+	XLogRecPtr	minRecoveryPoint;
+	TimeLineID	minRecoveryPointTLI;
+	XLogRecPtr	backupStartPoint;
+	XLogRecPtr	backupEndPoint;
+	bool		backupEndRequired;
+
+	int			wal_level;
+	bool		wal_log_hints;
+	int			MaxConnections;
+	int			max_worker_processes;
+	int			max_prepared_xacts;
+	int			max_locks_per_xact;
+	bool		track_commit_timestamp;
+
+	uint32		maxAlign;		/* alignment requirement for tuples */
+	double		floatFormat;	/* constant 1234567.0 */
+
+	uint32		blcksz;			/* data block size for this DB */
+	uint32		relseg_size;	/* blocks per segment of large relation */
+
+	uint32		xlog_blcksz;	/* block size within WAL files */
+	uint32		xlog_seg_size;	/* size of each WAL segment */
+
+	uint32		nameDataLen;	/* catalog name field width */
+	uint32		indexMaxKeys;	/* max number of columns in an index */
+
+	uint32		toast_max_chunk_size;	/* chunk size in TOAST tables */
+	uint32		loblksize;		/* chunk size in pg_largeobject */
+
+	bool		enableIntTimes; /* int64 storage enabled? */
+
+	bool		float4ByVal;	/* float4 pass-by-value? */
+	bool		float8ByVal;	/* float8, int8, etc pass-by-value? */
+
+	uint32		data_checksum_version;
+
+} ControlFileData95;
+
+
+
 extern DBState get_db_state(const char *data_directory);
 extern const char *describe_db_state(DBState state);
 extern int	get_data_checksum_version(const char *data_directory);

dbutils.c

@@ -124,7 +124,7 @@ _establish_db_connection(const char *conninfo, const bool exit_on_error, const b
 
 	initialize_conninfo_params(&conninfo_params, false);
 
-	parse_success = parse_conninfo_string(conninfo, &conninfo_params, errmsg, false);
+	parse_success = parse_conninfo_string(conninfo, &conninfo_params, &errmsg, false);
 
 	if (parse_success == false)
 	{
@@ -219,8 +219,7 @@ establish_db_connection_quiet(const char *conninfo)
 }
 
 
-PGconn
-		   *
+PGconn *
 establish_primary_db_connection(PGconn *conn,
 								const bool exit_on_error)
 {
@@ -237,36 +236,6 @@ establish_primary_db_connection(PGconn *conn,
 }
 
 
-PGconn *
-establish_db_connection_as_user(const char *conninfo,
-								const char *user,
-								const bool exit_on_error)
-{
-	PGconn	   *conn = NULL;
-	t_conninfo_param_list conninfo_params = T_CONNINFO_PARAM_LIST_INITIALIZER;
-	bool		parse_success = false;
-	char	   *errmsg = NULL;
-
-	initialize_conninfo_params(&conninfo_params, false);
-
-	parse_success = parse_conninfo_string(conninfo, &conninfo_params, errmsg, true);
-
-	if (parse_success == false)
-	{
-		log_error(_("unable to pass provided conninfo string:\n	 %s"), errmsg);
-		return NULL;
-	}
-
-	param_set(&conninfo_params, "user", user);
-
-	conn = establish_db_connection_by_params(&conninfo_params, false);
-
-	return conn;
-}
-
-
-
-
 PGconn *
 establish_db_connection_by_params(t_conninfo_param_list *param_list,
 								  const bool exit_on_error)
@@ -342,6 +311,18 @@ is_superuser_connection(PGconn *conn, t_connection_user *userinfo)
 }
 
 
+void
+close_connection(PGconn **conn)
+{
+	if (*conn == NULL)
+		return;
+
+	PQfinish(*conn);
+
+	*conn = NULL;
+}
+
+
 /* =============================== */
 /* conninfo manipulation functions */
 /* =============================== */
@@ -437,15 +418,18 @@ free_conninfo_params(t_conninfo_param_list *param_list)
 
 	for (c = 0; c < param_list->size; c++)
 	{
-		if (param_list->keywords[c] != NULL)
+		if (param_list->keywords != NULL && param_list->keywords[c] != NULL)
 			pfree(param_list->keywords[c]);
 
-		if (param_list->values[c] != NULL)
+		if (param_list->values != NULL && param_list->values[c] != NULL)
 			pfree(param_list->values[c]);
 	}
 
-	pfree(param_list->keywords);
-	pfree(param_list->values);
+	if (param_list->keywords != NULL)
+		pfree(param_list->keywords);
+
+	if (param_list->values != NULL)
+		pfree(param_list->values);
 }
 
 
@@ -569,7 +553,7 @@ param_get(t_conninfo_param_list *param_list, const char *param)
 /*
  * Parse a conninfo string into a t_conninfo_param_list
  *
- * See conn_to_param_list() to do the same for a PQconn
+ * See conn_to_param_list() to do the same for a PGconn
  *
  * "ignore_local_params": ignores those parameters specific
  * to a local installation, i.e. when parsing an upstream
@@ -577,12 +561,12 @@ param_get(t_conninfo_param_list *param_list, const char *param)
  * don't copy that node's values
  */
 bool
-parse_conninfo_string(const char *conninfo_str, t_conninfo_param_list *param_list, char *errmsg, bool ignore_local_params)
+parse_conninfo_string(const char *conninfo_str, t_conninfo_param_list *param_list, char **errmsg, bool ignore_local_params)
 {
 	PQconninfoOption *connOptions = NULL;
 	PQconninfoOption *option = NULL;
 
-	connOptions = PQconninfoParse(conninfo_str, &errmsg);
+	connOptions = PQconninfoParse(conninfo_str, errmsg);
 
 	if (connOptions == NULL)
 		return false;
@@ -613,10 +597,19 @@ parse_conninfo_string(const char *conninfo_str, t_conninfo_param_list *param_lis
 	return true;
 }
 
+
 /*
- * Parse a PQconn into a t_conninfo_param_list
+ * Parse a PGconn into a t_conninfo_param_list
  *
  * See parse_conninfo_string() to do the same for a conninfo string
+ *
+ * NOTE: the current use case for this is to take an active connection,
+ * replace the existing username (typically replacing it with the superuser
+ * or replication user name), and make a new connection as that user.
+ * If the "password" field is set, it will cause any connection made with
+ * these parameters to fail (unless of course the password happens to be the
+ * same). Therefore we remove the password altogether, and rely on it being
+ * available via .pgpass.
  */
 void
 conn_to_param_list(PGconn *conn, t_conninfo_param_list *param_list)
@@ -632,6 +625,10 @@ conn_to_param_list(PGconn *conn, t_conninfo_param_list *param_list)
 			(option->val != NULL && option->val[0] == '\0'))
 			continue;
 
+		/* Ignore "password" */
+		if (strcmp(option->keyword, "password") == 0)
+			continue;
+
 		param_set(param_list, option->keyword, option->val);
 	}
 
@@ -1012,7 +1009,7 @@ get_cluster_size(PGconn *conn, char *size)
 
 	initPQExpBuffer(&query);
 	appendPQExpBuffer(&query,
-					  "SELECT pg_catalog.pg_size_pretty(SUM(pg_catalog.pg_database_size(oid))::bigint) "
+					  "SELECT pg_catalog.pg_size_pretty(pg_catalog.sum(pg_catalog.pg_database_size(oid))::bigint) "
 					  "	 FROM pg_catalog.pg_database ");
 
 	log_verbose(LOG_DEBUG, "get_cluster_size():\n%s", query.data);
@@ -1057,7 +1054,7 @@ get_server_version(PGconn *conn, char *server_version)
 	}
 
 	if (server_version != NULL)
-		strcpy(server_version, PQgetvalue(res, 0, 1));
+		strncpy(server_version, PQgetvalue(res, 0, 1), MAXVERSIONSTR);
 
 	server_version_num = atoi(PQgetvalue(res, 0, 0));
 
@@ -1255,7 +1252,7 @@ get_primary_node_id(PGconn *conn)
 	initPQExpBuffer(&query);
 	appendPQExpBuffer(&query,
 					  "SELECT node_id		  "
-					  "	 FROM repmgr.nodes	  "
+					  "	 FROM repmgr.nodes    "
 					  " WHERE type = 'primary' "
 					  "   AND active IS TRUE  ");
 
@@ -1355,67 +1352,6 @@ get_replication_info(PGconn *conn, ReplInfo *replication_info)
 }
 
 
-bool
-can_use_pg_rewind(PGconn *conn, const char *data_directory, PQExpBufferData *reason)
-{
-	bool		can_use = true;
-
-	if (server_version_num == UNKNOWN_SERVER_VERSION_NUM)
-		server_version_num = get_server_version(conn, NULL);
-
-	if (server_version_num < 90500)
-	{
-		appendPQExpBuffer(reason,
-						  _("pg_rewind available from PostgreSQL 9.5"));
-		return false;
-	}
-
-	if (guc_set(conn, "full_page_writes", "=", "off"))
-	{
-		if (can_use == false)
-			appendPQExpBuffer(reason, "; ");
-
-		appendPQExpBuffer(reason,
-						  _("\"full_page_writes\" must be set to \"on\""));
-
-		can_use = false;
-	}
-
-	/*
-	 * "wal_log_hints" off - are data checksums available? Note: we're
-	 * checking the local pg_control file here as the value will be the same
-	 * throughout the cluster and saves a round-trip to the demotion
-	 * candidate.
-	 */
-	if (guc_set(conn, "wal_log_hints", "=", "on") == false)
-	{
-		int			data_checksum_version = get_data_checksum_version(data_directory);
-
-		if (data_checksum_version < 0)
-		{
-			if (can_use == false)
-				appendPQExpBuffer(reason, "; ");
-
-			appendPQExpBuffer(reason,
-							  _("\"wal_log_hints\" is set to \"off\" but unable to determine checksum version"));
-			can_use = false;
-		}
-		else if (data_checksum_version == 0)
-		{
-			if (can_use == false)
-				appendPQExpBuffer(reason, "; ");
-
-			appendPQExpBuffer(reason,
-							  _("\"wal_log_hints\" is set to \"off\" and checksums are disabled"));
-
-			can_use = false;
-		}
-	}
-
-	return can_use;
-}
-
-
 int
 get_ready_archive_files(PGconn *conn, const char *data_directory)
 {
@@ -1800,7 +1736,7 @@ _populate_node_record(PGresult *res, t_node_info *node_info, int row)
 	strncpy(node_info->config_file, PQgetvalue(res, row, 10), MAXLEN);
 
 	/* This won't normally be set */
-	strncpy(node_info->upstream_node_name, PQgetvalue(res, row, 10), MAXLEN);
+	strncpy(node_info->upstream_node_name, PQgetvalue(res, row, 11), MAXLEN);
 
 	/* Set remaining struct fields with default values */
 	node_info->node_status = NODE_STATUS_UNKNOWN;
@@ -1866,8 +1802,38 @@ get_node_record(PGconn *conn, int node_id, t_node_info *node_info)
 	initPQExpBuffer(&query);
 	appendPQExpBuffer(&query,
 					  "SELECT " REPMGR_NODES_COLUMNS
-					  "  FROM repmgr.nodes "
-					  " WHERE node_id = %i",
+					  "  FROM repmgr.nodes n "
+					  " WHERE n.node_id = %i",
+					  node_id);
+
+	log_verbose(LOG_DEBUG, "get_node_record():\n  %s", query.data);
+
+	result = _get_node_record(conn, query.data, node_info);
+	termPQExpBuffer(&query);
+
+	if (result == RECORD_NOT_FOUND)
+	{
+		log_verbose(LOG_DEBUG, "get_node_record(): no record found for node %i", node_id);
+	}
+
+	return result;
+}
+
+
+RecordStatus
+get_node_record_with_upstream(PGconn *conn, int node_id, t_node_info *node_info)
+{
+	PQExpBufferData query;
+	RecordStatus result;
+
+	initPQExpBuffer(&query);
+	appendPQExpBuffer(&query,
+					  "    SELECT n.node_id, n.type, n.upstream_node_id, n.node_name, n.conninfo, n.repluser, "
+					  "           n.slot_name, n.location, n.priority, n.active, n.config_file, un.node_name AS upstream_node_name "
+					  "      FROM repmgr.nodes n "
+					  " LEFT JOIN repmgr.nodes un "
+					  "        ON un.node_id = n.upstream_node_id"
+					  " WHERE n.node_id = %i",
 					  node_id);
 
 	log_verbose(LOG_DEBUG, "get_node_record():\n  %s", query.data);
@@ -1894,8 +1860,8 @@ get_node_record_by_name(PGconn *conn, const char *node_name, t_node_info *node_i
 
 	appendPQExpBuffer(&query,
 					  "SELECT " REPMGR_NODES_COLUMNS
-					  "  FROM repmgr.nodes "
-					  " WHERE node_name = '%s' ",
+					  "  FROM repmgr.nodes n "
+					  " WHERE n.node_name = '%s' ",
 					  node_name);
 
 	log_verbose(LOG_DEBUG, "get_node_record_by_name():\n  %s", query.data);
@@ -2020,8 +1986,8 @@ get_all_node_records(PGconn *conn, NodeInfoList *node_list)
 
 	appendPQExpBuffer(&query,
 					  "  SELECT " REPMGR_NODES_COLUMNS
-					  "    FROM repmgr.nodes "
-					  "ORDER BY node_id ");
+					  "    FROM repmgr.nodes n "
+					  "ORDER BY n.node_id ");
 
 	log_verbose(LOG_DEBUG, "get_all_node_records():\n%s", query.data);
 
@@ -2046,9 +2012,9 @@ get_downstream_node_records(PGconn *conn, int node_id, NodeInfoList *node_list)
 
 	appendPQExpBuffer(&query,
 					  "  SELECT " REPMGR_NODES_COLUMNS
-					  "    FROM repmgr.nodes "
-					  "   WHERE upstream_node_id = %i "
-					  "ORDER BY node_id ",
+					  "    FROM repmgr.nodes n "
+					  "   WHERE n.upstream_node_id = %i "
+					  "ORDER BY n.node_id ",
 					  node_id);
 
 	log_verbose(LOG_DEBUG, "get_downstream_node_records():\n%s", query.data);
@@ -2075,11 +2041,11 @@ get_active_sibling_node_records(PGconn *conn, int node_id, int upstream_node_id,
 
 	appendPQExpBuffer(&query,
 					  "  SELECT " REPMGR_NODES_COLUMNS
-					  "    FROM repmgr.nodes "
-					  "   WHERE upstream_node_id = %i "
-					  "     AND node_id != %i "
-					  "     AND active IS TRUE "
-					  "ORDER BY node_id ",
+					  "    FROM repmgr.nodes n "
+					  "   WHERE n.upstream_node_id = %i "
+					  "     AND n.node_id != %i "
+					  "     AND n.active IS TRUE "
+					  "ORDER BY n.node_id ",
 					  upstream_node_id,
 					  node_id);
 
@@ -2107,8 +2073,8 @@ get_node_records_by_priority(PGconn *conn, NodeInfoList *node_list)
 
 	appendPQExpBuffer(&query,
 					  "  SELECT " REPMGR_NODES_COLUMNS
-					  "    FROM repmgr.nodes "
-					  "ORDER BY priority DESC, node_name ");
+					  "    FROM repmgr.nodes n "
+					  "ORDER BY n.priority DESC, n.node_name ");
 
 	log_verbose(LOG_DEBUG, "get_node_records_by_priority():\n%s", query.data);
 
@@ -2123,7 +2089,11 @@ get_node_records_by_priority(PGconn *conn, NodeInfoList *node_list)
 	return;
 }
 
-void
+/*
+ * return all node records together with their upstream's node name,
+ * if available.
+ */
+bool
 get_all_node_records_with_upstream(PGconn *conn, NodeInfoList *node_list)
 {
 	PQExpBufferData query;
@@ -2133,7 +2103,7 @@ get_all_node_records_with_upstream(PGconn *conn, NodeInfoList *node_list)
 
 	appendPQExpBuffer(&query,
 					  "    SELECT n.node_id, n.type, n.upstream_node_id, n.node_name, n.conninfo, n.repluser, "
-					  "           n.slot_name, n.location, n.priority, n.active, un.node_name AS upstream_node_name "
+					  "           n.slot_name, n.location, n.priority, n.active, n.config_file, un.node_name AS upstream_node_name "
 					  "      FROM repmgr.nodes n "
 					  " LEFT JOIN repmgr.nodes un "
 					  "        ON un.node_id = n.upstream_node_id"
@@ -2145,15 +2115,62 @@ get_all_node_records_with_upstream(PGconn *conn, NodeInfoList *node_list)
 
 	termPQExpBuffer(&query);
 
+	if (PQresultStatus(res) != PGRES_TUPLES_OK)
+	{
+		log_error(_("unable to retrieve node records"));
+		log_detail("%s", PQerrorMessage(conn));
+		PQclear(res);
+		return false;
+	}
+
 	_populate_node_records(res, node_list);
 
 	PQclear(res);
 
-	return;
+	return true;
 }
 
 
 
+bool
+get_downstream_nodes_with_missing_slot(PGconn *conn, int this_node_id, NodeInfoList *node_list)
+{
+	PQExpBufferData query;
+	PGresult   *res = NULL;
+
+	initPQExpBuffer(&query);
+
+	appendPQExpBuffer(&query,
+					  "   SELECT " REPMGR_NODES_COLUMNS
+					  "     FROM repmgr.nodes n "
+					  "LEFT JOIN pg_catalog.pg_replication_slots rs "
+					  "       ON rs.slot_name = n.slot_name "
+					  "    WHERE n.slot_name IS NOT NULL"
+                      "      AND rs.slot_name IS NULL "
+                      "      AND n.upstream_node_id = %i ",
+					  this_node_id);
+
+	log_verbose(LOG_DEBUG, "get_all_node_records_with_missing_slot():\n%s", query.data);
+
+	res = PQexec(conn, query.data);
+
+	termPQExpBuffer(&query);
+
+	if (PQresultStatus(res) != PGRES_TUPLES_OK)
+	{
+		log_error(_("unable to retrieve node records"));
+		log_detail("%s", PQerrorMessage(conn));
+		PQclear(res);
+		return false;
+	}
+
+	_populate_node_records(res, node_list);
+
+	PQclear(res);
+
+	return true;
+}
+
 bool
 create_node_record(PGconn *conn, char *repmgr_action, t_node_info *node_info)
 {
@@ -2271,9 +2288,11 @@ _create_update_node_record(PGconn *conn, char *action, t_node_info *node_info)
 
 	if (PQresultStatus(res) != PGRES_COMMAND_OK)
 	{
-		log_error(_("unable to %s node record:\n  %s"),
+		log_error(_("unable to %s node record for node \"%s\" (ID: %i)"),
 				  action,
-				  PQerrorMessage(conn));
+				  node_info->node_name,
+				  node_info->node_id);
+		log_detail("%s", PQerrorMessage(conn));
 		PQclear(res);
 		return false;
 	}
@@ -2292,8 +2311,7 @@ update_node_record_set_active(PGconn *conn, int this_node_id, bool active)
 
 	initPQExpBuffer(&query);
 
-	appendPQExpBuffer(
-					  &query,
+	appendPQExpBuffer(&query,
 					  "UPDATE repmgr.nodes SET active = %s "
 					  " WHERE node_id = %i",
 					  active == true ? "TRUE" : "FALSE",
@@ -2318,6 +2336,40 @@ update_node_record_set_active(PGconn *conn, int this_node_id, bool active)
 }
 
 
+bool
+update_node_record_set_active_standby(PGconn *conn, int this_node_id)
+{
+	PQExpBufferData query;
+	PGresult   *res = NULL;
+
+	initPQExpBuffer(&query);
+
+	appendPQExpBuffer(&query,
+					  "UPDATE repmgr.nodes "
+					  "   SET type = 'standby', "
+					  "       active = TRUE "
+					  " WHERE node_id = %i",
+					  this_node_id);
+
+	log_verbose(LOG_DEBUG, "update_node_record_set_active_standby():\n  %s", query.data);
+
+	res = PQexec(conn, query.data);
+	termPQExpBuffer(&query);
+
+	if (PQresultStatus(res) != PGRES_COMMAND_OK)
+	{
+		log_error(_("unable to update node record:\n  %s"),
+				  PQerrorMessage(conn));
+		PQclear(res);
+		return false;
+	}
+
+	PQclear(res);
+
+	return true;
+}
+
+
 bool
 update_node_record_set_primary(PGconn *conn, int this_node_id)
 {
@@ -2335,7 +2387,9 @@ update_node_record_set_primary(PGconn *conn, int this_node_id)
 					  "  UPDATE repmgr.nodes "
 					  "     SET active = FALSE "
 					  "   WHERE type = 'primary' "
-					  "     AND active IS TRUE ");
+					  "     AND active IS TRUE "
+					  "     AND node_id != %i ",
+					  this_node_id);
 
 	res = PQexec(conn, query.data);
 	termPQExpBuffer(&query);
@@ -2357,7 +2411,8 @@ update_node_record_set_primary(PGconn *conn, int this_node_id)
 	appendPQExpBuffer(&query,
 					  "  UPDATE repmgr.nodes"
 					  "     SET type = 'primary', "
-					  "         upstream_node_id = NULL "
+					  "         upstream_node_id = NULL, "
+					  "         active = TRUE "
 					  "   WHERE node_id = %i ",
 					  this_node_id);
 
@@ -2520,9 +2575,11 @@ witness_copy_node_records(PGconn *primary_conn, PGconn *witness_conn)
 		log_error(_("unable to defer constraints:\n  %s"),
 				  PQerrorMessage(witness_conn));
 		rollback_transaction(witness_conn);
+		PQclear(res);
 
 		return false;
 	}
+	PQclear(res);
 
 	/* truncate existing records */
 
@@ -2543,6 +2600,8 @@ witness_copy_node_records(PGconn *primary_conn, PGconn *witness_conn)
 	/* and done */
 	commit_transaction(witness_conn);
 
+	clear_node_info_list(&nodes);
+
 	return true;
 }
 
@@ -2557,7 +2616,7 @@ delete_node_record(PGconn *conn, int node)
 
 	appendPQExpBuffer(&query,
 					  "DELETE FROM repmgr.nodes "
-					  " WHERE node_id = %d",
+					  " WHERE node_id = %i",
 					  node);
 
 	log_verbose(LOG_DEBUG, "delete_node_record():\n  %s", query.data);
@@ -2627,23 +2686,29 @@ update_node_record_slot_name(PGconn *primary_conn, int node_id, char *slot_name)
 	return true;
 }
 
+
 void
 get_node_replication_stats(PGconn *conn, int server_version_num, t_node_info *node_info)
 {
 	PQExpBufferData query;
 	PGresult   *res = NULL;
 
+	if (server_version_num == UNKNOWN_SERVER_VERSION_NUM)
+		server_version_num = get_server_version(conn, NULL);
+
+	Assert(server_version_num != UNKNOWN_SERVER_VERSION_NUM);
+
 	initPQExpBuffer(&query);
 
 	appendPQExpBuffer(&query,
-					  " SELECT current_setting('max_wal_senders')::INT AS max_wal_senders, "
-					  "        (SELECT COUNT(*) FROM pg_catalog.pg_stat_replication) AS attached_wal_receivers, ");
+					  " SELECT pg_catalog.current_setting('max_wal_senders')::INT AS max_wal_senders, "
+					  "        (SELECT pg_catalog.count(*) FROM pg_catalog.pg_stat_replication) AS attached_wal_receivers, ");
 
 	/* no replication slots in PostgreSQL 9.3 */
 	if (server_version_num < 90400)
 	{
 		appendPQExpBuffer(&query,
-						  "        0 AS  max_replication_slots, "
+						  "        0 AS max_replication_slots, "
 						  "        0 AS total_replication_slots, "
 						  "        0 AS active_replication_slots, "
 						  "        0 AS inactive_replication_slots, ");
@@ -2652,16 +2717,16 @@ get_node_replication_stats(PGconn *conn, int server_version_num, t_node_info *no
 	{
 		appendPQExpBuffer(&query,
 						  "        current_setting('max_replication_slots')::INT AS max_replication_slots, "
-						  "        (SELECT COUNT(*) FROM pg_catalog.pg_replication_slots) AS total_replication_slots, "
-						  "        (SELECT COUNT(*) FROM pg_catalog.pg_replication_slots WHERE active = TRUE)  AS active_replication_slots, "
-						  "        (SELECT COUNT(*) FROM pg_catalog.pg_replication_slots WHERE active = FALSE) AS inactive_replication_slots, ");
+						  "        (SELECT pg_catalog.count(*) FROM pg_catalog.pg_replication_slots) AS total_replication_slots, "
+						  "        (SELECT pg_catalog.count(*) FROM pg_catalog.pg_replication_slots WHERE active IS TRUE)  AS active_replication_slots, "
+						  "        (SELECT pg_catalog.count(*) FROM pg_catalog.pg_replication_slots WHERE active IS FALSE) AS inactive_replication_slots, ");
 	}
 
 
 	appendPQExpBuffer(&query,
 					  "        pg_catalog.pg_is_in_recovery() AS in_recovery");
 
-
+	log_verbose(LOG_DEBUG, "get_node_replication_stats():\n%s", query.data);
 
 	res = PQexec(conn, query.data);
 	termPQExpBuffer(&query);
@@ -2698,7 +2763,7 @@ is_downstream_node_attached(PGconn *conn, char *node_name)
 	initPQExpBuffer(&query);
 
 	appendPQExpBuffer(&query,
-					  " SELECT COUNT(*) FROM pg_catalog.pg_stat_replication "
+					  " SELECT pg_catalog.count(*) FROM pg_catalog.pg_stat_replication "
 					  "  WHERE application_name = '%s'",
 					  node_name);
 	res = PQexec(conn, query.data);
@@ -2788,21 +2853,21 @@ get_datadir_configuration_files(PGconn *conn, KeyValueList *list)
 	appendPQExpBuffer(&query,
 					  "WITH files AS ( "
 					  "  WITH dd AS ( "
-					  "    SELECT setting "
+					  "   SELECT setting "
 					  "     FROM pg_catalog.pg_settings "
 					  "    WHERE name = 'data_directory') "
-					  " SELECT distinct(sourcefile) AS config_file"
-					  "   FROM dd, pg_catalog.pg_settings ps "
-					  "  WHERE ps.sourcefile IS NOT NULL "
-					  "    AND ps.sourcefile ~ ('^' || dd.setting) "
-					  "     UNION "
-					  "  SELECT ps.setting  AS config_file"
-					  "    FROM dd, pg_catalog.pg_settings ps "
-					  "   WHERE ps.name IN ( 'config_file', 'hba_file', 'ident_file') "
-					  "     AND ps.setting ~ ('^' || dd.setting) "
+					  "   SELECT distinct(sourcefile) AS config_file"
+					  "     FROM dd, pg_catalog.pg_settings ps "
+					  "    WHERE ps.sourcefile IS NOT NULL "
+					  "      AND ps.sourcefile ~ ('^' || dd.setting) "
+					  "       UNION "
+					  "   SELECT ps.setting  AS config_file"
+					  "     FROM dd, pg_catalog.pg_settings ps "
+					  "    WHERE ps.name IN ('config_file', 'hba_file', 'ident_file') "
+					  "      AND ps.setting ~ ('^' || dd.setting) "
 					  ") "
 					  "  SELECT config_file, "
-					  "         regexp_replace(config_file, '^.*\\/','') AS filename "
+					  "         pg_catalog.regexp_replace(config_file, '^.*\\/','') AS filename "
 					  "    FROM files "
 					  "ORDER BY config_file");
 
@@ -2895,7 +2960,7 @@ get_configuration_file_locations(PGconn *conn, t_configfile_list *list)
 					  "     WHERE name = 'data_directory' "
 					  "  ) "
 					  "    SELECT ps.setting, "
-					  "           regexp_replace(setting, '^.*\\/', '') AS filename, "
+					  "           pg_catalog.regexp_replace(setting, '^.*\\/', '') AS filename, "
 					  "           ps.setting ~ ('^' || dd.data_directory) AS in_data_dir "
 					  "      FROM dd, pg_catalog.pg_settings ps "
 					  "     WHERE ps.name IN ('hba_file', 'ident_file') "
@@ -3251,14 +3316,14 @@ _create_event(PGconn *conn, t_configuration_options *options, int node_id, char
 						}
 						break;
 					case 'p':
-						/* %p: former primary id ("repmgr standby switchover") */
+						/* %p: primary id ("standby_switchover": former primary id) */
 						src_ptr++;
-						if (event_info->former_primary_id != UNKNOWN_NODE_ID)
+						if (event_info->node_id != UNKNOWN_NODE_ID)
 						{
 							PQExpBufferData node_id;
 							initPQExpBuffer(&node_id);
 							appendPQExpBuffer(&node_id,
-											  "%i", event_info->former_primary_id);
+											  "%i", event_info->node_id);
 							strlcpy(dst_ptr, node_id.data, end_ptr - dst_ptr);
 							dst_ptr += strlen(dst_ptr);
 							termPQExpBuffer(&node_id);
@@ -3312,7 +3377,7 @@ get_event_records(PGconn *conn, int node_id, const char *node_name, const char *
 	/* LEFT JOIN used here as a node record may have been removed */
 	appendPQExpBuffer(&query,
 					  "   SELECT e.node_id, n.node_name, e.event, e.successful, "
-					  "          TO_CHAR(e.event_timestamp, 'YYYY-MM-DD HH24:MI:SS') AS timestamp, "
+					  "          pg_catalog.to_char(e.event_timestamp, 'YYYY-MM-DD HH24:MI:SS') AS timestamp, "
 					  "          e.details "
 					  "     FROM repmgr.events e "
 					  "LEFT JOIN repmgr.nodes n ON e.node_id = n.node_id ");
@@ -3401,6 +3466,9 @@ create_replication_slot(PGconn *conn, char *slot_name, int server_version_num, P
 	PGresult   *res = NULL;
 	t_replication_slot slot_info = T_REPLICATION_SLOT_INITIALIZER;
 
+	if (server_version_num == UNKNOWN_SERVER_VERSION_NUM)
+		server_version_num = get_server_version(conn, NULL);
+
 	/*
 	 * Check whether slot exists already; if it exists and is active, that
 	 * means another active standby is using it, which creates an error
@@ -3550,6 +3618,45 @@ get_slot_record(PGconn *conn, char *slot_name, t_replication_slot *record)
 	return RECORD_FOUND;
 }
 
+
+int
+get_free_replication_slots(PGconn *conn)
+{
+	PQExpBufferData query;
+	PGresult   *res = NULL;
+	int			free_slots = 0;
+
+	initPQExpBuffer(&query);
+
+	appendPQExpBuffer(&query,
+					  " SELECT pg_catalog.current_setting('max_replication_slots')::INT - "
+					  "        pg_catalog.count(*) AS free_slots"
+					  "   FROM pg_catalog.pg_replication_slots");
+
+	res = PQexec(conn, query.data);
+	termPQExpBuffer(&query);
+
+	if (PQresultStatus(res) != PGRES_TUPLES_OK)
+	{
+		log_error(_("unable to execute replication slot query"));
+		log_detail("%s", PQerrorMessage(conn));
+		PQclear(res);
+		return -1;
+	}
+
+	if (PQntuples(res) == 0)
+	{
+		PQclear(res);
+		return -1;
+	}
+
+	free_slots = atoi(PQgetvalue(res, 0, 0));
+
+	PQclear(res);
+	return free_slots;
+}
+
+
 /* ==================== */
 /* tablespace functions */
 /* ==================== */
@@ -3718,6 +3825,45 @@ is_server_available(const char *conninfo)
 }
 
 
+bool
+is_server_available_params(t_conninfo_param_list *param_list)
+{
+	PGPing		status = PQpingParams((const char **) param_list->keywords,
+									  (const char **) param_list->values,
+									  false);
+
+	/* deparsing the param_list adds overhead, so only do it if needed  */
+	if (log_level == LOG_DEBUG)
+	{
+		char *conninfo_str = param_list_to_string(param_list);
+		log_verbose(LOG_DEBUG, "ping status for %s is %i", conninfo_str, (int)status);
+		pfree(conninfo_str);
+	}
+
+	if (status == PQPING_OK)
+		return true;
+
+	return false;
+}
+
+
+
+/*
+ * Simple throw-away query to stop a connection handle going stale
+ */
+void
+connection_ping(PGconn *conn)
+{
+	PGresult   *res = PQexec(conn, "SELECT TRUE");
+
+	log_verbose(LOG_DEBUG, "connection_ping(): result is %s", PQresStatus(PQresultStatus(res)));
+
+	PQclear(res);
+	return;
+}
+
+
+
 /* ==================== */
 /* monitoring functions */
 /* ==================== */
@@ -3802,9 +3948,9 @@ get_number_of_monitoring_records_to_delete(PGconn *primary_conn, int keep_histor
 	initPQExpBuffer(&query);
 
 	appendPQExpBuffer(&query,
-					  "SELECT COUNT(*) "
+					  "SELECT pg_catalog.count(*) "
 					  "  FROM repmgr.monitoring_history "
-					  " WHERE age(now(), last_monitor_time) >= '%d days'::interval",
+					  " WHERE pg_catalog.age(pg_catalog.now(), last_monitor_time) >= '%d days'::interval",
 					  keep_history);
 
 	res = PQexec(primary_conn, query.data);
@@ -3843,7 +3989,7 @@ delete_monitoring_records(PGconn *primary_conn, int keep_history)
 	{
 		appendPQExpBuffer(&query,
 						  "DELETE FROM repmgr.monitoring_history "
-						  " WHERE age(now(), last_monitor_time) >= '%d days'::interval ",
+						  " WHERE pg_catalog.age(pg_catalog.now(), last_monitor_time) >= '%d days'::interval ",
 						  keep_history);
 	}
 	else
@@ -4141,7 +4287,7 @@ _is_bdr_db(PGconn *conn, PQExpBufferData *output, bool quiet)
 	initPQExpBuffer(&query);
 
 	appendPQExpBuffer(&query,
-					  "SELECT COUNT(*) FROM pg_catalog.pg_extension WHERE extname='bdr'");
+					  "SELECT pg_catalog.count(*) FROM pg_catalog.pg_extension WHERE extname='bdr'");
 
 	res = PQexec(conn, query.data);
 	termPQExpBuffer(&query);
@@ -4254,9 +4400,9 @@ is_bdr_repmgr(PGconn *conn)
 	initPQExpBuffer(&query);
 
 	appendPQExpBuffer(&query,
-					  "SELECT COUNT(*)"
-					  "  FROM repmgr.nodes"
-					  " WHERE type != 'bdr' ");
+					  "SELECT pg_catalog.count(*)"
+					  "  FROM repmgr.nodes n"
+					  " WHERE n.type != 'bdr' ");
 
 	res = PQexec(conn, query.data);
 	termPQExpBuffer(&query);
@@ -4285,8 +4431,8 @@ is_table_in_bdr_replication_set(PGconn *conn, const char *tablename, const char
 	initPQExpBuffer(&query);
 
 	appendPQExpBuffer(&query,
-					  "SELECT COUNT(*) "
-					  "  FROM UNNEST(bdr.table_get_replication_sets('repmgr.%s')) AS repset "
+					  "SELECT pg_catalog.count(*) "
+					  "  FROM pg_catalog.unnest(bdr.table_get_replication_sets('repmgr.%s')) AS repset "
 					  " WHERE repset='%s' ",
 					  tablename,
 					  set);
@@ -4425,9 +4571,9 @@ get_bdr_other_node_name(PGconn *conn, int node_id, char *node_name)
 	initPQExpBuffer(&query);
 
 	appendPQExpBuffer(&query,
-					  " SELECT node_name "
-					  "   FROM repmgr.nodes "
-					  "  WHERE node_id != %i",
+					  " SELECT n.node_name "
+					  "   FROM repmgr.nodes n "
+					  "  WHERE n.node_id != %i",
 					  node_id);
 
 	log_verbose(LOG_DEBUG, "get_bdr_other_node_name():\n  %s", query.data);
@@ -4664,8 +4810,8 @@ bdr_node_has_repmgr_set(PGconn *conn, const char *node_name)
 	initPQExpBuffer(&query);
 
 	appendPQExpBuffer(&query,
-					  " SELECT COUNT(*) "
-					  "   FROM UNNEST(bdr.connection_get_replication_sets('%s') AS repset "
+					  " SELECT pg_catalog.count(*) "
+					  "   FROM pg_catalog.unnest(bdr.connection_get_replication_sets('%s') AS repset "
 					  "  WHERE repset = 'repmgr'",
 					  node_name);
 
@@ -4700,7 +4846,7 @@ bdr_node_set_repmgr_set(PGconn *conn, const char *node_name)
 					  " SELECT bdr.connection_set_replication_sets( "
 					  "   ARRAY( "
 					  "     SELECT repset::TEXT "
-					  "       FROM UNNEST(bdr.connection_get_replication_sets('%s')) AS repset "
+					  "       FROM pg_catalog.unnest(bdr.connection_get_replication_sets('%s')) AS repset "
 					  "         UNION "
 					  "     SELECT 'repmgr'::TEXT "
 					  "   ), "

dbutils.h

@@ -28,7 +28,7 @@
 #include "strutil.h"
 #include "voting.h"
 
-#define REPMGR_NODES_COLUMNS "node_id, type, upstream_node_id, node_name, conninfo, repluser, slot_name, location, priority, active, config_file, '' AS upstream_node_name "
+#define REPMGR_NODES_COLUMNS "n.node_id, n.type, n.upstream_node_id, n.node_name, n.conninfo, n.repluser, n.slot_name, n.location, n.priority, n.active, n.config_file, '' AS upstream_node_name "
 #define BDR_NODES_COLUMNS "node_sysid, node_timeline, node_dboid, node_status, node_name, node_local_dsn, node_init_from_dsn, node_read_only, node_seq_id"
 
 #define ERRBUFF_SIZE 512
@@ -79,6 +79,14 @@ typedef enum
 	NODE_STATUS_UNCLEAN_SHUTDOWN
 } NodeStatus;
 
+typedef enum
+{
+	CONN_UNKNOWN = -1,
+	CONN_OK,
+	CONN_BAD,
+	CONN_ERROR
+} ConnectionStatus;
+
 typedef enum
 {
 	SLOT_UNKNOWN = -1,
@@ -175,7 +183,7 @@ typedef struct s_event_info
 {
 	char	   *node_name;
 	char	   *conninfo_str;
-	int			former_primary_id;
+	int			node_id;
 } t_event_info;
 
 #define T_EVENT_INFO_INITIALIZER { \
@@ -335,9 +343,6 @@ bool		atobool(const char *value);
 PGconn *establish_db_connection(const char *conninfo,
 						const bool exit_on_error);
 PGconn	   *establish_db_connection_quiet(const char *conninfo);
-PGconn *establish_db_connection_as_user(const char *conninfo,
-								const char *user,
-								const bool exit_on_error);
 
 PGconn *establish_db_connection_by_params(t_conninfo_param_list *param_list,
 								  const bool exit_on_error);
@@ -348,6 +353,7 @@ PGconn	   *get_primary_connection(PGconn *standby_conn, int *primary_id, char *p
 PGconn	   *get_primary_connection_quiet(PGconn *standby_conn, int *primary_id, char *primary_conninfo_out);
 
 bool		is_superuser_connection(PGconn *conn, t_connection_user *userinfo);
+void		close_connection(PGconn **conn);
 
 /* conninfo manipulation functions */
 bool		get_conninfo_value(const char *conninfo, const char *keyword, char *output);
@@ -359,7 +365,7 @@ void		conn_to_param_list(PGconn *conn, t_conninfo_param_list *param_list);
 void		param_set(t_conninfo_param_list *param_list, const char *param, const char *value);
 void		param_set_ine(t_conninfo_param_list *param_list, const char *param, const char *value);
 char	   *param_get(t_conninfo_param_list *param_list, const char *param);
-bool		parse_conninfo_string(const char *conninfo_str, t_conninfo_param_list *param_list, char *errmsg, bool ignore_local_params);
+bool		parse_conninfo_string(const char *conninfo_str, t_conninfo_param_list *param_list, char **errmsg, bool ignore_local_params);
 char	   *param_list_to_string(t_conninfo_param_list *param_list);
 bool		has_passfile(void);
 
@@ -381,7 +387,6 @@ bool		get_cluster_size(PGconn *conn, char *size);
 int			get_server_version(PGconn *conn, char *server_version);
 RecoveryType get_recovery_type(PGconn *conn);
 int			get_primary_node_id(PGconn *conn);
-bool		can_use_pg_rewind(PGconn *conn, const char *data_directory, PQExpBufferData *reason);
 int			get_ready_archive_files(PGconn *conn, const char *data_directory);
 bool		identify_system(PGconn *repl_conn, t_system_identification *identification);
 bool		repmgrd_set_local_node_id(PGconn *conn, int local_node_id);
@@ -400,6 +405,8 @@ t_server_type parse_node_type(const char *type);
 const char *get_node_type_string(t_server_type type);
 
 RecordStatus get_node_record(PGconn *conn, int node_id, t_node_info *node_info);
+RecordStatus get_node_record_with_upstream(PGconn *conn, int node_id, t_node_info *node_info);
+
 RecordStatus get_node_record_by_name(PGconn *conn, const char *node_name, t_node_info *node_info);
 t_node_info *get_node_record_pointer(PGconn *conn, int node_id);
 
@@ -410,7 +417,8 @@ void		get_all_node_records(PGconn *conn, NodeInfoList *node_list);
 void		get_downstream_node_records(PGconn *conn, int node_id, NodeInfoList *nodes);
 void		get_active_sibling_node_records(PGconn *conn, int node_id, int upstream_node_id, NodeInfoList *node_list);
 void		get_node_records_by_priority(PGconn *conn, NodeInfoList *node_list);
-void		get_all_node_records_with_upstream(PGconn *conn, NodeInfoList *node_list);
+bool		get_all_node_records_with_upstream(PGconn *conn, NodeInfoList *node_list);
+bool		get_downstream_nodes_with_missing_slot(PGconn *conn, int this_node_id, NodeInfoList *noede_list);
 
 bool		create_node_record(PGconn *conn, char *repmgr_action, t_node_info *node_info);
 bool		update_node_record(PGconn *conn, char *repmgr_action, t_node_info *node_info);
@@ -419,6 +427,7 @@ bool		truncate_node_records(PGconn *conn);
 
 bool		update_node_record_set_active(PGconn *conn, int this_node_id, bool active);
 bool		update_node_record_set_primary(PGconn *conn, int this_node_id);
+bool		update_node_record_set_active_standby(PGconn *conn, int this_node_id);
 bool		update_node_record_set_upstream(PGconn *conn, int this_node_id, int new_upstream_node_id);
 bool		update_node_record_status(PGconn *conn, int this_node_id, char *type, int upstream_node_id, bool active);
 bool		update_node_record_conn_priority(PGconn *conn, t_configuration_options *options);
@@ -445,6 +454,7 @@ void		create_slot_name(char *slot_name, int node_id);
 bool		create_replication_slot(PGconn *conn, char *slot_name, int server_version_num, PQExpBufferData *error_msg);
 bool		drop_replication_slot(PGconn *conn, char *slot_name);
 RecordStatus get_slot_record(PGconn *conn, char *slot_name, t_replication_slot *record);
+int			get_free_replication_slots(PGconn *conn);
 
 /* tablespace functions */
 bool		get_tablespace_name_by_location(PGconn *conn, const char *location, char *name);
@@ -455,6 +465,8 @@ int			wait_connection_availability(PGconn *conn, long long timeout);
 
 /* node availability functions */
 bool		is_server_available(const char *conninfo);
+bool		is_server_available_params(t_conninfo_param_list *param_list);
+void		connection_ping(PGconn *conn);
 
 /* monitoring functions  */
 void

dirutil.c

@@ -21,6 +21,7 @@
 
 #include <unistd.h>
 #include <dirent.h>
+#include <signal.h>
 #include <sys/stat.h>
 #include <errno.h>
 #include <stdio.h>
@@ -34,34 +35,33 @@
 #include "dirutil.h"
 #include "strutil.h"
 #include "log.h"
+#include "controldata.h"
 
 static int	unlink_dir_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf);
 
+/* PID can be negative if backend is standalone */
+typedef long pgpid_t;
 
 
 /*
- * make sure the directory either doesn't exist or is empty
- * we use this function to check the new data directory and
- * the directories for tablespaces
+ * Check if a directory exists, and if so whether it is empty.
  *
- * This is the same check initdb does on the new PGDATA dir
- *
- * Returns 0 if nonexistent, 1 if exists and empty, 2 if not empty,
- * or -1 if trouble accessing directory
+ * This function is used for checking both the data directory
+ * and tablespace directories.
  */
-int
+DataDirState
 check_dir(char *path)
 {
-	DIR		   *chkdir;
-	struct dirent *file;
-	int			result = 1;
+	DIR		   *chkdir = NULL;
+	struct dirent *file = NULL;
+	int			result = DIR_EMPTY;
 
 	errno = 0;
 
 	chkdir = opendir(path);
 
 	if (!chkdir)
-		return (errno == ENOENT) ? 0 : -1;
+		return (errno == ENOENT) ? DIR_NOENT : DIR_ERROR;
 
 	while ((file = readdir(chkdir)) != NULL)
 	{
@@ -73,25 +73,15 @@ check_dir(char *path)
 		}
 		else
 		{
-			result = 2;			/* not empty */
+			result = DIR_NOT_EMPTY;
 			break;
 		}
 	}
 
-#ifdef WIN32
-
-	/*
-	 * This fix is in mingw cvs (runtime/mingwex/dirent.c rev 1.4), but not in
-	 * released version
-	 */
-	if (GetLastError() == ERROR_NO_MORE_FILES)
-		errno = 0;
-#endif
-
 	closedir(chkdir);
 
 	if (errno != 0)
-		return -1;				/* some kind of I/O error? */
+		return DIR_ERROR;				/* some kind of I/O error? */
 
 	return result;
 }
@@ -106,12 +96,13 @@ create_dir(char *path)
 	if (mkdir_p(path, 0700) == 0)
 		return true;
 
-	log_error(_("unable to create directory \"%s\": %s"),
-			  path, strerror(errno));
+	log_error(_("unable to create directory \"%s\""), path);
+	log_detail("%s", strerror(errno));
 
 	return false;
 }
 
+
 bool
 set_dir_permissions(char *path)
 {
@@ -146,26 +137,6 @@ mkdir_p(char *path, mode_t omode)
 	oumask = 0;
 	retval = 0;
 
-#ifdef WIN32
-	/* skip network and drive specifiers for win32 */
-	if (strlen(p) >= 2)
-	{
-		if (p[0] == '/' && p[1] == '/')
-		{
-			/* network drive */
-			p = strstr(p + 2, "/");
-			if (p == NULL)
-				return 1;
-		}
-		else if (p[1] == ':' &&
-				 ((p[0] >= 'a' && p[0] <= 'z') ||
-				  (p[0] >= 'A' && p[0] <= 'Z')))
-		{
-			/* local drive */
-			p += 2;
-		}
-	}
-#endif
 
 	if (p[0] == '/')			/* Skip leading '/'. */
 		++p;
@@ -242,17 +213,91 @@ is_pg_dir(char *path)
 	return false;
 }
 
+/*
+ * Attempt to determine if a PostgreSQL data directory is in use
+ * by reading the pidfile. This is the same mechanism used by
+ * "pg_ctl".
+ *
+ * This function will abort with appropriate log messages if a file error
+ * is encountered, as the user will need to address the situation before
+ * any further useful progress can be made.
+ */
+PgDirState
+is_pg_running(char *path)
+{
+	long		pid;
+	FILE	   *pidf;
+
+	char pid_file[MAXPGPATH];
+
+	/* it's reasonable to assume the pidfile name will not change */
+	snprintf(pid_file, MAXPGPATH, "%s/postmaster.pid", path);
+
+	pidf = fopen(pid_file, "r");
+	if (pidf == NULL)
+	{
+		/*
+		 * No PID file - PostgreSQL shouldn't be running. From 9.3 (the
+		 * earliesty version we care about) removal of the PID file will
+		 * cause the postmaster to shut down, so it's highly unlikely
+		 * that PostgreSQL will still be running.
+		 */
+		if (errno == ENOENT)
+		{
+			return PG_DIR_NOT_RUNNING;
+		}
+		else
+		{
+			log_error(_("unable to open PostgreSQL PID file \"%s\""), pid_file);
+			log_detail("%s", strerror(errno));
+			exit(ERR_BAD_CONFIG);
+		}
+	}
+
+
+	/*
+	 * In the unlikely event we're unable to extract a PID from the PID file,
+	 * log a warning but assume we're not dealing with a running instance
+	 * as PostgreSQL should have shut itself down in these cases anyway.
+	 */
+	if (fscanf(pidf, "%ld", &pid) != 1)
+	{
+		/* Is the file empty? */
+		if (ftell(pidf) == 0 && feof(pidf))
+		{
+			log_warning(_("PostgreSQL PID file \"%s\" is empty"), path);
+		}
+		else
+		{
+			log_warning(_("invalid data in PostgreSQL PID file \"%s\""), path);
+		}
+
+		return PG_DIR_NOT_RUNNING;
+	}
+
+	fclose(pidf);
+
+	if (pid == getpid())
+		return PG_DIR_NOT_RUNNING;
+
+	if (pid == getppid())
+		return PG_DIR_NOT_RUNNING;
+
+	if (kill(pid, 0) == 0)
+		return PG_DIR_RUNNING;
+
+	return PG_DIR_NOT_RUNNING;
+}
+
 
 bool
 create_pg_dir(char *path, bool force)
 {
-	bool		pg_dir = false;
-
-	/* Check this directory could be used as a PGDATA dir */
+	/* Check this directory can be used as a PGDATA dir */
 	switch (check_dir(path))
 	{
-		case 0:
-			/* dir not there, must create it */
+		case DIR_NOENT:
+			/* directory does not exist, attempt to create it */
 			log_info(_("creating directory \"%s\"..."), path);
 
 			if (!create_dir(path))
@@ -262,52 +307,51 @@ create_pg_dir(char *path, bool force)
 				return false;
 			}
 			break;
-		case 1:
-			/* Present but empty, fix permissions and use it */
-			log_info(_("checking and correcting permissions on existing directory %s"),
+		case DIR_EMPTY:
+			/* exists but empty, fix permissions and use it */
+			log_info(_("checking and correcting permissions on existing directory \"%s\""),
 					 path);
 
 			if (!set_dir_permissions(path))
 			{
-				log_error(_("unable to change permissions of directory \"%s\":\n  %s"),
-						  path, strerror(errno));
+				log_error(_("unable to change permissions of directory \"%s\""), path);
+				log_detail("%s", strerror(errno));
 				return false;
 			}
 			break;
-		case 2:
-			/* Present and not empty */
+		case DIR_NOT_EMPTY:
+			/* exists but is not empty */
 			log_warning(_("directory \"%s\" exists but is not empty"),
 						path);
 
-			pg_dir = is_pg_dir(path);
-
-			if (pg_dir && force)
+			if (is_pg_dir(path))
 			{
-				/* TODO: check DB state, if not running overwrite */
-
-				if (false)
+				if (force == true)
 				{
-					log_notice(_("deleting existing data directory \"%s\""), path);
+					log_notice(_("-F/--force provided - deleting existing data directory \"%s\""), path);
 					nftw(path, unlink_dir_callback, 64, FTW_DEPTH | FTW_PHYS);
+					return true;
 				}
-				/* Let it continue */
-				break;
-			}
-			else if (pg_dir && !force)
-			{
-				log_hint(_("This looks like a PostgreSQL directory.\n"
-						   "If you are sure you want to clone here, "
-						   "please check there is no PostgreSQL server "
-						   "running and use the -F/--force option"));
+
 				return false;
 			}
-
-			return false;
-		default:
+			else
+			{
+				if (force == true)
+				{
+					log_notice(_("deleting existing directory \"%s\""), path);
+					nftw(path, unlink_dir_callback, 64, FTW_DEPTH | FTW_PHYS);
+					return true;
+				}
+				return false;
+			}
+			break;
+		case DIR_ERROR:
 			log_error(_("could not access directory \"%s\": %s"),
 					  path, strerror(errno));
 			return false;
 	}
+
 	return true;
 }
 

dirutil.h

@@ -19,12 +19,29 @@
 #ifndef _DIRUTIL_H_
 #define _DIRUTIL_H_
 
+typedef enum
+{
+	DIR_ERROR = -1,
+	DIR_NOENT,
+	DIR_EMPTY,
+	DIR_NOT_EMPTY
+} DataDirState;
+
+typedef enum
+{
+	PG_DIR_ERROR = -1,
+	PG_DIR_NOT_RUNNING,
+	PG_DIR_RUNNING
+} PgDirState;
+
 extern int	mkdir_p(char *path, mode_t omode);
 extern bool set_dir_permissions(char *path);
 
-extern int	check_dir(char *path);
+extern DataDirState	check_dir(char *path);
 extern bool create_dir(char *path);
 extern bool is_pg_dir(char *path);
+extern PgDirState is_pg_running(char *path);
 extern bool create_pg_dir(char *path, bool force);
 extern int rmdir_recursive(char *path);
+
 #endif

doc/appendix-faq.sgml

@@ -24,8 +24,9 @@
       series will no longer be actively maintained.
      </para>
      <para>
-      repmgr 2.x supports PostgreSQL 9.0 ~ 9.3. While it is compatible
-      with PostgreSQL 9.3, we recommend using repmgr 4.x.
+      &repmgr; 2.x supports PostgreSQL 9.0 ~ 9.3. While it is compatible
+      with PostgreSQL 9.3, we recommend using repmgr 4.x. &repmgr; 2.x is
+      no longer maintained.
      </para>
   </sect2>
 
@@ -35,7 +36,7 @@
     Replication slots, introduced in PostgreSQL 9.4, ensure that the
     primary server will retain WAL files until they have been consumed
     by all standby servers. This makes WAL file management much easier,
-    and if used `repmgr` will no longer insist on a fixed minimum number
+    and if used &repmgr; will no longer insist on a fixed minimum number
     (default: 5000) of WAL files being retained.
    </para>
    <para>
@@ -69,12 +70,50 @@
     in a streaming replication cluster.
    </para>
   </sect2>
+
+  <sect2 id="faq-upgrades" xreflabel="Upgrading PostgreSQL with repmgr">
+   <title>Can &repmgr; assist with upgrading a PostgreSQL cluster?</title>
+   <para>
+     For <emphasis>minor</emphasis> version upgrades, e.g. from 9.6.7 to 9.6.8, a common
+     approach is to upgrade a standby to the latest version, perform a
+     <link linkend="performing-switchover">switchover</link> promoting it to a primary,
+     then upgrade the former primary.
+   </para>
+   <para>
+     For <emphasis>major</emphasis> version upgrades (e.g. from PostgreSQL 9.6 to PostgreSQL 10),
+     the traditional approach is to "reseed" a cluster by upgrading a single
+     node with <ulink url="https://www.postgresql.org/docs/current/static/pgupgrade.html">pg_upgrade</ulink>
+     and recloning standbys from this.
+   </para>
+   <para>
+     To minimize downtime during major upgrades, for more recent PostgreSQL
+     versions (PostgreSQL 9.4 and later),
+     <ulink url="https://www.2ndquadrant.com/en/resources/pglogical/">pglogical</ulink>
+     can be used to set up a parallel cluster using the newer PostgreSQL version,
+     which can be kept in sync with the existing production cluster until the
+     new cluster is ready to be put into production.
+   </para>
+  </sect2>
+
+  <sect2 id="faq-libdir-repmgr-error">
+   <title>What does this error mean: <literal>ERROR: could not access file "$libdir/repmgr"</literal>?</title>
+   <para>
+     It means the &repmgr; extension code is not installed in the
+     PostgreSQL application directory. This typically happens when using PostgreSQL
+     packages provided by a third-party vendor, which often have different
+     filesystem layouts.
+   </para>
+   <para>
+     Either use PostgreSQL packages provided by the community or 2ndQuadrant; if this
+     is not possible, contact your vendor for assistance.
+   </para>
+  </sect2>
  </sect1>
 
  <sect1 id="faq-repmgr" xreflabel="repmgr">
   <title><command>repmgr</command></title>
 
-  <sect2 id="faq-register-existing-node" xreflabel="">
+  <sect2 id="faq-register-existing-node" xreflabel="registering an existing node">
    <title>Can I register an existing PostgreSQL server with repmgr?</title>
    <para>
     Yes, any existing PostgreSQL server which is part of the same replication
@@ -83,6 +122,26 @@
    </para>
   </sect2>
 
+  <sect2 id="faq-repmgr-clone-other-source" >
+   <title>Can I use a standby not cloned by &repmgr; as a &repmgr; node?</title>
+
+   <para>
+     For a standby which has been manually cloned or recovered from an external
+     backup manager such as Barman, the command
+     <command><link linkend="repmgr-standby-clone">repmgr standby clone --recovery-conf-only</link></command>
+     can be used to create the correct <filename>recovery.conf</filename> file for
+     use with &repmgr; (and will create a replication slot if required). Once this has been done,
+     <link linkend="repmgr-standby-register">register the node</link> as usual.
+   </para>
+  </sect2>
+
+  <sect2 id="faq-repmgr-recovery-conf" >
+    <title>What does &repmgr; write in <filename>recovery.conf</filename>, and what options can be set there?</title>
+   <para>
+     See section <link linkend="repmgr-standby-clone-recovery-conf">Customising recovery.conf</link>.
+   </para>
+  </sect2>
+
   <sect2 id="faq-repmgr-failed-primary-standby" xreflabel="Reintegrate a failed primary as a standby">
    <title>How can a failed primary be re-added as a standby?</title>
    <para>
@@ -91,19 +150,23 @@
     needs to be re-registered as a standby.
    </para>
    <para>
-    In PostgreSQL 9.5 and later, it's possible to use <command>pg_rewind</command>
-    to re-synchronise the existing data directory, which will usually be much
+    It's possible to use <command>pg_rewind</command> to re-synchronise the existing data
+    directory, which will usually be much
     faster than re-cloning the server. However <command>pg_rewind</command> can only
     be used if PostgreSQL either has <varname>wal_log_hints</varname> enabled, or
     data checksums were enabled when the cluster was initialized.
    </para>
    <para>
-    &repmgr; provides the command <command>repmgr node rejoin</command> which can
-    optionally execute <command>pg_rewind</command>; see the <xref linkend="repmgr-node-rejoin">
-    documentation for details.
+     Note that <command>pg_rewind</command> is available as part of the core PostgreSQL
+     distribution from PostgreSQL 9.5, and as a third-party utility for PostgreSQL 9.3 and 9.4.
    </para>
    <para>
-    If <command>pg_rewind</command> cannot be used, then the data directory will have
+    &repmgr; provides the command <command>repmgr node rejoin</command> which can
+    optionally execute <command>pg_rewind</command>; see the <xref linkend="repmgr-node-rejoin">
+    documentation for details, in particular the section <xref linkend="repmgr-node-rejoin-pg-rewind">.
+   </para>
+   <para>
+    If <command>pg_rewind</command> cannot be used, then the data directory will need
     to be re-cloned from scratch.
    </para>
 
@@ -180,6 +243,9 @@
    </para>
   </sect2>
 
+
+
+
  </sect1>
 
  <sect1 id="faq-repmgrd" xreflabel="repmgrd">

doc/appendix-packages.sgml

@@ -1,48 +1,118 @@
 <appendix id="appendix-packages" xreflabel="Package details">
- <indexterm>
-  <primary>packages</primary>
- </indexterm>
+  <indexterm>
+    <primary>packages</primary>
+  </indexterm>
 
- <title>&repmgr; package details</title>
- <para>
-   This section provides technical details about various &repmgr; binary
-   packages, such as location of the installed binaries and
-   configuration files.
- </para>
-
- <sect1 id="packages-centos" xreflabel="CentOS packages">
-  <title>CentOS, RHEL, Scientific Linux etc.</title>
+  <title>&repmgr; package details</title>
   <para>
-    Currently packages are provided for versions 6.x and 7.x of CentOS et al.
+    This section provides technical details about various &repmgr; binary
+    packages, such as location of the installed binaries and
+    configuration files.
   </para>
 
-  <note>
+  <sect1 id="packages-centos" xreflabel="CentOS packages">
+    <title>CentOS Packages</title>
+    <indexterm>
+      <primary>packages</primary>
+      <secondary>CentOS packages</secondary>
+    </indexterm>
     <para>
-      For PostgreSQL 9.6 and lower, the CentOS packages use a mixture of <literal>9.6</literal>
-      and <literal>96</literal> in various places to designate the major version;
-      from PostgreSQL 10, the first part of the version number (e.g. <literal>10</literal>) is
-      the major version, so there is more consistency in file/path/package naming.
+      Currently, &repmgr; RPM packages are provided for versions 6.x and 7.x of CentOS. These should also
+      work on matching versions of Red Hat Enterprise Linux, Scientific Linux and Oracle Enterprise Linux;
+      together with CentOS, these are the same RedHat-based distributions for which the main community project
+      (PGDG) provides packages (see the <ulink url="https://yum.postgresql.org/">PostgreSQL RPM Building Project</ulink>
+      page for details).
     </para>
-  </note>
+
+    <para>
+      Note these &repmgr; RPM packages are not designed to work with SuSE/OpenSuSE.
+    </para>
+
+    <note>
+      <para>
+        &repmgr; packages are designed to be compatible with community-provided PostgreSQL packages.
+        They may not work with vendor-specific packages such as those provided by RedHat for RHEL
+        customers, as the filesystem layout may be different to the community RPMs.
+        Please contact your support vendor for assistance.
+      </para>
+    </note>
+
+    <sect2 id="packages-centos-repositories">
+      <title>CentOS repositories</title>
+
+      <para>
+        &repmgr; packages are available from the 2ndQuadrant repository, and also the PostgreSQL
+        community repository. The 2ndQuadrant repository is updated immediately after each
+        &repmgr; release.
+      </para>
+
+      <table id="centos-2ndquadrant-repository">
+        <title>2ndQuadrant repository</title>
+        <tgroup cols="2">
+          <tbody>
+            <row>
+              <entry>Repository URL:</entry>
+              <entry><ulink url="http://packages.2ndquadrant.com/repmgr/">http://packages.2ndquadrant.com/repmgr/</ulink></entry>
+            </row>
+            <row>
+              <entry>Repository documentation:</entry>
+              <entry><ulink url="https://repmgr.org/docs/4.0/installation-packages.html#INSTALLATION-PACKAGES-REDHAT-2NDQ">https://repmgr.org/docs/4.0/installation-packages.html#INSTALLATION-PACKAGES-REDHAT-2NDQ</ulink></entry>
+            </row>
+          </tbody>
+        </tgroup>
+      </table>
+
+      <table id="centos-pgdg-repository">
+        <title>PostgreSQL community repository (PGDG)</title>
+        <tgroup cols="2">
+          <tbody>
+            <row>
+              <entry>Repository URL:</entry>
+              <entry><ulink url="https://yum.postgresql.org/repopackages.php">https://yum.postgresql.org/repopackages.php</ulink></entry>
+            </row>
+            <row>
+              <entry>Repository documentation:</entry>
+              <entry><ulink url="https://yum.postgresql.org/">https://yum.postgresql.org/</ulink></entry>
+            </row>
+          </tbody>
+        </tgroup>
+      </table>
+
+    </sect2>
+
+    <sect2 id="packages-centos-details">
+      <title>CentOS package details</title>
+
+      <para>
+        The two tables below list relevant information, paths, commands etc. for the &repmgr; packages on
+        CentOS 7 (with systemd) and CentOS 6 (no systemd). Substitute the appropriate PostgreSQL major
+        version number for your installation.
+      </para>
+
+      <note>
+        <para>
+          For PostgreSQL 9.6 and lower, the CentOS packages use a mixture of <literal>9.6</literal>
+          and <literal>96</literal> in various places to designate the major version; e.g. the
+          package name is <literal>repmgr96</literal>, but the binary directory is
+          <filename>/var/lib/pgsql/9.6/data</filename>.
+        </para>
+        <para>
+          From PostgreSQL 10, the first part of the version number (e.g. <literal>10</literal>) is
+          the major version, so there is more consistency in file/path/package naming
+          (package <literal>repmgr10</literal>, binary directory <filename>/var/lib/pgsql/10/data</filename>).
+        </para>
+      </note>
+
 
   <table id="centos-7-packages">
    <title>CentOS 7 packages</title>
 
    <tgroup cols="2">
     <tbody>
-     <row>
-      <entry>Repository URL:</entry>
-      <entry><ulink url="https://yum.postgresql.org/repopackages.php">https://yum.postgresql.org/repopackages.php</ulink></entry>
-     </row>
-
-     <row>
-      <entry>Repository documentation:</entry>
-      <entry><ulink url="https://yum.postgresql.org/">https://yum.postgresql.org/</ulink></entry>
-     </row>
 
      <row>
       <entry>Package name example:</entry>
-      <entry><filename>repmgr10-4.0.0-1.rhel7.x86_64</filename></entry>
+      <entry><filename>repmgr10-4.0.4-1.rhel7.x86_64</filename></entry>
      </row>
 
      <row>
@@ -52,7 +122,7 @@
 
      <row>
       <entry>Installation command:</entry>
-      <entry><literal>yum install -y repmgr10</literal></entry>
+      <entry><literal>yum install repmgr10</literal></entry>
      </row>
 
      <row>
@@ -61,7 +131,7 @@
      </row>
 
      <row>
-      <entry>In default path:</entry>
+      <entry>repmgr in default path:</entry>
       <entry>NO</entry>
      </row>
 
@@ -70,9 +140,14 @@
       <entry><filename>/etc/repmgr/10/repmgr.conf</filename></entry>
      </row>
 
+     <row>
+      <entry>Data directory:</entry>
+      <entry><filename>/var/lib/pgsql/10/data</filename></entry>
+     </row>
+
      <row>
       <entry>repmgrd service command:</entry>
-      <entry><literal>service repmgr10</literal></entry>
+      <entry><command>systemctl [start|stop|restart|reload] repmgr10</command></entry>
      </row>
 
      <row>
@@ -82,7 +157,7 @@
 
      <row>
       <entry>repmgrd log file location:</entry>
-      <entry>(not specified)</entry>
+      <entry>(not specified by package; set in <filename>repmgr.conf</filename>)</entry>
      </row>
 
     </tbody>
@@ -94,29 +169,20 @@
 
    <tgroup cols="2">
     <tbody>
-     <row>
-      <entry>Repository URL:</entry>
-      <entry><ulink url="https://yum.postgresql.org/repopackages.php">https://yum.postgresql.org/repopackages.php</ulink></entry>
-     </row>
-
-     <row>
-      <entry>Repository documentation:</entry>
-      <entry><ulink url="https://yum.postgresql.org/">https://yum.postgresql.org/</ulink></entry>
-     </row>
 
      <row>
       <entry>Package name example:</entry>
-      <entry><filename>repmgr96-4.0.0-1.rhel6.x86_64</filename></entry>
+      <entry><filename>repmgr96-4.0.4-1.rhel6.x86_64</filename></entry>
      </row>
 
      <row>
       <entry>Metapackage:</entry>
-      <entry>NO</entry>
+      <entry>(none)</entry>
      </row>
 
      <row>
       <entry>Installation command:</entry>
-      <entry><literal>yum install -y repmgr96</literal></entry>
+      <entry><literal>yum install repmgr96</literal></entry>
      </row>
 
      <row>
@@ -125,7 +191,7 @@
      </row>
 
      <row>
-      <entry>In default path:</entry>
+      <entry>repmgr in default path:</entry>
       <entry>NO</entry>
      </row>
 
@@ -134,9 +200,14 @@
       <entry><filename>/etc/repmgr/9.6/repmgr.conf</filename></entry>
      </row>
 
+     <row>
+      <entry>Data directory:</entry>
+      <entry><filename>/var/lib/pgsql/9.6/data</filename></entry>
+     </row>
+
      <row>
       <entry>repmgrd service command:</entry>
-      <entry>service repmgr-9.6</entry>
+      <entry><literal>service [start|stop|restart|reload] repmgr-9.6</literal></entry>
      </row>
 
      <row>
@@ -153,6 +224,143 @@
    </tgroup>
   </table>
 
-
+    </sect2>
  </sect1>
+
+
+
+
+  <sect1 id="packages-debian-ubuntu" xreflabel="Debian/Ubuntu packages">
+    <title>Debian/Ubuntu Packages</title>
+    <indexterm>
+      <primary>packages</primary>
+      <secondary>Debian/Ubuntu packages</secondary>
+    </indexterm>
+    <para>
+      &repmgr; <literal>.deb</literal> packages are provided via the
+      PostgreSQL Community APT repository, and are available for each community-supported
+      PostgreSQL version, currently supported Debian releases, and currently supported
+      Ubuntu LTS releases.
+    </para>
+
+    <sect2 id="packages-apt-repository">
+      <title>APT repository</title>
+
+      <para>
+        &repmgr; packages are available from the  PostgreSQL Community APT repository,
+        which is updated immediately after each &repmgr; release.
+      </para>
+
+
+      <table id="apt-repository">
+        <title>PostgreSQL Community APT repository (PGDG)</title>
+        <tgroup cols="2">
+          <tbody>
+            <row>
+              <entry>Repository URL:</entry>
+              <entry><ulink url="http://apt.postgresql.org/">http://apt.postgresql.org/</ulink></entry>
+            </row>
+            <row>
+              <entry>Repository documentation:</entry>
+              <entry><ulink url="https://wiki.postgresql.org/wiki/Apt)">https://wiki.postgresql.org/wiki/Apt)</ulink></entry>
+            </row>
+          </tbody>
+        </tgroup>
+      </table>
+    </sect2>
+
+   <sect2 id="packages-debian-details">
+      <title>Debian/Ubuntu package details</title>
+
+      <para>
+        The table below lists relevant information, paths, commands etc. for the &repmgr; packages on
+        Debian 9.x ("Stretch"). Substitute the appropriate PostgreSQL major
+        version number for your installation.
+      </para>
+      <para>
+        See also <xref linkend="repmgrd-configuration-debian-ubuntu"> for some specifics related
+        to configuring the <application>repmgrd</application> daemon.
+      </para>
+
+      <table id="debian-9-packages">
+        <title>Debian 9.x packages</title>
+
+        <tgroup cols="2">
+          <tbody>
+
+            <row>
+              <entry>Package name example:</entry>
+              <entry><filename>postgresql-10-repmgr</filename></entry>
+            </row>
+
+            <row>
+              <entry>Metapackage:</entry>
+              <entry><filename>repmgr-common</filename></entry>
+            </row>
+
+            <row>
+              <entry>Installation command:</entry>
+              <entry><literal>apt-get install postgresql-10-repmgr</literal></entry>
+            </row>
+
+            <row>
+              <entry>Binary location:</entry>
+              <entry><filename>/usr/lib/postgresql/10/bin</filename></entry>
+            </row>
+
+            <row>
+              <entry>repmgr in default path:</entry>
+              <entry>Yes (via wrapper script <filename>/usr/bin/repmgr</filename>)</entry>
+            </row>
+
+            <row>
+              <entry>Configuration file location:</entry>
+              <entry>(not set by package)</entry>
+            </row>
+
+            <row>
+              <entry>Data directory:</entry>
+              <entry><filename>/var/lib/postgresql/10/main</filename></entry>
+            </row>
+
+            <row>
+              <entry>PostgreSQL service command:</entry>
+              <entry><command>systemctl [start|stop|restart|reload] postgresql@10-main</command></entry>
+
+            </row>
+
+            <row>
+              <entry>repmgrd service command:</entry>
+              <entry><command>systemctl [start|stop|restart|reload] repmgrd</command></entry>
+            </row>
+
+            <row>
+              <entry>repmgrd service file location:</entry>
+              <entry><filename>/etc/init.d/repmgrd</filename> (defaults in: <filename>/etc/defaults/repmgrd</filename>)</entry>
+            </row>
+
+            <row>
+              <entry>repmgrd log file location:</entry>
+              <entry>(not specified by package; set in <filename>repmgr.conf</filename>)</entry>
+            </row>
+
+          </tbody>
+        </tgroup>
+      </table>
+      <note>
+        <para>
+          Instead of using the <application>systemd</application> service command directly,
+          it's recommended to execute <command>pg_ctlcluster</command> (as <literal>root</literal>,
+          either directly or via <command>sudo</command>), e.g.:
+          <programlisting>
+            <command>pg_ctlcluster 10 main [start|stop|restart|reload]</command></programlisting>
+        </para>
+        <para>
+          For pre-<application>systemd</application> systems, <command>pg_ctlcluster</command>
+          can be executed directly by the <literal>postgres</literal> user.
+        </para>
+      </note>
+   </sect2>
+
+  </sect1>
 </appendix>

doc/appendix-release-notes.sgml

@@ -11,18 +11,446 @@
     before performing an upgrade, as there may be version-specific upgrade steps.
   </para>
 
-
   <para>
     See also: <xref linkend="upgrading-repmgr">
   </para>
 
+  <sect1 id="release-4.0.5">
+    <title>Release 4.0.5</title>
+    <para><emphasis>Wed May 2, 2018</emphasis></para>
+    <para>
+      &repmgr; 4.0.5 contains a number of usability enhancements related to
+      <application>pg_rewind</application> usage, <filename>recovery.conf</filename>
+      generation and (in <application>repmgrd</application>) handling of various
+      corner-case situations, as well as a number of bug fixes.
+    </para>
+    <sect2>
+      <title>Usability enhancements</title>
+
+      <para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              Various documentation improvements, with particular emphasis on
+              the importance of setting appropriate <link linkend="configuration-service-commands">service commands</link>
+              instead of relying on <application>pg_ctl</application>.
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Poll demoted primary after restart as a standby during a switchover operation (GitHub #408).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Add configuration parameter <option>config_directory</option> (GitHub #424).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Add sanity check if <option>--upstream-node-id</option> not supplied when executing
+              <xref linkend="repmgr-standby-register"> (GitHub #395).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Enable <link linkend="repmgr-node-rejoin-pg-rewind">pg_rewind</link> to be used with
+              PostgreSQL 9.3/9.4 (GitHub #413).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              When generating replication connection strings, set <literal>dbname=replication</literal>
+              if appropriate (GitHub #421).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Enable provision of <option>archive_cleanup_command</option> in <filename>recovery.conf</filename>
+              (GitHub #416).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Actively check for node to <link linkend="repmgr-node-rejoin">rejoin</link> cluster (GitHub #415).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <application>repmgrd</application>: set <literal>connect_timeout=2</literal> (if not explicitly set)
+              when pinging a server.
+           </para>
+          </listitem>
+
+        </itemizedlist>
+      </para>
+
+    </sect2>
+
+   <sect2>
+      <title>Bug fixes</title>
+      <para>
+
+        <itemizedlist>
+
+          <listitem>
+            <para>
+              Fix display of conninfo parsing error messages.
+           </para>
+          </listitem>
+
+
+          <listitem>
+            <para>
+              Fix minimum accepted value for <varname>degraded_monitoring_timeout</varname> (GitHub #411).
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Fix superuser password handling (GitHub #400)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Fix parsing of <varname>archive_ready_critical</varname> configuration file parameter (GitHub #426).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              Fix <command><link linkend="repmgr-cluster-crosscheck">repmgr cluster crosscheck</link></command>
+              output (GitHub #389)
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+               Fix memory leaks in witness code (GitHub #402).
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <application>repmgrd</application>: handle <command>pg_ctl promote</command> timeout (GitHub #425).
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <application>repmgrd</application>: handle failover situation with only two nodes in the primary
+          location, and at least one node in another location (GitHub #407).
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+               <application>repmgrd</application>: prevent standby connection handle from going stale.
+           </para>
+          </listitem>
+
+
+
+        </itemizedlist>
+      </para>
+   </sect2>
+
+  </sect1>
+
+
+  <sect1 id="release-4.0.4">
+    <title>Release 4.0.4</title>
+    <para><emphasis>Fri Mar 9, 2018</emphasis></para>
+
+    <para>
+      &repmgr; 4.0.4 contains some bug fixes and and a number of
+      usability enhancements related to logging/diagnostics,
+      event notifications and pre-action checks.
+    </para>
+    <para>
+      This release can be installed as a simple package upgrade from repmgr 4.0 ~ 4.0.3;
+      <application>repmgrd</application> (if running) should be restarted. See <xref linkend="upgrading-repmgr">
+      for more details.
+    </para>
+
+    <note>
+      <para>
+        It is not possible to perform a switchover where the demotion candidate is
+        running &repmgr; 4.0.2 or lower; all nodes should be upgraded to the latest version (4.0.4).
+        This is due to additional checks introduced in 4.0.3 which require the presence of
+        4.0.3 or later versions on all nodes.
+      </para>
+    </note>
+
+    <sect2>
+      <title>Usability enhancements</title>
+
+      <para>
+        <itemizedlist>
+
+          <listitem>
+            <para>
+              add <command><link linkend="repmgr-standby-clone">repmgr standby clone --recovery-conf-only</link></command>
+              option to enable integration of a standby cloned from another source into a &repmgr; cluster (GitHub #382)
+            </para>
+          </listitem>
+
+         <listitem>
+            <para>
+              remove restriction on using replication slots when cloning from a Barman server (GitHub #379)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              make <command><link linkend="repmgr-standby-promote">repmgr standby promote</link></command>
+              timeout values configurable (GitHub #387)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              add missing options to main <literal>--help</literal> output (GitHub #391, #392)
+            </para>
+          </listitem>
+
+        </itemizedlist>
+      </para>
+
+    </sect2>
+
+    <sect2>
+      <title>Bug fixes</title>
+      <para>
+
+        <itemizedlist>
+
+          <listitem>
+            <para>
+              ensure <command><link linkend="repmgr-node-rejoin">repmgr node rejoin</link></command>
+              honours the <option>--dry-run</option> option (GitHub #383)
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              improve replication slot warnings generated by
+              <command><link linkend="repmgr-node-status">repmgr node status</link></command>
+              (GitHub #385)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              fix --superuser handling when cloning a standby (GitHub #380)
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <application>repmgrd</application>: improve detection of status change from primary to
+              standby
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <application>repmgrd</application>:  improve reconnection to the local node after a
+              failover (previously a connection error due to the node starting up was being
+              interpreted as the node being unavailable)
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <application>repmgrd</application>: when running on a witness server, correctly connect
+              to new primary after a failover
+           </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <application>repmgrd</application>: add <link linkend="event-notifications">event notification</link>
+              <literal>repmgrd_shutdown</literal> (GitHub #393)
+           </para>
+          </listitem>
+
+        </itemizedlist>
+
+      </para>
+    </sect2>
+
+  </sect1>
+
+  <sect1 id="release-4.0.3">
+    <title>Release 4.0.3</title>
+    <para><emphasis>Thu Feb 15, 2018</emphasis></para>
+
+    <para>
+      &repmgr; 4.0.3 contains some bug fixes and and a number of
+      usability enhancements related to logging/diagnostics,
+      event notifications and pre-action checks.
+    </para>
+
+    <para>
+      This release can be installed as a simple package upgrade from repmgr 4.0 ~ 4.0.2;
+      repmgrd (if running) should be restarted.
+    </para>
+    <note>
+      <para>
+        It is not possible to perform a switchover where the demotion candidate is
+        running &repmgr; 4.0.2 or lower; all nodes should be upgraded to 4.0.3. This is due
+        to additional checks introduced in 4.0.3 which require the presence of
+        4.0.3 or later versions on all nodes.
+      </para>
+    </note>
+    <sect2>
+      <title>Usability enhancements</title>
+
+      <para>
+        <itemizedlist>
+
+          <listitem>
+            <para>
+              improve <command><link linkend="repmgr-standby-switchover">repmgr standby switchover</link></command>
+              behaviour when <command>pg_ctl</command> is used to control the server and logging output is
+              not explicitly redirected
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              improve <command><link linkend="repmgr-standby-switchover">repmgr standby switchover</link></command>
+              log messages and provide new exit code <literal>ERR_SWITCHOVER_INCOMPLETE</literal> when old primary could
+              not be shut down cleanly
+            </para>
+          </listitem>
+
+         <listitem>
+            <para>
+              add check to verify the demotion candidate can make a replication connection to the
+              promotion candidate before executing a switchover (GitHub #370)
+            </para>
+         </listitem>
+
+         <listitem>
+            <para>
+              add check for sufficient walsenders and replication slots on the promotion candidate  before executing
+              <command><link linkend="repmgr-standby-switchover">repmgr standby switchover</link></command>
+              (GitHub #371)
+            </para>
+         </listitem>
+
+          <listitem>
+            <para>
+              add --dry-run mode to <command><link linkend="repmgr-standby-switchover">repmgr standby follow</link></command>
+              (GitHub #368)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              provide information about the primary node for
+              <command><link linkend="repmgr-standby-register">repmgr standby register</link></command> and
+              <command><link linkend="repmgr-standby-follow">repmgr standby follow</link></command> event notifications (GitHub #375)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              add <literal>standby_register_sync</literal> <link linkend="event-notifications">event notification</link>, which is fired when
+              <command><link linkend="repmgr-standby-register">repmgr standby register</link></command>
+              is run with the <option>--wait-sync</option> option and the new or updated standby node
+              record has synchronised to the standby (GitHub #374)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              when running <command><link linkend="repmgr-cluster-show">repmgr cluster show</link></command>,
+              if any node is unreachable, output the error message encountered in the list of warnings
+              (GitHub #369)
+            </para>
+          </listitem>
+
+        </itemizedlist>
+      </para>
+    </sect2>
+
+    <sect2>
+      <title>Bug fixes</title>
+
+      <para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              ensure an inactive data directory can be overwritten when
+              cloning a standby (GitHub #366)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <command><link linkend="repmgr-node-status">repmgr node status</link></command>
+              upstream node display fixed (GitHub #363)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <command><link linkend="repmgr-primary-unregister">repmgr primary unregister</link></command>:
+              clarify usage and fix <literal>--help</literal> output (GitHub #373)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              parsing of <varname>pg_basebackup_options</varname> fixed (GitHub #376)
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              ensure the <filename>pg_subtrans</filename> directory is created when cloning a
+              standby in Barman mode
+            </para>
+          </listitem>
+
+          <listitem>
+            <para>
+              <command><link linkend="repmgr-witness-register">repmgr witness register</link></command>:
+              fix primary node check (GitHub #377).
+            </para>
+          </listitem>
+        </itemizedlist>
+
+      </para>
+    </sect2>
+
+  </sect1>
+
+
   <sect1 id="release-4.0.2">
     <title>Release 4.0.2</title>
     <para><emphasis>Thu Jan 18, 2018</emphasis></para>
 
     <para>
-      repmgr 4.0.2 contains some bug fixes and minor usability enhancements.
+      &repmgr; 4.0.2 contains some bug fixes and small usability enhancements.
     </para>
+    <para>
+      This release can be installed as a simple package upgrade from &repmgr; 4.0.1 or 4.0;
+      <application>repmgrd</application> (if running) should be restarted.
+    </para>
+
     <sect2>
       <title>Usability enhancements</title>
 
@@ -121,7 +549,7 @@
   <para><emphasis>Wed Dec 13, 2017</emphasis></para>
 
   <para>
-    repmgr 4.0.1 is a bugfix release.
+    &repmgr; 4.0.1 is a bugfix release.
   </para>
   <sect2>
     <title>Bug fixes</title>

doc/cloning-standbys.sgml

@@ -51,7 +51,7 @@
    </itemizedlist>
    </para>
 
-  <sect2 id="cloning-from-barman-prerequisites" xreflabel="Prerequisites for cloning from Barman">
+  <sect2 id="cloning-from-barman-prerequisites">
    <title>Prerequisites for cloning from Barman</title>
    <para>
     In order to enable Barman support for <command>repmgr standby clone</command>, following
@@ -356,7 +356,7 @@
      By default, <command>pg_basebackup</command> performs a checkpoint before beginning the backup
      process. However, a normal checkpoint may take some time to complete;
      a fast checkpoint can be forced with the <literal>-c/--fast-checkpoint</literal> option.
-     However this may impact performance of the server being cloned from (typically the primary)
+     Note that this may impact performance of the server being cloned from (typically the primary)
      so should be used with care.
     </para>
     <tip>
@@ -384,11 +384,16 @@
 
    <sect2 id="cloning-advanced-managing-passwords" xreflabel="Managing passwords">
     <title>Managing passwords</title>
+    <indexterm>
+      <primary>cloning</primary>
+      <secondary>using passwords</secondary>
+    </indexterm>
+
     <para>
      If replication connections to a standby's upstream server are password-protected,
-     the standby must be able to provide the password so it can begin streaming
-     replication.
+     the standby must be able to provide the password so it can begin streaming replication.
     </para>
+
     <para>
      The recommended way to do this is to store the password in the <literal>postgres</literal> system
      user's <filename>~/.pgpass</filename> file. It's also possible to store the password in the
@@ -396,6 +401,17 @@
      security reasons. For more details see the
      <ulink url="https://www.postgresql.org/docs/current/static/libpq-pgpass.html">PostgreSQL password file documentation</ulink>.
     </para>
+
+    <note>
+      <para>
+        If using a <filename>pgpass</filename> file, an entry for the replication user (by default the
+        user who connects to the <literal>repmgr</literal> database) <emphasis>must</emphasis>
+        be provided, with database name set to <literal>replication</literal>, e.g.:
+        <programlisting>
+          node1:5432:replication:repmgr:12345</programlisting>
+      </para>
+    </note>
+
     <para>
      If, for whatever reason, you wish to include the password in <filename>recovery.conf</filename>,
      set <varname>use_primary_conninfo_password</varname> to <literal>true</literal> in
@@ -407,8 +423,7 @@
     </para>
     <para>
      It is of course also possible to include the password value in the <varname>conninfo</varname>
-     string for each node, but this is obviously a security risk and should be
-     avoided.
+     string for each node, but this is obviously a security risk and should be avoided.
     </para>
     <para>
       From PostgreSQL 9.6, <application>libpq</application> supports the <varname>passfile</varname>

doc/configuration-file-settings.sgml

@@ -1,10 +1,10 @@
 <sect1 id="configuration-file-settings" xreflabel="configuration file settings">
   <indexterm>
     <primary>repmgr.conf</primary>
-    <secondary>settings</secondary>
+    <secondary>basic settings</secondary>
   </indexterm>
 
- <title>Configuration file settings</title>
+ <title>Basic configuration file settings</title>
  <para>
    Each <filename>repmgr.conf</filename> file must contain the following parameters:
  </para>
@@ -92,7 +92,10 @@
 
   <para>
     For a full list of annotated configuration items, see the file
-    <ulink url="https://raw.githubusercontent.com/2ndQuadrant/repmgr/master/repmgr.conf.sample">repmgr.conf.sample</>.
+    <ulink url="https://raw.githubusercontent.com/2ndQuadrant/repmgr/master/repmgr.conf.sample">repmgr.conf.sample</ulink>.
+  </para>
+  <para>
+    For <application>repmgrd</application>-specific settings, see <xref linkend="repmgrd-configuration">.
   </para>
 
   <note>

doc/configuration-service-commands.sgml

@@ -0,0 +1,115 @@
+<sect1 id="configuration-service-commands" xreflabel="service command settings">
+  <indexterm>
+    <primary>repmgr.conf</primary>
+    <secondary>service command settings</secondary>
+  </indexterm>
+  <indexterm>
+    <primary>service command settings</primary>
+    <secondary>configuration in repmgr.conf</secondary>
+  </indexterm>
+  <title>Service command settings</title>
+
+  <para>
+    In some circumstances, &repmgr; (and <application>repmgrd</application>) need to
+    be able to stop, start or restart PostgreSQL. &repmgr; commands which need to do this
+    include <link linkend="repmgr-standby-follow"><command>repmgr standby follow</command></link>,
+    <link linkend="repmgr-standby-switchover"><command>repmgr standby switchover</command></link> and
+    <link linkend="repmgr-node-rejoin"><command>repmgr node rejoin</command></link>.
+  </para>
+  <para>
+    By default, &repmgr; will use PostgreSQL's <command>pg_ctl</command> to control the PostgreSQL
+    server. However this can lead to various problems, particularly when PostgreSQL has been
+    installed from packages, and expecially so if <application>systemd</application> is in use.
+  </para>
+
+
+  <note>
+    <para>
+      If using <application>systemd</application>, ensure you have <varname>RemoteIPC</varname> set to <literal>off</literal>.
+      See the <ulink url="https://wiki.postgresql.org/wiki/Systemd">systemd</ulink>
+      entry in the <ulink url="https://wiki.postgresql.org/wiki/Main_Page">PostgreSQL wiki</ulink> for details.
+    </para>
+  </note>
+
+
+  <para>
+    With this in mind, we recommend to <emphasis>always</emphasis> configure &repmgr; to use the
+    available system service commands.
+  </para>
+
+  <para>
+    To do this, specify the appropriate command for each action
+    in <filename>repmgr.conf</filename> using the following configuration
+    parameters:
+    <programlisting>
+    service_start_command
+    service_stop_command
+    service_restart_command
+    service_reload_command</programlisting>
+  </para>
+
+  <note>
+    <para>
+      It's also possible to specify a <varname>service_promote_command</varname>;
+      this overrides any value contained in the setting <varname>promote_command</varname>.
+      This is intended for systems which provide a package-level promote command,
+      such as Debian's <application>pg_ctlcluster</application>.
+    </para>
+  </note>
+
+  <para>
+    To confirm which command &repmgr; will execute for each action, use
+    <command>repmgr node service --list --action=...</command>, e.g.:
+    <programlisting>
+      repmgr -f /etc/repmgr.conf node service --list --action=stop
+      repmgr -f /etc/repmgr.conf node service --list --action=start
+      repmgr -f /etc/repmgr.conf node service --list --action=restart
+      repmgr -f /etc/repmgr.conf node service --list --action=reload</programlisting>
+  </para>
+
+  <para>
+     These commands will be executed by the system user which &repmgr; runs as (usually <literal>postgres</literal>)
+     and will probably require passwordless sudo access to be able to execute the command.
+  </para>
+  <para>
+    For example, using <application>systemd</application> on CentOS 7, the service commands can be
+    set as follows:
+    <programlisting>
+      service_start_command   = 'sudo systemctl start postgresql-9.6'
+      service_stop_command    = 'sudo systemctl stop postgresql-9.6'
+      service_restart_command = 'sudo systemctl restart postgresql-9.6'
+      service_reload_command  = 'sudo systemctl reload postgresql-9.6'</programlisting>
+    and <filename>/etc/sudoers</filename> should be set as follows:
+    <programlisting>
+      Defaults:postgres !requiretty
+      postgres ALL = NOPASSWD: /usr/bin/systemctl stop postgresql-9.6, \
+        /usr/bin/systemctl start postgresql-9.6, \
+        /usr/bin/systemctl restart postgresql-9.6 \
+        /usr/bin/systemctl reload postgresql-9.6</programlisting>
+  </para>
+
+  <important>
+    <indexterm>
+      <primary>pg_ctlcluster</primary>
+      <secondary>service command settings</secondary>
+    </indexterm>
+    <para>
+      Debian/Ubuntu users: instead of calling <command>sudo systemctl</command> directly, use
+      <command>sudo pg_ctlcluster</command>, e.g.:
+    <programlisting>
+      service_start_command   = 'sudo pg_ctlcluster 9.6 main start'
+      service_stop_command    = 'sudo pg_ctlcluster 9.6 main stop'
+      service_restart_command = 'sudo pg_ctlcluster 9.6 main restart'
+      service_reload_command  = 'sudo pg_ctlcluster 9.6 main reload'</programlisting>
+      and set <filename>/etc/sudoers</filename> accordingly.
+    </para>
+    <para>
+      While <command>pg_ctlcluster</command> will work when executed as user <literal>postgres</literal>,
+      it's strongly recommended to use <command>sudo pg_ctlcluster</command> on <application>systemd</application>
+      systems, to ensure <application>systemd</application> has a correct picture of
+      the PostgreSQL application state.
+    </para>
+
+  </important>
+
+</sect1>

doc/configuration.sgml

@@ -3,6 +3,7 @@
 
   &configuration-file;
   &configuration-file-settings;
+  &configuration-service-commands;
 
   <sect1 id="configuration-permissions" xreflabel="User permissions">
     <indexterm>

doc/event-notifications.sgml

@@ -37,7 +37,7 @@
   <filename>repmgr.conf</filename>.
  </para>
  <para>
-  This parameter accepts the following format placeholders:
+  The following format placeholders are provided for all event notifications:
  </para>
 
  <variablelist>
@@ -84,18 +84,8 @@
     </para>
    </listitem>
   </varlistentry>
-
-
-  <varlistentry>
-   <term><option>%p</option></term>
-   <listitem>
-    <para>
-     node ID of the demoted standby (<xref linkend="repmgr-standby-switchover"> only)
-    </para>
-   </listitem>
-  </varlistentry>
-
  </variablelist>
+
  <para>
   The values provided for <literal>%t</literal> and <literal>%d</literal>
   will probably contain spaces, so should be quoted in the provided command
@@ -104,34 +94,60 @@
     event_notification_command='/path/to/some/script %n %e %s "%t" "%d"'
   </programlisting>
  </para>
+
  <para>
-  Additionally the following format placeholders are available for the event
-  type <varname>bdr_failover</varname> and optionally <varname>bdr_recovery</varname>:
+   The following parameters are provided for a subset of event notifications:
  </para>
+
  <variablelist>
+  <varlistentry>
+   <term><option>%p</option></term>
+   <listitem>
+    <para>
+     node ID of the current primary (<xref linkend="repmgr-standby-register"> and <xref linkend="repmgr-standby-follow">)
+    </para>
+    <para>
+     node ID of the demoted primary (<xref linkend="repmgr-standby-switchover"> only)
+    </para>
+   </listitem>
+  </varlistentry>
   <varlistentry>
    <term><option>%c</option></term>
    <listitem>
     <para>
-     conninfo string of the next available node
+     <literal>conninfo</literal> string of the primary node
+     (<xref linkend="repmgr-standby-register"> and <xref linkend="repmgr-standby-follow">)
+    </para>
+    <para>
+      <literal>conninfo</literal> string of the next available node
+      (<varname>bdr_failover</varname> and  <varname>bdr_recovery</varname>)
     </para>
    </listitem>
   </varlistentry>
+
   <varlistentry>
    <term><option>%a</option></term>
    <listitem>
     <para>
-     name of the next available node
+     name of the current primary node (<xref linkend="repmgr-standby-register"> and <xref linkend="repmgr-standby-follow">)
+    </para>
+    <para>
+     name of the next available node (<varname>bdr_failover</varname> and  <varname>bdr_recovery</varname>)
     </para>
    </listitem>
   </varlistentry>
+
  </variablelist>
+
  <para>
-  These should always be quoted.
+  The values provided for <literal>%c</literal> and <literal>%a</literal>
+  will probably contain spaces, so should always be quoted.
  </para>
+
  <para>
   By default, all notification types will be passed to the designated script;
-  the notification types can be filtered to explicitly named ones:
+  the notification types can be filtered to explicitly named ones using the
+  <varname>event_notifications</varname> parameter:
 
   <itemizedlist spacing="compact" mark="bullet">
 
@@ -144,6 +160,9 @@
    <listitem>
     <simpara><literal>standby_register</literal></simpara>
    </listitem>
+   <listitem>
+    <simpara><literal>standby_register_sync</literal></simpara>
+   </listitem>
    <listitem>
     <simpara><literal>standby_unregister</literal></simpara>
    </listitem>
@@ -186,6 +205,21 @@
    <listitem>
     <simpara><literal>repmgrd_failover_follow</literal></simpara>
    </listitem>
+   <listitem>
+     <simpara><literal>repmgrd_failover_aborted</literal></simpara>
+   </listitem>
+   <listitem>
+    <simpara><literal>repmgrd_upstream_disconnect</literal></simpara>
+   </listitem>
+   <listitem>
+    <simpara><literal>repmgrd_upstream_reconnect</literal></simpara>
+   </listitem>
+   <listitem>
+    <simpara><literal>repmgrd_promote_error</literal></simpara>
+   </listitem>
+   <listitem>
+    <simpara><literal>repmgrd_failover_promote</literal></simpara>
+   </listitem>
    <listitem>
     <simpara><literal>bdr_failover</literal></simpara>
    </listitem>
@@ -204,6 +238,7 @@
 
   </itemizedlist>
  </para>
+
  <para>
   Note that under some circumstances (e.g. when no replication cluster primary
   could be located), it will not be possible to write an entry into the

doc/filelist.sgml

@@ -39,6 +39,7 @@
 <!ENTITY configuration      SYSTEM "configuration.sgml">
 <!ENTITY configuration-file      SYSTEM "configuration-file.sgml">
 <!ENTITY configuration-file-settings      SYSTEM "configuration-file-settings.sgml">
+<!ENTITY configuration-service-commands   SYSTEM "configuration-service-commands.sgml">
 <!ENTITY cloning-standbys  SYSTEM "cloning-standbys.sgml">
 <!ENTITY promoting-standby  SYSTEM "promoting-standby.sgml">
 <!ENTITY follow-new-primary  SYSTEM "follow-new-primary.sgml">

doc/install-packages.sgml

@@ -9,7 +9,7 @@
 
   <indexterm>
    <primary>installation</primary>
-   <secondary>on Redhat/CentOS/Fedora etc.</secondary>
+   <secondary>on Red Hat/CentOS/Fedora etc.</secondary>
   </indexterm>
 
   <title>RedHat/Fedora/CentOS</title>
@@ -26,6 +26,20 @@
    at the same time as each &repmgr; release, as it can take some days for
    them to become available via the main PGDG repository. See following section for details:
   </para>
+  <note>
+    <para>
+      &repmgr; packages are designed to be compatible with the community-provided PostgreSQL packages.
+      They may not work with vendor-specific packages such as those provided by RedHat for RHEL
+      customers, as the filesystem layout may be different to the community RPMs.
+      Please contact your support vendor for assistance.
+    </para>
+  </note>
+
+  <para>
+    For more information on the package contents, including details of installation
+    paths and relevant <link linkend="configuration-service-commands">service commands</link>,
+    see the appendix section <xref linkend="packages-centos">.
+  </para>
 
 
   <sect3 id="installation-packages-redhat-2ndq">
@@ -148,6 +162,12 @@
   Instructions can be found in the APT section of the PostgreSQL Wiki
   (<ulink url="https://wiki.postgresql.org/wiki/Apt">https://wiki.postgresql.org/wiki/Apt</ulink>).
   </para>
+  <para>
+    For more information on the package contents, including details of installation
+    paths and relevant <link linkend="configuration-service-commands">service commands</link>,
+    see the appendix section <xref linkend="packages-debian-ubuntu">.
+  </para>
+
  </sect2>
 
 </sect1>

doc/overview.sgml

@@ -2,7 +2,8 @@
  <title>repmgr overview</title>
 
  <para>
-  This chapter provides a high-level overview of repmgr's components and functionality.
+  This chapter provides a high-level overview of &repmgr;'s components and
+  functionality.
  </para>
  <sect1 id="repmgr-concepts" xreflabel="Concepts">
 
@@ -178,8 +179,8 @@
   <para>
    In order to effectively manage a replication cluster, &repmgr; needs to store
    information about the servers in the cluster in a dedicated database schema.
-   This schema is automatically by the &repmgr; extension, which is installed
-   during the first step in initialising a &repmgr;-administered cluster
+   This schema is automatically created by the &repmgr; extension, which is installed
+   during the first step in initializing a &repmgr;-administered cluster
    (<command><link linkend="repmgr-primary-register">repmgr primary register</link></command>)
    and contains the following objects:
    <variablelist>

doc/repmgr-bdr.sgml

@@ -1,37 +0,0 @@
-<chapter id="repmgrd-bdr">
-  <indexterm>
-    <primary>repmgrd</primary>
-    <secondary>BDR</secondary>
-  </indexterm>
-
-  <indexterm>
-    <primary>BDR</primary>
-  </indexterm>
-
-  <title>BDR failover with repmgrd</title>
-  <para>
-    &repmgr; 4.x provides support for monitoring BDR nodes and taking action in
-    case one of the nodes fails.
-  </para>
-  <note>
-    <simpara>
-      Due to the nature of BDR, it's only safe to use this solution for
-      a two-node scenario. Introducing additional nodes will create an inherent
-      risk of node desynchronisation if a node goes down without being cleanly
-      removed from the cluster.
-    </simpara>
-  </note>
-  <para>
-    In contrast to streaming replication, there's no concept of "promoting" a new
-    primary node with BDR. Instead, "failover" involves monitoring both nodes
-    with `repmgrd` and redirecting queries from the failed node to the remaining
-    active node. This can be done by using an
-    <link linkend="event-notifications">event notification</link> script
-    which is called by <application>repmgrd</application> to dynamically
-    reconfigure a proxy server/connection pooler such as <application>PgBouncer</application>.
-  </para>
-
-  <sect1 id="prerequisites" xreflable="BDR prequisites">
-  </sect1>
-</chapter>
-

doc/repmgr-node-rejoin.sgml

@@ -45,6 +45,77 @@
     </para>
   </refsect1>
 
+  <refsect1>
+
+    <title>Options</title>
+    <variablelist>
+
+      <varlistentry>
+        <term><option>--dry-run</option></term>
+        <listitem>
+          <para>
+            Check prerequisites but don't actually execute the rejoin.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--force-rewind[=/path/to/pg_rewind]</option></term>
+        <listitem>
+          <para>
+            Execute <application>pg_rewind</application> if necessary.
+          </para>
+          <para>
+            It is only necessary to provide the <application>pg_rewind</application>
+            if using PostgreSQL 9.3 or 9.4, and <application>pg_rewind</application>
+            is not installed in the PostgreSQL <filename>bin</filename> directory.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--config-files</option></term>
+        <listitem>
+          <para>
+            comma-separated list of configuration files to retain after
+            executing <application>pg_rewind</application>.
+          </para>
+          <para>
+            Currently <application>pg_rewind</application> will overwrite
+            the local node's configuration files with the files from the source node,
+            so it's advisable to use this option to ensure they are kept.
+          </para>
+        </listitem>
+      </varlistentry>
+
+
+      <varlistentry>
+        <term><option>--config-archive-dir</option></term>
+        <listitem>
+          <para>
+            Directory to temporarily store configuration files specified with
+            <option>--config-files</option>; default: <filename>/tmp</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+
+      <varlistentry>
+        <term><option>-W/--no-wait</option></term>
+        <listitem>
+          <para>
+            Don't wait for the node to rejoin cluster.
+          </para>
+          <para>
+            If this option is supplied, &repmgr; will restart the node but
+            not wait for it to connect to the primary.
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+  </refsect1>
+
   <refsect1>
     <title>Event notifications</title>
     <para>
@@ -77,11 +148,18 @@
   </refsect1>
 
   <refsect1 id="repmgr-node-rejoin-pg-rewind" xreflabel="Using pg_rewind">
+
+   <indexterm>
+      <primary>pg_rewind</primary>
+      <secondary>using with "repmgr node rejoin"</secondary>
+    </indexterm>
+
     <title>Using <command>pg_rewind</command></title>
     <para>
       <command>repmgr node rejoin</command> can optionally use <command>pg_rewind</command> to re-integrate a
       node which has diverged from the rest of the cluster, typically a failed primary.
-      <command>pg_rewind</command> is available in PostgreSQL 9.5 and later.
+      <command>pg_rewind</command> is available in PostgreSQL 9.5 and later as part of the core distribution,
+      and can be installed from external sources for PostgreSQL 9.3 and 9.4.
     </para>
     <note>
       <para>

doc/repmgr-primary-register.sgml

@@ -26,7 +26,7 @@
   <refsect1>
     <title>Execution</title>
     <para>
-      Execute with the <literal>--dry-run</literal> option to check what would happen without
+      Execute with the <option>--dry-run</option> option to check what would happen without
       actually registering the primary.
     </para>
     <para>
@@ -36,7 +36,7 @@
 
     <note>
     <para>
-      If providing the configuration file location with <literal>-f/--config-file</literal>,
+      If providing the configuration file location with <option>-f/--config-file</option>,
       avoid using a relative path, as &repmgr; stores the configuration file location
       in the repmgr metadata for use when &repmgr; is executed remotely (e.g. during
       <xref linkend="repmgr-standby-switchover">). &repmgr; will attempt to convert the
@@ -48,6 +48,33 @@
     </note>
   </refsect1>
 
+  <refsect1>
+
+    <title>Options</title>
+    <variablelist>
+
+      <varlistentry>
+        <term><option>--dry-run</option></term>
+        <listitem>
+          <para>
+            Check prerequisites but don't actually register the primary.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+       <term><option>-F</option>, <option>--force</option></term>
+        <listitem>
+          <para>
+            Overwrite an existing node record
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+  </refsect1>
+
+
   <refsect1>
     <title>Event notifications</title>
     <para>

doc/repmgr-primary-unregister.sgml

@@ -21,6 +21,10 @@
 
   <refsect1>
     <title>Execution</title>
+    <para>
+      <command>repmgr primary unregister</command> can be run on any active &repmgr; node,
+      with the ID of the node to unregister passed as <option>--node-id</option>.
+    </para>
     <para>
       Execute with the <literal>--dry-run</literal> option to check what would happen without
       actually unregistering the node.
@@ -32,6 +36,34 @@
     </para>
   </refsect1>
 
+  <refsect1>
+
+    <title>Options</title>
+
+    <variablelist>
+
+      <varlistentry>
+        <term><option>--dry-run</option></term>
+        <listitem>
+          <para>
+            Check prerequisites but don't actually unregister the primary.
+          </para>
+        </listitem>
+      </varlistentry>
+
+     <varlistentry>
+        <term><option>--node-id</option></term>
+        <listitem>
+          <para>
+            ID of the inactive primary to be unregistered.
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </refsect1>
+
   <refsect1>
     <title>Event notifications</title>
     <para>

doc/repmgr-standby-clone.sgml

@@ -25,9 +25,11 @@
     <note>
       <simpara>
         <command>repmgr standby clone</command> does not start the standby, and after cloning
-        <command>repmgr standby register</command> must be executed to notify &repmgr; of its presence.
+        a standby, the command <command>repmgr standby register</command> must be executed to
+        notify &repmgr; of its existence.
       </simpara>
     </note>
+
   </refsect1>
 
 
@@ -65,7 +67,71 @@
    </tip>
   </refsect1>
 
-  <refsect1 id="repmgr-standby-clone-wal-management" xreflabel="Managing WAL during the cloning process">
+  <refsect1 id="repmgr-standby-clone-recovery-conf">
+   <indexterm>
+     <primary>recovery.conf</primary>
+     <secondary>customising with "repmgr standby clone"</secondary>
+   </indexterm>
+
+   <title>Customising recovery.conf</title>
+   <para>
+     By default, &repmgr; will create a minimal <filename>recovery.conf</filename>
+     containing following parameters:
+   </para>
+
+   <itemizedlist spacing="compact" mark="bullet">
+
+     <listitem>
+       <simpara><varname>standby_mode</varname> (always <literal>'on'</literal>)</simpara>
+     </listitem>
+
+     <listitem>
+       <simpara><varname>recovery_target_timeline</varname> (always <literal>'latest'</literal>)</simpara>
+     </listitem>
+
+     <listitem>
+       <simpara><varname>primary_conninfo</varname></simpara>
+     </listitem>
+
+     <listitem>
+       <simpara><varname>primary_slot_name</varname> (if replication slots in use)</simpara>
+     </listitem>
+
+   </itemizedlist>
+
+   <para>
+     The following additional parameters can be specified in <filename>repmgr.conf</filename>
+     for inclusion in <filename>recovery.conf</filename>:
+   </para>
+
+   <itemizedlist spacing="compact" mark="bullet">
+
+     <listitem>
+       <simpara><varname>restore_command</varname></simpara>
+     </listitem>
+
+     <listitem>
+       <simpara><varname>archive_cleanup_command</varname></simpara>
+     </listitem>
+
+     <listitem>
+       <simpara><varname>recovery_min_apply_delay</varname></simpara>
+     </listitem>
+
+   </itemizedlist>
+
+   <note>
+     <para>
+       We recommend using <ulink url="https://www.pgbarman.org/">Barman</ulink> to manage
+       WAL file archiving. For more details on combining &repmgr; and <application>Barman</application>,
+       in particular using <varname>restore_command</varname> to configure Barman as a backu source of
+       WAL files, see <xref linkend="cloning-from-barman">.
+     </para>
+   </note>
+
+  </refsect1>
+
+  <refsect1 id="repmgr-standby-clone-wal-management">
    <title>Managing WAL during the cloning process</title>
    <para>
     When initially cloning a standby, you will need to ensure
@@ -100,6 +166,163 @@
    </note>
   </refsect1>
 
+
+  <refsect1 id="repmgr-standby-create-recovery-conf">
+
+   <indexterm>
+     <primary>recovery.conf</primary>
+     <secondary>generating for a standby cloned by another method</secondary>
+   </indexterm>
+
+   <title>Using a standby cloned by another method</title>
+   <para>
+     &repmgr; supports standbys cloned by another method (e.g. using <application>barman</application>'s
+     <command>barman recover</command> command).
+   </para>
+   <para>
+     To integrate the standby as a &repmgr; node, ensure the <filename>repmgr.conf</filename>
+     file is created for the node, then execute the command
+     <command>repmgr standby clone --recovery-conf-only</command>.
+     This will create the <filename>recovery.conf</filename> file needed to attach
+     the node to its upstream, and will also create a replication slot on the
+     upstream node if required.
+   </para>
+   <para>
+     Note that the upstream node must be running. An existing
+     <filename>recovery.conf</filename> will not be overwritten unless the
+     <option>-F/--force</option> option is provided.
+   </para>
+   <para>
+     Execute <command>repmgr standby clone --recovery-conf-only --dry-run</command>
+     to check the prerequisites for creating the <filename>recovery.conf</filename> file,
+     and display the contents of the file without actually creating it.
+   </para>
+
+   <note>
+     <para>
+       <option>--recovery-conf-only</option> was introduced in &repmgr; <link linkend="release-4.0.4">4.0.4</link>.
+     </para>
+   </note>
+
+  </refsect1>
+
+  <refsect1>
+
+    <title>Options</title>
+
+    <variablelist>
+
+      <varlistentry>
+        <term><option>--dry-run</option></term>
+        <listitem>
+          <para>
+            Check prerequisites but don't actually clone the standby.
+          </para>
+          <para>
+            If <option>--recovery-conf-only</option> specified, the contents of
+            the generated <filename>recovery.conf</filename> file will be displayed
+            but the file itself not written.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>-c, --fast-checkpoint</option></term>
+        <listitem>
+          <para>
+            Force fast checkpoint (not effective when cloning from Barman).
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--copy-external-config-files[={samepath|pgdata}]</option></term>
+        <listitem>
+          <para>
+            Copy configuration files located outside the data directory on the source
+            node to the same path on the standby (default) or to the
+            PostgreSQL data directory.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--no-upstream-connection</option></term>
+        <listitem>
+          <para>
+            When using Barman, do not connect to upstream node.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>-R, --remote-user=USERNAME</option></term>
+        <listitem>
+          <para>
+            Remote system username for SSH operations (default: current local system username).
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option> --recovery-conf-only</option></term>
+        <listitem>
+          <para>
+            Create <filename>recovery.conf</filename> file for a previously cloned instance. &repmgr 4.0.4 and later.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--replication-user</option></term>
+        <listitem>
+          <para>
+            User to make replication connections with (optional, not usually required).
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--superuser</option></term>
+        <listitem>
+          <para>
+            If the &repmgr; user is not a superuser, the name of a valid superuser must
+            be provided with this option.
+          </para>
+        </listitem>
+      </varlistentry>
+
+
+      <varlistentry>
+        <term><option>--upstream-conninfo</option></term>
+        <listitem>
+          <para>
+            <literal>primary_conninfo</literal> value to write in recovery.conf
+            when the intended upstream server does not yet exist.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--upstream-node-id</option></term>
+        <listitem>
+          <para>
+            ID of the upstream node to replicate from (optional, defaults to primary node)
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><option>--without-barman </option></term>
+        <listitem>
+          <para>
+            Do not use Barman even if configured.
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+  </refsect1>
+
   <refsect1>
     <title>Event notifications</title>
     <para>
@@ -107,5 +330,11 @@
     </para>
   </refsect1>
 
+  <refsect1>
+    <title>See also</title>
+    <para>
+      See <xref linkend="cloning-standbys"> for details about various aspects of cloning.
+    </para>
+  </refsect1>
 </refentry>
 

doc/repmgr-standby-follow.sgml

@@ -30,6 +30,7 @@
       To re-add an inactive node to the replication cluster, see
       <xref linkend="repmgr-node-rejoin">
     </para>
+
   </refsect1>
 
   <refsect1>
@@ -48,14 +49,56 @@
     </para>
   </refsect1>
 
+  <refsect1>
+    <title>Options</title>
+    <variablelist>
+
+      <varlistentry>
+        <term><option>--dry-run</option></term>
+        <listitem>
+          <para>
+            Check prerequisites but don't actually follow a new standby.
+          </para>
+          <important>
+            <para>
+              This does not guarantee the standby can follow the primary; in
+              particular, whether the primary and standby timelines have diverged,
+              can currently only be determined by actually attempting to
+              attach the standby to the primary.
+            </para>
+          </important>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>-w</option></term>
+        <term><option>--wait</option></term>
+        <listitem>
+          <para>
+            Wait for a primary to appear. &repmgr; will wait for up to
+            <varname>primary_follow_timeout</varname> seconds
+            (default: 60 seconds) to verify that the standby is following the new primary.
+            This value can be defined in <filename>repmgr.conf</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+  </refsect1>
+
   <refsect1>
     <title>Event notifications</title>
     <para>
       A <literal>standby_follow</literal> <link linkend="event-notifications">event notification</link> will be generated.
     </para>
+    <para>
+      If provided, &repmgr; will subsitute the placeholders <literal>%p</literal> with the node ID of the primary
+      being followed, <literal>%c</literal> with its <literal>conninfo</literal> string, and
+      <literal>%a</literal> with its node name.
+    </para>
   </refsect1>
 
- <refsect1>
+  <refsect1>
     <title>See also</title>
     <para>
      <xref linkend="repmgr-node-rejoin">

doc/repmgr-standby-promote.sgml

@@ -26,6 +26,12 @@
       by using <xref linkend="repmgr-standby-follow">; if <application>repmgrd</application>
         is active, it will handle this automatically.
     </para>
+    <para>
+      Note that &repmgr; will wait for up to <varname>promote_check_timeout</varname> seconds
+      (default: 60 seconds) to verify that the standby has been promoted, and will
+      check the promotion every <varname>promote_check_interval</varname> seconds (default: 1 second).
+      Both values can be defined in <filename>repmgr.conf</filename>.
+    </para>
   </refsect1>
 
   <refsect1>
@@ -42,6 +48,7 @@
     </para>
   </refsect1>
 
+
   <refsect1>
     <title>Event notifications</title>
     <para>

doc/repmgr-standby-register.sgml

@@ -57,16 +57,16 @@
   <refsect1 id="repmgr-standby-register-wait-sync" xreflabel="repmgr standby register --wait-sync">
    <title>Waiting for the registration to propagate to the standby</title>
    <para>
-     Depending on your environment and workload, it may take some time for
-     the standby's node record to propagate from the primary to the standby. Some
-     actions (such as starting <application>repmgrd</application>) require that the standby's node record
+     Depending on your environment and workload, it may take some time for the standby's node record
+     to propagate from the primary to the standby. Some actions (such as starting
+     <application>repmgrd</application>) require that the standby's node record
      is present and up-to-date to function correctly.
    </para>
    <para>
-    By providing the option <literal>--wait-sync</literal> to the
+    By providing the option <option>--wait-sync</option> to the
     <command>repmgr standby register</command> command, &repmgr; will wait
     until the record is synchronised before exiting. An optional timeout (in
-    seconds) can be added to this option (e.g. <literal>--wait-sync=60</literal>).
+    seconds) can be added to this option (e.g. <option>--wait-sync=60</option>).
    </para>
   </refsect1>
 
@@ -75,29 +75,109 @@
    <para>
     Under some circumstances you may wish to register a standby which is not
     yet running; this can be the case when using provisioning tools to create
-    a complex replication cluster. In this case, by using the <literal>-F/--force</literal>
+    a complex replication cluster. In this case, by using the <option>-F/--force</option>
     option and providing the connection parameters to the primary server,
     the standby can be registered.
    </para>
    <para>
     Similarly, with cascading replication it may be necessary to register
     a standby whose upstream node has not yet been registered - in this case,
-    using <literal>-F/--force</literal> will result in the creation of an inactive placeholder
+    using <option>-F/--force</option> will result in the creation of an inactive placeholder
     record for the upstream node, which will however later need to be registered
-    with the <literal>-F/--force</literal> option too.
+    with the <option>-F/--force</option> option too.
    </para>
    <para>
     When used with <command>repmgr standby register</command>, care should be taken that use of the
-    <literal>-F/--force</literal> option does not result in an incorrectly configured cluster.
+    <option>-F/--force</option> option does not result in an incorrectly configured cluster.
    </para>
   </refsect1>
 
+  <refsect1 id="repmgr-standby-register-node-cloned-other-source">
+    <title>Registering a node not cloned by repmgr</title>
+    <para>
+      If you've cloned a standby using another method (e.g. <application>barman</application>'s
+     <command>barman recover</command> command), first execute
+     <link linkend="repmgr-standby-create-recovery-conf">repmgr standby clone --recovery-conf-only</link>
+     to add the <filename>recovery.conf</filename> file, then register the standby as usual.
+    </para>
+  </refsect1>
+
+  <refsect1>
+
+    <title>Options</title>
+
+    <variablelist>
+
+      <varlistentry>
+        <term><option>--dry-run</option></term>
+        <listitem>
+          <para>
+            Check prerequisites but don't actually register the standby.
+          </para>
+        </listitem>
+      </varlistentry>
+
+
+      <varlistentry>
+       <term><option>-F</option><option>--force</option></term>
+        <listitem>
+          <para>
+            Overwrite an existing node record
+          </para>
+        </listitem>
+      </varlistentry>
+
+
+      <varlistentry>
+        <term><option>--upstream-node-id</option></term>
+        <listitem>
+          <para>
+            ID of the upstream node to replicate from (optional)
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--wait-start</option></term>
+        <listitem>
+          <para>
+            wait for the standby to start (timeout in seconds, default 30 seconds)
+          </para>
+        </listitem>
+      </varlistentry>
+
+     <varlistentry>
+        <term><option>--wait-sync</option></term>
+        <listitem>
+          <para>
+            wait for the node record to synchronise to the standby (optional timeout in seconds)
+          </para>
+        </listitem>
+      </varlistentry>
+
+
+    </variablelist>
+  </refsect1>
+
   <refsect1>
     <title>Event notifications</title>
     <para>
       A <literal>standby_register</literal> <link linkend="event-notifications">event notification</link>
-      will be generated.
+      will be generated immediately after the node record is updated on the primary.
     </para>
+
+    <para>
+      If the <option>--wait-sync</option> option is provided, a <literal>standby_register_sync</literal>
+      event notification  will be generated immediately after the node record has synchronised to the
+      standby.
+    </para>
+
+    <para>
+      If provided, &repmgr; will subsitute the placeholders <literal>%p</literal> with the node ID of the
+      primary node, <literal>%c</literal> with its <literal>conninfo</literal> string, and
+      <literal>%a</literal> with its node name.
+    </para>
+
   </refsect1>
 
 </refentry>

doc/repmgr-standby-switchover.sgml

@@ -22,8 +22,22 @@
     </para>
     <para>
       If other standbys are connected to the demotion candidate, &repmgr; can instruct
-    these to follow the new primary if the option <literal>--siblings-follow</literal>
-      is specified.
+      these to follow the new primary if the option <literal>--siblings-follow</literal>
+      is specified. This requires a passwordless SSH connection between the promotion
+      candidate (new primary) and the standbys attached to the demotion candidate
+      (existing primary).
+    </para>
+    <note>
+      <para>
+        Performing a switchover is a non-trivial operation. In particular it
+        relies on the current primary being able to shut down cleanly and quickly.
+        &repmgr; will attempt to check for potential issues but cannot guarantee
+        a successful switchover.
+      </para>
+    </note>
+    <para>
+      For more details on performing a switchover, including preparation and configuration,
+      see section <xref linkend="performing-switchover">.
     </para>
   </refsect1>
 
@@ -47,6 +61,13 @@
           <para>
             Check prerequisites but don't actually execute a switchover.
           </para>
+          <important>
+            <para>
+              Success of <option>--dry-run</option> does not imply the switchover will
+              complete successfully, only that
+              the prerequisites for performing the operation are met.
+            </para>
+          </important>
         </listitem>
       </varlistentry>
 
@@ -57,15 +78,24 @@
           <para>
             Ignore warnings and continue anyway.
           </para>
+          <para>
+            Specifically, if a problem is encountered when shutting down the current primary,
+            using <option>-F/--force</option> will cause &repmgr; to continue by promoting
+            the standby to be the new primary, and if <option>--siblings-follow</option> is
+            specified, attach any other standbys to the new primary.
+          </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
-        <term><option>--force-rewind</option></term>
+        <term><option>--force-rewind[=/path/to/pg_rewind]</option></term>
         <listitem>
           <para>
             Use <application>pg_rewind</application> to reintegrate the old primary if necessary
-            (PostgreSQL 9.5 and later).
+            (and the prerequisites for using <application>pg_rewind</application> are met).
+            If using PostgreSQL 9.3 or 9.4, and the <application>pg_rewind</application>
+            binary is not installed in the PostgreSQL <filename>bin</filename> directory,
+            provide its full path. For more details see also <xref linkend="switchover-pg-rewind">.
           </para>
         </listitem>
       </varlistentry>
@@ -92,6 +122,48 @@
 
   </refsect1>
 
+  <refsect1>
+    <title>Configuration file settings</title>
+
+    <para>
+     Note that following parameters in <filename>repmgr.conf</filename> are relevant to the
+     switchover operation:
+     <itemizedlist spacing="compact" mark="bullet">
+       <listitem>
+         <simpara>
+           <literal>reconnect_attempts</literal>: number of times to check the original primary
+           for a clean shutdown after executing the shutdown command, before aborting
+         </simpara>
+       </listitem>
+       <listitem>
+         <simpara>
+           <literal>reconnect_interval</literal>: interval (in seconds) to check the original
+           primary for a clean shutdown after executing the shutdown command (up to a maximum
+           of <literal>reconnect_attempts</literal> tries)
+         </simpara>
+       </listitem>
+       <listitem>
+         <simpara>
+           <literal>replication_lag_critical</literal>:
+           if replication lag (in seconds) on the standby exceeds this value, the
+           switchover will be aborted (unless the <literal>-F/--force</literal> option
+           is provided)
+         </simpara>
+       </listitem>
+
+       <listitem>
+         <simpara>
+           <literal>standby_reconnect_timeout</literal>:
+           Number of seconds to attempt to reconnect to the demoted primary
+           once it has been restarted.
+         </simpara>
+       </listitem>
+
+     </itemizedlist>
+    </para>
+  </refsect1>
+
+
   <refsect1>
     <title>Execution</title>
 
@@ -103,6 +175,11 @@
       <application>repmgrd</application> should not be active on any nodes while a switchover is being
       executed. This restriction may be lifted in a later version.
     </para>
+    <para>
+      External database connections, e.g. from an application, should not be permitted while
+      the switchover is taking place. In particular, active transactions on the primary
+      can potentially disrupt the shutdown process.
+    </para>
   </refsect1>
 
   <refsect1>
@@ -115,10 +192,48 @@
     <para>
       If using an event notification script, <literal>standby_switchover</literal>
       will populate the placeholder parameter <literal>%p</literal> with the node ID of
-      the former standby.
+      the former primary.
     </para>
   </refsect1>
 
+  <refsect1>
+    <title>Exit codes</title>
+    <para>
+      Following exit codes can be emitted by <literal>repmgr standby switchover</literal>:
+    </para>
+    <variablelist>
+
+      <varlistentry>
+        <term><option>SUCCESS (0)</option></term>
+        <listitem>
+          <para>
+            The switchover completed successfully.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>ERR_SWITCHOVER_FAIL (18)</option></term>
+        <listitem>
+          <para>
+            The switchover could not be executed.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>ERR_SWITCHOVER_INCOMPLETE (22)</option></term>
+        <listitem>
+          <para>
+            The switchover was executed but a problem was encountered.
+            Typically this means the former primary could not be reattached
+            as a standby.
+          </para>
+        </listitem>
+      </varlistentry>
+
+   </variablelist>
+  </refsect1>
 
   <refsect1>
     <title>See also</title>

doc/repmgr-standby-unregister.sgml

@@ -43,6 +43,22 @@
     </para>
   </refsect1>
 
+  <refsect1>
+    <title>Options</title>
+    <variablelist>
+
+      <varlistentry>
+        <term><option>--node-id</option></term>
+        <listitem>
+          <para>
+            <varname>node_id</varname> of the node to unregister (optional)
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+  </refsect1>
+
   <refsect1>
     <title>Event notifications</title>
     <para>

doc/repmgrd-bdr.sgml

@@ -24,7 +24,7 @@
   <para>
     In contrast to streaming replication, there's no concept of "promoting" a new
     primary node with BDR. Instead, "failover" involves monitoring both nodes
-    with `repmgrd` and redirecting queries from the failed node to the remaining
+    with <application>repmgrd</application> and redirecting queries from the failed node to the remaining
     active node. This can be done by using an
     <link linkend="event-notifications">event notification</link> script
     which is called by <application>repmgrd</application> to dynamically
@@ -174,17 +174,13 @@
     <para>
       Key to "failover" execution is the <literal>event_notification_command</literal>,
       which is a user-definable script specified in <filename>repmpgr.conf</filename>
-      and which should reconfigure the proxy server/ connection pooler to point
-      to the other, still-active node.
+      and which can use a &repmgr; <link linkend="event-notifications">event notification</link>
+      to reconfigure the proxy server / connection pooler so it points to the other, still-active node.
+      Details of the event will be passed as parameters to the script.
     </para>
     <para>
-      Each time &repmgr; (or <application>repmgrd</application>) records an event,
-      it can optionally execute the script defined in
-      <literal>event_notification_command</literal> to take further action;
-      details of the event will be passed as parameters.
-    </para>
-    <para>
-      Following placeholders are available to the script:
+      Following parameter placeholders are available for the script definition in <filename>repmpgr.conf</filename>;
+      these will be replaced with the appropriate value when the script is executed:
     </para>
 
     <variablelist>
@@ -231,20 +227,37 @@
           </para>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term><option>%c</option></term>
+        <listitem>
+          <para>
+            conninfo string of the next available node (<varname>bdr_failover</varname> and <varname>bdr_recovery</varname>)
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><option>%a</option></term>
+        <listitem>
+          <para>
+            name of the next available node (<varname>bdr_failover</varname> and <varname>bdr_recovery</varname>)
+          </para>
+        </listitem>
+      </varlistentry>
     </variablelist>
 
     <para>
-      Note that <literal>%c</literal> and <literal>%a</literal> will only be provided during
-      <varname>bdr_failover</varname> events, which is what is of interest here.
+      Note that <literal>%c</literal> and <literal>%a</literal> are only provided with
+      particular failover events, in this case <varname>bdr_failover</varname>.
     </para>
     <para>
-      The provided sample script (`scripts/bdr-pgbouncer.sh`) is configured like
-      this:
+      The provided sample script
+     (<literal><ulink url="https://raw.githubusercontent.com/2ndQuadrant/repmgr/master/scripts/bdr-pgbouncer.sh">scripts/bdr-pgbouncer.sh</ulink></literal>)
+      is configured as follows:
       <programlisting>
         event_notification_command='/path/to/bdr-pgbouncer.sh %n %e %s "%c" "%a"'</programlisting>
     </para>
     <para>
-      and parses the configures parameters like this:
+      and parses the placeholder parameters like this:
       <programlisting>
         NODE_ID=$1
         EVENT_TYPE=$2
@@ -252,12 +265,14 @@
         NEXT_CONNINFO=$4
         NEXT_NODE_NAME=$5</programlisting>
     </para>
-    <para>
-      The script also contains some hard-coded values about the <application>PgBouncer</application>
-      configuration for both nodes; these will need to be adjusted for your local environment
-      (ideally the scripts would be maintained as templates and generated by some
-      kind of provisioning system).
-    </para>
+    <note>
+      <para>
+        The sample script also contains some hard-coded values for the <application>PgBouncer</application>
+        configuration for both nodes; these will need to be adjusted for your local environment
+        (ideally the scripts would be maintained as templates and generated by some
+        kind of provisioning system).
+      </para>
+    </note>
 
     <para>
       The script performs following steps:

doc/repmgrd-configuration.sgml

@@ -1,60 +1,233 @@
 <chapter id="repmgrd-configuration">
 
- <indexterm>
-   <primary>repmgrd</primary>
-   <secondary>configuration</secondary>
- </indexterm>
+  <indexterm>
+    <primary>repmgrd</primary>
+    <secondary>configuration</secondary>
+  </indexterm>
 
- <title>repmgrd configuration</title>
- <para>
-  To use <application>repmgrd</application>, its associated function library must be
-  included in <filename>postgresql.conf</filename> with:
+  <title>repmgrd configuration</title>
 
-  <programlisting>
-    shared_preload_libraries = 'repmgr'</programlisting>
- </para>
- <para>
-  Changing this setting requires a restart of PostgreSQL; for more details see
-  the <ulink url="https://www.postgresql.org/docs/current/static/runtime-config-client.html#GUC-SHARED-PRELOAD-LIBRARIES">PostgreSQL documentation</ulink>.
- </para>
- <para>
-  Additionally the following <application>repmgrd</application> options *must* be set in
-  <filename>repmgr.conf</filename> (adjust configuration file locations as appropriate):
-  <programlisting>
-    failover=automatic
-    promote_command='repmgr standby promote -f /etc/repmgr.conf --log-to-file'
-    follow_command='repmgr standby follow -f /etc/repmgr.conf --log-to-file --upstream-node-id=%n'</programlisting>
- </para>
- <para>
-  Note that the <literal>--log-to-file</literal> option will cause
-  output generated by the &repmgr; command, when executed by <application>repmgrd</application>,
-  to be logged to the same destination configured to receive log output for <application>repmgrd</application>.
-  See <filename>repmgr.conf.sample</filename> for further <application>repmgrd</application>-specific settings.
- </para>
- <para>
-  When <varname>failover</varname> is set to <literal>automatic</literal>, upon detecting failure
-  of the current  primary, <application>repmgrd</application> will execute one of
-  <varname>promote_command</varname> or <varname>follow_command</varname>,
-  depending on whether the current server is to become the new primary, or
-  needs to follow another server which has become the new primary. Note that
-  these commands can be any valid shell script which results in one of these
-  two actions happening, but if &repmgr;'s <command>standby follow</command> or
-  <command>standby promote</command>
-  commands are not executed (either directly as shown here, or from a script which
-  performs other actions), the &repmgr; metadata will not be updated and
-  &repmgr; will no longer function reliably.
- </para>
- <para>
-  The <varname>follow_command</varname> should provide the <literal>--upstream-node-id=%n</literal>
-  option to <command>repmgr standby follow</command>; the <literal>%n</literal> will be replaced by
-  <application>repmgrd</application> with the ID of the new primary node. If this is not provided, &repmgr;
-  will attempt to determine the new primary by itself, but  if the
-  original primary comes back online after the new primary is promoted, there is a risk that
-  <command>repmgr standby follow</command> will result in the node continuing to follow
-  the original primary.
- </para>
- <sect1 id="repmgrd-connection-settings">
- <title>repmgrd connection settings</title>
+  <para>
+    <application>repmgrd</application> is a daemon which runs on each PostgreSQL node,
+    monitoring the local node, and (unless it's the primary node) the upstream server
+    (the primary server or with cascading replication, another standby) which it's
+    connected to.
+  </para>
+  <para>
+    <application>repmgrd</application> can be configured to provide failover
+    capability in case the primary upstream node becomes unreachable, and/or
+    provide monitoring data to the &repmgr; metadatabase.
+  </para>
+
+  <sect1 id="repmgrd-basic-configuration">
+    <title>repmgrd basic configuration</title>
+
+    <para>
+      To use <application>repmgrd</application>, its associated function library <emphasis>must</emphasis> be
+      included in <filename>postgresql.conf</filename> with:
+
+      <programlisting>
+        shared_preload_libraries = 'repmgr'</programlisting>
+    </para>
+    <para>
+      Changing this setting requires a restart of PostgreSQL; for more details see
+      the <ulink url="https://www.postgresql.org/docs/current/static/runtime-config-client.html#GUC-SHARED-PRELOAD-LIBRARIES">PostgreSQL documentation</ulink>.
+    </para>
+
+    <sect2 id="repmgrd-automatic-failover-configuration">
+      <title>automatic failover configuration</title>
+      <para>
+        If using automatic failover, the following <application>repmgrd</application> options *must* be set in
+        <filename>repmgr.conf</filename> :
+        <programlisting>
+          failover=automatic
+          promote_command='/usr/bin/repmgr standby promote -f /etc/repmgr.conf --log-to-file'
+          follow_command='/usr/bin/repmgr standby follow -f /etc/repmgr.conf --log-to-file --upstream-node-id=%n'</programlisting>
+      </para>
+      <para>
+        Adjust file paths as appropriate; we recomment specifying the full path to the &repmgr; binary.
+      </para>
+      <para>
+        Note that the <literal>--log-to-file</literal> option will cause
+        output generated by the &repmgr; command, when executed by <application>repmgrd</application>,
+        to be logged to the same destination configured to receive log output for <application>repmgrd</application>.
+        See <filename><ulink url="https://raw.githubusercontent.com/2ndQuadrant/repmgr/master/repmgr.conf.sample">repmgr.conf.sample</ulink></filename>
+        for further <application>repmgrd</application>-specific settings.
+      </para>
+      <para>
+        When <varname>failover</varname> is set to <literal>automatic</literal>, upon detecting failure
+        of the current  primary, <application>repmgrd</application> will execute one of:
+      </para>
+      <itemizedlist spacing="compact" mark="bullet">
+        <listitem>
+          <simpara>
+            <varname>promote_command</varname> (if the current server is to become the new primary)
+          </simpara>
+        </listitem>
+        <listitem>
+          <simpara>
+            <varname>follow_command</varname> (if the current server needs to follow another server which has
+            become the new primary)
+          </simpara>
+        </listitem>
+      </itemizedlist>
+      <note>
+        <para>
+          These commands can be any valid shell script which results in one of these
+          two actions happening, but if &repmgr;'s <command>standby follow</command> or
+          <command>standby promote</command>
+          commands are not executed (either directly as shown here, or from a script which
+          performs other actions), the &repmgr; metadata will not be updated and
+          &repmgr; will no longer function reliably.
+        </para>
+      </note>
+
+      <para>
+        The <varname>follow_command</varname> should provide the <literal>--upstream-node-id=%n</literal>
+        option to <command>repmgr standby follow</command>; the <literal>%n</literal> will be replaced by
+        <application>repmgrd</application> with the ID of the new primary node. If this is not provided, &repmgr;
+        will attempt to determine the new primary by itself, but if the
+        original primary comes back online after the new primary is promoted, there is a risk that
+        <command>repmgr standby follow</command> will result in the node continuing to follow
+        the original primary.
+      </para>
+    </sect2>
+
+    <sect2 id="repmgrd-service-configuration">
+      <indexterm>
+        <primary>repmgrd</primary>
+        <secondary>PostgreSQL service configuration</secondary>
+      </indexterm>
+      <title>PostgreSQL service configuration</title>
+      <para>
+        If using automatic failover, currently <application>repmgrd</application> will need to execute
+        <link linkend="repmgr-standby-follow"><command>repmgr standby follow</command></link>
+        to restart PostgreSQL on standbys to have them follow a new primary.
+      </para>
+      <para>
+        To ensure this happens smoothly, it's essential to provide the appropriate system/service restart
+        command appropriate to your operating system via <varname>service_restart_command</varname>
+        in <filename>repmgr.conf</filename>. If you don't do this, <application>repmgrd</application>
+        will default to using <command>pg_ctl</command>, which can result in unexpected problems,
+        particularly on <application>systemd</application>-based systems.
+      </para>
+      <para>
+        For more details, see <xref linkend="configuration-service-commands">.
+      </para>
+    </sect2>
+
+    <sect2 id="repmgrd-monitoring-configuration">
+      <indexterm>
+        <primary>repmgrd</primary>
+        <secondary>monitoring configuration</secondary>
+      </indexterm>
+      <title>Monitoring configuration</title>
+      <para>
+        To enable monitoring, set:
+        <programlisting>
+          monitoring_history=yes</programlisting>
+        in <filename>repmgr.conf</filename>.
+      </para>
+      <para>
+        The default monitoring interval is 2 seconds; this value can be explicitly set using:
+        <programlisting>
+          monitor_interval_secs=&lt;seconds&gt;</programlisting>
+        in <filename>repmgr.conf</filename>.
+      </para>
+      <para>
+        For more details on monitoring, see <xref linkend="repmgrd-monitoring">.
+      </para>
+    </sect2>
+
+  </sect1>
+
+  <sect1 id="repmgrd-daemon">
+    <indexterm>
+      <primary>repmgrd</primary>
+      <secondary>starting and stopping</secondary>
+    </indexterm>
+    <title>repmgrd daemon</title>
+    <para>
+      If installed from a package, the <application>repmgrd</application> can be started
+      via the operating system's service command, e.g. in <application>systemd</application>
+      using <command>systemctl</command>.
+    </para>
+    <para>
+      See appendix <xref linkend="appendix-packages"> for details of service commands
+      for different distributions.
+    </para>
+    <para>
+      <application>repmgrd</application> can be started manually like this:
+      <programlisting>
+        repmgrd -f /etc/repmgr.conf --pid-file /tmp/repmgrd.pid --daemonize</programlisting>
+      and stopped with <command>kill `cat /tmp/repmgrd.pid`</command>. Adjust paths as appropriate.
+    </para>
+    <para>
+      To apply configuration file changes to a running <application>repmgrd</application>
+      daemon, execute the operating system's service reload command (for manually started
+      instances, execute <command>kill -HUP `cat /tmp/repmgrd.pid`</command>).
+      Note that only a subset of configuration file parameters can be changed on a
+      running <application>repmgrd</application> daemon.
+    </para>
+
+    <sect2 id="repmgrd-configuration-debian-ubuntu">
+      <indexterm>
+        <primary>repmgrd</primary>
+        <secondary>Debian/Ubuntu and daemon configuration</secondary>
+      </indexterm>
+      <indexterm>
+        <primary>Debian/Ubuntu</primary>
+        <secondary>repmgrd daemon configuration</secondary>
+      </indexterm>
+
+      <title>repmgrd daemon configuration on Debian/Ubuntu</title>
+
+      <para>
+        If &repmgr; was installed from Debian/Ubuntu packages, additional configuration
+        is required before <application>repmgrd</application> is started as a daemon.
+      </para>
+      <para>
+        This is done via the file <filename>/etc/default/repmgrd</filename>, which by default
+        looks like this:
+        <programlisting>
+# default settings for repmgrd. This file is source by /bin/sh from
+# /etc/init.d/repmgrd
+
+# disable repmgrd by default so it won't get started upon installation
+# valid values: yes/no
+REPMGRD_ENABLED=no
+
+# configuration file (required)
+#REPMGRD_CONF="/path/to/repmgr.conf"
+
+# additional options
+#REPMGRD_OPTS=""
+
+# user to run repmgrd as
+#REPMGRD_USER=postgres
+
+# repmgrd binary
+#REPMGRD_BIN=/usr/bin/repmgrd
+
+# pid file
+#REPMGRD_PIDFILE=/var/run/repmgrd.pid</programlisting>
+      </para>
+      <para>
+        Set <varname>REPMGRD_ENABLED</varname> to <literal>yes</literal>, and <varname>REPMGRD_CONF</varname>
+        to the <filename>repmgr.conf</filename> file you are using.
+      </para>
+      <para>
+        If using <application>systemd</application>, you may need to execute <command>systemctl daemon-reload</command>.
+        Also, if you attempted to start <application>repmgrd</application> using <command>systemctl start repmgrd</command>,
+        you'll need to execute <command>systemctl stop repmgrd</command>. Because that's how <application>systemd</application>
+        rolls.
+      </para>
+
+    </sect2>
+  </sect1>
+
+  <sect1 id="repmgrd-connection-settings">
+    <title>repmgrd connection settings</title>
  <para>
   In addition to the &repmgr; configuration settings, parameters in the
   <varname>conninfo</varname> string influence how &repmgr; makes a network connection to
@@ -76,12 +249,21 @@
   <ulink url="https://www.postgresql.org/docs/current/static/libpq-connect.html#LIBPQ-PARAMKEYWORDS">PostgreSQL documentation</ulink>.
  </para>
  </sect1>
+
+
+
  <sect1 id="repmgrd-log-rotation">
+   <indexterm>
+     <primary>log rotation</primary>
+     <secondary>repmgrd</secondary>
+   </indexterm>
+
   <title>repmgrd log rotation</title>
   <para>
-   To ensure the current <application>repmgrd</application> logfile does not grow
-   indefinitely, configure your system's <command>logrotate</command> to
-   regularly rotate it.
+   To ensure the current <application>repmgrd</application> logfile
+   (specified in <filename>repmgr.conf</filename> with the parameter
+   <option>log_file</option> does not grow indefinitely, configure your
+   system's <command>logrotate</command> to regularly rotate it.
   </para>
   <para>
    Sample configuration to rotate logfiles weekly with retention for

doc/repmgrd-degraded-monitoring.sgml

@@ -40,7 +40,7 @@
    </listitem>
 
    <listitem>
-    <simpara>repmgrd is monitoring the primary node, but it is not available</simpara>
+    <simpara>repmgrd is monitoring the primary node, but it is not available (and no other node has been promoted as primary)</simpara>
    </listitem>
   </itemizedlist>
  </para>
@@ -69,7 +69,15 @@
   By default, <literal>repmgrd</literal> will continue in degraded monitoring mode indefinitely.
   However a timeout (in seconds) can be set with <varname>degraded_monitoring_timeout</varname>,
   after which <application>repmgrd</application> will terminate.
-
  </para>
 
+ <note>
+   <para>
+     If <application>repmgrd</application> is monitoring a primary mode which has been stopped
+     and manually restarted as a standby attached to a new primary, it will automatically detect
+     the status change and update the node record to reflect the node's new status
+     as an active standby. It will then resume monitoring the node as a standby.
+   </para>
+ </note>
+
 </chapter>

doc/repmgrd-monitoring.sgml

@@ -3,6 +3,10 @@
    <primary>repmgrd</primary>
    <secondary>monitoring</secondary>
  </indexterm>
+ <indexterm>
+   <primary>monitoring</primary>
+   <secondary>with repmgrd</secondary>
+ </indexterm>
 
  <title>Monitoring with repmgrd</title>
  <para>

doc/switchover.sgml

@@ -60,13 +60,28 @@
     &repmgr;  being able to shut down the current primary server quickly and cleanly.
    </para>
 
+   <para>
+     Ensure that a passwordless SSH connection is possible from the promotion candidate
+     (standby) to the demotion candidate (current primary). If <literal>--siblings-follow</literal>
+     will be used, ensure that passwordless SSH connections are possible from the
+     promotion candidate to all standbys attached to the demotion candidate.
+   </para>
+
+   <note>
+     <simpara>
+       &repmgr; expects to find the &repmgr; binary in the same path on the remote
+       server as on the local server.
+     </simpara>
+   </note>
+
    <para>
     Double-check which commands will be used to stop/start/restart the current
-    primary; on the primary execute:
+    primary; on the current primary execute:
     <programlisting>
      repmgr -f /etc/repmgr.conf node service --list --action=stop
      repmgr -f /etc/repmgr.conf node service --list --action=start
      repmgr -f /etc/repmgr.conf node service --list --action=restart</programlisting>
+
    </para>
 
    <para>
@@ -85,7 +100,11 @@
      <para>
        If the <option>service_*_command</option> options aren't defined, &repmgr; will
        fall back to using <application>pg_ctl</application> to stop/start/restart
-       PostgreSQL, which may not work properly.
+       PostgreSQL, which may not work properly, particularly when executed on a remote
+       server.
+     </para>
+     <para>
+       For more details, see <xref linkend="configuration-service-commands">.
      </para>
    </important>
 
@@ -102,6 +121,7 @@
     </simpara>
    </note>
 
+
    <para>
     Check that access from applications is minimalized or preferably blocked
     completely, so applications are not unexpectedly interrupted.
@@ -156,34 +176,60 @@
      </para>
    </important>
 
-   <para>
-     Note that following parameters in <filename>repmgr.conf</filename> are relevant to the
-     switchover operation:
-     <itemizedlist spacing="compact" mark="bullet">
-       <listitem>
-         <simpara>
-           <literal>reconnect_attempts</literal>: number of times to check the original primary
-           for a clean shutdown after executing the shutdown command, before aborting
-         </simpara>
-       </listitem>
-       <listitem>
-         <simpara>
-           <literal>reconnect_interval</literal>: interval (in seconds) to check the original
-           primary for a clean shutdown after executing the shutdown command (up to a maximum
-           of <literal>reconnect_attempts</literal> tries)
-         </simpara>
-       </listitem>
-       <listitem>
-         <simpara>
-           <literal>replication_lag_critical</literal>:
-           if replication lag (in seconds) on the standby exceeds this value, the
-           switchover will be aborted (unless the <literal>-F/--force</literal> option
-           is provided)
-         </simpara>
-       </listitem>
 
-     </itemizedlist>
-   </para>
+   <note>
+     <simpara>
+       See <xref linkend="repmgr-standby-switchover"> for a full list of available
+       command line options and <filename>repmgr.conf</filename> settings relevant
+       to performing a switchover.
+     </simpara>
+   </note>
+
+  <sect2 id="switchover-pg-rewind" xreflabel="Switchover and pg_rewind">
+    <indexterm>
+      <primary>pg_rewind</primary>
+      <secondary>using with "repmgr standby switchover"</secondary>
+    </indexterm>
+    <title>Switchover and pg_rewind</title>
+    <para>
+      If the demotion candidate does not shut down smoothly or cleanly, there's a risk it
+      will have a slightly divergent timeline and will not be able to attach to the new
+      primary. To fix this situation without needing to reclone the old primary, it's
+      possible to use the <application>pg_rewind</application> utility, which will usually be
+      able to resync the two servers.
+    </para>
+    <para>
+      To have &repmgr; execute <application>pg_rewind</application> if it detects this
+      situation after promoting the new primary, add the <option>--force-rewind</option>
+      option.
+    </para>
+    <note>
+      <simpara>
+        If &repmgr; detects a situation where it needs to execute <application>pg_rewind</application>,
+        it will execute a <literal>CHECKPOINT</literal> on the new primary before executing
+        <application>pg_rewind</application>.
+      </simpara>
+    </note>
+    <para>
+      For more details on <application>pg_rewind</application>, see:
+      <ulink url="https://www.postgresql.org/docs/current/static/app-pgrewind.html">https://www.postgresql.org/docs/current/static/app-pgrewind.html</ulink>.
+    </para>
+    <para>
+      <application>pg_rewind</application> has been part of the core PostgreSQL distribution since
+      version 9.5. Users of versions 9.3 and 9.4 will need to manually install it; the source code is available here:
+      <ulink url="https://github.com/vmware/pg_rewind">https://github.com/vmware/pg_rewind</ulink>.
+      If the <application>pg_rewind</application>
+      binary is not installed in the PostgreSQL <filename>bin</filename> directory, provide
+      its full path  on the demotion candidate  with <option>--force-rewind</option>.
+    </para>
+    <para>
+      Note that building the 9.3/9.4 version of <application>pg_rewind</application> requires the PostgreSQL
+      source code. Also, PostgreSQL 9.3 does not provide <varname>wal_log_hints</varname>,
+      meaning data checksums must have been enabled when the database was initialized.
+    </para>
+  </sect2>
+
+
  </sect1>
 
  <sect1 id="switchover-execution" xreflabel="Executing the switchover command">

doc/upgrading-repmgr.sgml

@@ -11,22 +11,86 @@
   containing bugfixes and other minor improvements. Any substantial new
   functionality will be included in a feature release (e.g. 4.0.x to 4.1.x).
  </para>
- <para>
-  &repmgr; is implemented as a PostgreSQL extension; to upgrade it, first
-  install the updated package (or compile the updated source), then in the
-  database where the &repmgr; extension is installed, execute
-  <command>ALTER EXTENSION repmgr UPDATE</command>.
- </para>
- <para>
-  If <application>repmgrd</application> is running, it may be necessary to restart
-  the PostgreSQL server if the upgrade contains changes to the shared object
-  file used by <application>repmgrd</application>; check the release notes for details.
- </para>
 
- <para>
-   Please check the <link linkend="appendix-release-notes">release notes</link> for every
-   release as they may contain upgrade instructions particular to individual versions.
- </para>
+ <sect1 id="upgrading-repmgr-extension" xreflabel="Upgrading repmgr 4.x and later">
+  <indexterm>
+   <primary>upgrading</primary>
+   <secondary>repmgr 4.x and later</secondary>
+  </indexterm>
+  <title>Upgrading repmgr 4.x and later</title>
+  <para>
+    &repmgr; 4.x is implemented as a PostgreSQL extension; normally the upgrade consists
+    of the two following steps:
+    <orderedlist>
+      <listitem>
+        <simpara>
+          Install the updated package (or compile the updated source)
+        </simpara>
+      </listitem>
+      <listitem>
+        <simpara>
+          In the database where the &repmgr; extension is installed, execute
+          <command>ALTER EXTENSION repmgr UPDATE</command>.
+        </simpara>
+      </listitem>
+    </orderedlist>
+  </para>
+
+  <para>
+    Always check the <link linkend="appendix-release-notes">release notes</link> for every
+    release as they may contain upgrade instructions particular to individual versions.
+  </para>
+
+  <para>
+    If the <application>repmgrd</application> daemon is in use, we recommend stopping it
+    before upgrading &repmgr;.
+  </para>
+  <para>
+    Note that it may be necessary to restart the PostgreSQL server if the upgrade contains
+    changes to the shared object file used by <application>repmgrd</application>; check the
+    release notes for details.
+  </para>
+ </sect1>
+
+ <sect1 id="upgrading-and-pg-upgrade" xreflabel="pg_upgrade and repmgr">
+  <indexterm>
+   <primary>upgrading</primary>
+   <secondary>pg_upgrade</secondary>
+  </indexterm>
+  <indexterm>
+    <primary>pg_upgrade</primary>
+  </indexterm>
+  <title>pg_upgrade and repmgr</title>
+
+  <para>
+    <application>pg_upgrade</application> requires that if any functions are
+    dependent on a shared library, this library must be present in both
+    the old and new installations before <application>pg_upgrade</application>
+    can be executed.
+  </para>
+  <para>
+    To minimize the risk of any upgrade issues (particularly if an upgrade to
+    a new major &repmgr; version is involved), we recommend upgrading
+    &repmgr; on the old server <emphasis>before</emphasis> running
+    <application>pg_upgrade</application> to ensure that old and new
+    versions are the same.
+  </para>
+  <note>
+    <simpara>
+      This issue applies to any PostgreSQL extension which has
+      dependencies on a shared library.
+    </simpara>
+  </note>
+  <para>
+    For further details please see the <ulink url="https://www.postgresql.org/docs/current/static/pgupgrade.html">pg_upgrade documentation</ulink>.
+  </para>
+  <para>
+    If replication slots are in use, bear in mind these will <emphasis>not</emphasis>
+    be recreated by <application>pg_upgrade</application>. These will need to
+    be recreated manually.
+  </para>
+ </sect1>
+
 
  <sect1 id="upgrading-from-repmgr-3" xreflabel="Upgrading from repmgr 3.x">
   <indexterm>

doc/version.sgml

@@ -1 +1 @@
-<!ENTITY repmgrversion "4.0.2">
+<!ENTITY repmgrversion "4.0.5">

errcode.h

@@ -43,5 +43,8 @@
 #define ERR_BARMAN 19
 #define ERR_REGISTRATION_SYNC 20
 #define ERR_OUT_OF_MEMORY 21
+#define ERR_SWITCHOVER_INCOMPLETE 22
+#define ERR_FOLLOW_FAIL 23
+#define ERR_REJOIN_FAIL 24
 
 #endif							/* _ERRCODE_H_ */

repmgr-action-cluster.c

@@ -82,6 +82,7 @@ do_cluster_show(void)
 	NodeInfoListCell *cell = NULL;
 	int			i = 0;
 	ItemList	warnings = {NULL, NULL};
+	bool		success = false;
 
 	/* Connect to local database to obtain cluster connection data */
 	log_verbose(LOG_INFO, _("connecting to database"));
@@ -91,11 +92,19 @@ do_cluster_show(void)
 	else
 		conn = establish_db_connection_by_params(&source_conninfo, true);
 
-	get_all_node_records_with_upstream(conn, &nodes);
+	success = get_all_node_records_with_upstream(conn, &nodes);
+
+	if (success == false)
+	{
+		/* get_all_node_records_with_upstream() will print error message */
+		PQfinish(conn);
+		exit(ERR_BAD_CONFIG);
+	}
 
 	if (nodes.node_count == 0)
 	{
-		log_error(_("unable to retrieve any node records"));
+		log_error(_("no node records were found"));
+		log_hint(_("ensure at least one node is registered"));
 		PQfinish(conn);
 		exit(ERR_BAD_CONFIG);
 	}
@@ -131,8 +140,14 @@ do_cluster_show(void)
 		}
 		else
 		{
+			char		error[MAXLEN];
+
+			strncpy(error, PQerrorMessage(cell->node_info->conn), MAXLEN);
 			cell->node_info->node_status = NODE_STATUS_DOWN;
 			cell->node_info->recovery_type = RECTYPE_UNKNOWN;
+			item_list_append_format(&warnings,
+									"when attempting to connect to node \"%s\" (ID: %i), following error encountered :\n\"%s\"",
+									cell->node_info->node_name, cell->node_info->node_id, trim(error));
 		}
 
 		initPQExpBuffer(&details);
@@ -158,15 +173,13 @@ do_cluster_show(void)
 									break;
 								case RECTYPE_STANDBY:
 									appendPQExpBuffer(&details, "! running as standby");
-									item_list_append_format(
-															&warnings,
+									item_list_append_format(&warnings,
 															"node \"%s\" (ID: %i) is registered as primary but running as standby",
 															cell->node_info->node_name, cell->node_info->node_id);
 									break;
 								case RECTYPE_UNKNOWN:
 									appendPQExpBuffer(&details, "! unknown");
-									item_list_append_format(
-															&warnings,
+									item_list_append_format(&warnings,
 															"node \"%s\" (ID: %i) has unknown replication status",
 															cell->node_info->node_name, cell->node_info->node_id);
 									break;
@@ -177,16 +190,14 @@ do_cluster_show(void)
 							if (cell->node_info->recovery_type == RECTYPE_PRIMARY)
 							{
 								appendPQExpBuffer(&details, "! running");
-								item_list_append_format(
-														&warnings,
+								item_list_append_format(&warnings,
 														"node \"%s\" (ID: %i) is running but the repmgr node record is inactive",
 														cell->node_info->node_name, cell->node_info->node_id);
 							}
 							else
 							{
 								appendPQExpBuffer(&details, "! running as standby");
-								item_list_append_format(
-														&warnings,
+								item_list_append_format(&warnings,
 														"node \"%s\" (ID: %i) is registered as an inactive primary but running as standby",
 														cell->node_info->node_name, cell->node_info->node_id);
 							}
@@ -199,8 +210,7 @@ do_cluster_show(void)
 						if (cell->node_info->active == true)
 						{
 							appendPQExpBuffer(&details, "? unreachable");
-							item_list_append_format(
-													&warnings,
+							item_list_append_format(&warnings,
 													"node \"%s\" (ID: %i) is registered as an active primary but is unreachable",
 													cell->node_info->node_name, cell->node_info->node_id);
 						}
@@ -226,8 +236,7 @@ do_cluster_show(void)
 									break;
 								case RECTYPE_PRIMARY:
 									appendPQExpBuffer(&details, "! running as primary");
-									item_list_append_format(
-															&warnings,
+									item_list_append_format(&warnings,
 															"node \"%s\" (ID: %i) is registered as standby but running as primary",
 															cell->node_info->node_name, cell->node_info->node_id);
 									break;
@@ -245,16 +254,14 @@ do_cluster_show(void)
 							if (cell->node_info->recovery_type == RECTYPE_STANDBY)
 							{
 								appendPQExpBuffer(&details, "! running");
-								item_list_append_format(
-														&warnings,
+								item_list_append_format(&warnings,
 														"node \"%s\" (ID: %i) is running but the repmgr node record is inactive",
 														cell->node_info->node_name, cell->node_info->node_id);
 							}
 							else
 							{
 								appendPQExpBuffer(&details, "! running as primary");
-								item_list_append_format(
-														&warnings,
+								item_list_append_format(&warnings,
 														"node \"%s\" (ID: %i) is running as primary but the repmgr node record is inactive",
 														cell->node_info->node_name, cell->node_info->node_id);
 							}
@@ -267,8 +274,7 @@ do_cluster_show(void)
 						if (cell->node_info->active == true)
 						{
 							appendPQExpBuffer(&details, "? unreachable");
-							item_list_append_format(
-													&warnings,
+							item_list_append_format(&warnings,
 													"node \"%s\" (ID: %i) is registered as an active standby but is unreachable",
 													cell->node_info->node_name, cell->node_info->node_id);
 						}
@@ -416,7 +422,7 @@ do_cluster_show(void)
 		printf(_("\nWARNING: following issues were detected\n"));
 		for (cell = warnings.head; cell; cell = cell->next)
 		{
-			printf(_("  %s\n"), cell->string);
+			printf(_("  - %s\n"), cell->string);
 		}
 	}
 }
@@ -958,8 +964,7 @@ build_cluster_matrix(t_node_matrix_rec ***matrix_rec_dest, int *name_length)
 
 		initPQExpBuffer(&command_output);
 
-		(void) remote_command(
-							  host,
+		(void) remote_command(host,
 							  runtime_options.remote_user,
 							  command.data,
 							  &command_output);
@@ -1138,13 +1143,12 @@ build_cluster_crosscheck(t_node_status_cube ***dest_cube, int *name_length)
 		/* fix to work with --node-id */
 		if (cube[i]->node_id == config_file_options.node_id)
 		{
-			(void) local_command(
-								 command.data,
-								 &command_output);
+			(void) local_command_simple(command.data,
+										&command_output);
 		}
 		else
 		{
-			t_conninfo_param_list remote_conninfo;
+			t_conninfo_param_list remote_conninfo = T_CONNINFO_PARAM_LIST_INITIALIZER;
 			char	   *host = NULL;
 			PQExpBufferData quoted_command;
 
@@ -1164,8 +1168,7 @@ build_cluster_crosscheck(t_node_status_cube ***dest_cube, int *name_length)
 
 			log_verbose(LOG_DEBUG, "build_cluster_crosscheck(): executing\n  %s", quoted_command.data);
 
-			(void) remote_command(
-								  host,
+			(void) remote_command(host,
 								  runtime_options.remote_user,
 								  quoted_command.data,
 								  &command_output);

repmgr-action-node.c

@@ -41,6 +41,7 @@ static void _do_node_status_is_shutdown_cleanly(void);
 static void _do_node_archive_config(void);
 static void _do_node_restore_config(void);
 
+static void do_node_check_replication_connection(void);
 static CheckStatus do_node_check_archive_ready(PGconn *conn, OutputMode mode, CheckStatusList *list_output);
 static CheckStatus do_node_check_downstream(PGconn *conn, OutputMode mode, CheckStatusList *list_output);
 static CheckStatus do_node_check_replication_lag(PGconn *conn, OutputMode mode, t_node_info *node_info, CheckStatusList *list_output);
@@ -91,7 +92,7 @@ do_node_status(void)
 
 	/* Check node exists and is really a standby */
 
-	if (get_node_record(conn, config_file_options.node_id, &node_info) != RECORD_FOUND)
+	if (get_node_record_with_upstream(conn, config_file_options.node_id, &node_info) != RECORD_FOUND)
 	{
 		log_error(_("no record found for node %i"), config_file_options.node_id);
 		PQfinish(conn);
@@ -249,8 +250,7 @@ do_node_status(void)
 	if (node_info.max_wal_senders >= 0)
 	{
 		/* In CSV mode, raw values supplied as well */
-		key_value_list_set_format(
-								  &node_status,
+		key_value_list_set_format(&node_status,
 								  "Replication connections",
 								  "%i (of maximal %i)",
 								  node_info.attached_wal_receivers,
@@ -258,8 +258,7 @@ do_node_status(void)
 	}
 	else if (node_info.max_wal_senders == 0)
 	{
-		key_value_list_set_format(
-								  &node_status,
+		key_value_list_set_format(&node_status,
 								  "Replication connections",
 								  "disabled");
 	}
@@ -276,8 +275,7 @@ do_node_status(void)
 
 		initPQExpBuffer(&slotinfo);
 
-		appendPQExpBuffer(
-						  &slotinfo,
+		appendPQExpBuffer(&slotinfo,
 						  "%i (of maximal %i)",
 						  node_info.active_replication_slots + node_info.inactive_replication_slots,
 						  node_info.max_replication_slots);
@@ -289,8 +287,7 @@ do_node_status(void)
 							  "; %i inactive",
 							  node_info.inactive_replication_slots);
 
-			item_list_append_format(
-									&warnings,
+			item_list_append_format(&warnings,
 									_("- node has %i inactive replication slots"),
 									node_info.inactive_replication_slots);
 		}
@@ -309,13 +306,46 @@ do_node_status(void)
 	}
 
 
+	/*
+	 * check for missing replication slots - we do this regardless of
+	 * what "max_replication_slots" is set to, in case the downstream
+	 * node was configured with "use_replication_slots=true" and is
+	 * expecting a replication slot to be available
+	 */
+
+	{
+		NodeInfoList missing_slots = T_NODE_INFO_LIST_INITIALIZER;
+		get_downstream_nodes_with_missing_slot(conn,
+											   config_file_options.node_id,
+											   &missing_slots);
+
+		if (missing_slots.node_count > 0)
+		{
+			NodeInfoListCell *missing_slot_cell = NULL;
+
+			item_list_append_format(&warnings,
+									_("- replication slots missing for following %i node(s):"),
+									missing_slots.node_count);
+
+			for (missing_slot_cell = missing_slots.head; missing_slot_cell; missing_slot_cell = missing_slot_cell->next)
+			{
+				item_list_append_format(&warnings,
+										_("  - %s (ID: %i, slot name: \"%s\")"),
+										missing_slot_cell->node_info->node_name,
+										missing_slot_cell->node_info->node_id,
+										missing_slot_cell->node_info->slot_name);
+			}
+		}
+	}
+
+
 	if (node_info.type == STANDBY)
 	{
 		key_value_list_set_format(&node_status,
 								  "Upstream node",
 								  "%s (ID: %i)",
-								  node_info.node_name,
-								  node_info.node_id);
+								  node_info.upstream_node_name,
+								  node_info.upstream_node_id);
 
 		get_replication_info(conn, &replication_info);
 
@@ -463,8 +493,7 @@ _do_node_status_is_shutdown_cleanly(void)
 
 	initPQExpBuffer(&output);
 
-	appendPQExpBuffer(
-					  &output,
+	appendPQExpBuffer(&output,
 					  "--state=");
 
 	/* sanity-check we're dealing with a PostgreSQL directory */
@@ -580,6 +609,11 @@ do_node_check(void)
 		exit(return_code);
 	}
 
+	if (runtime_options.replication_connection == true)
+	{
+		do_node_check_replication_connection();
+		exit(SUCCESS);
+	}
 
 	if (strlen(config_file_options.conninfo))
 		conn = establish_db_connection(config_file_options.conninfo, true);
@@ -883,6 +917,72 @@ do_node_check_slots(PGconn *conn, OutputMode mode, t_node_info *node_info, Check
 }
 
 
+static void
+do_node_check_replication_connection(void)
+{
+	PGconn *local_conn = NULL;
+	PGconn *repl_conn = NULL;
+	t_node_info node_record = T_NODE_INFO_INITIALIZER;
+	RecordStatus record_status = RECORD_NOT_FOUND;
+	t_conninfo_param_list remote_conninfo = T_CONNINFO_PARAM_LIST_INITIALIZER;
+	PQExpBufferData output;
+
+
+	initPQExpBuffer(&output);
+	appendPQExpBuffer(&output,
+					  "--connection=");
+
+	if (runtime_options.remote_node_id == UNKNOWN_NODE_ID)
+	{
+		appendPQExpBuffer(&output, "UNKNOWN");
+		printf("%s\n", output.data);
+		termPQExpBuffer(&output);
+		return;
+	}
+
+	/* retrieve remote node record from local database */
+	local_conn = establish_db_connection(config_file_options.conninfo, true);
+
+	record_status = get_node_record(local_conn, runtime_options.remote_node_id, &node_record);
+	PQfinish(local_conn);
+
+	if (record_status != RECORD_FOUND)
+	{
+		appendPQExpBuffer(&output, "UNKNOWN");
+		printf("%s\n", output.data);
+		termPQExpBuffer(&output);
+		return;
+	}
+
+	initialize_conninfo_params(&remote_conninfo, false);
+	parse_conninfo_string(node_record.conninfo, &remote_conninfo, NULL, false);
+
+	if (strcmp(param_get(&remote_conninfo, "user"), node_record.repluser) != 0)
+	{
+		param_set(&remote_conninfo, "user", node_record.repluser);
+		param_set(&remote_conninfo, "dbname", "replication");
+	}
+	param_set(&remote_conninfo, "replication", "1");
+
+	repl_conn = establish_db_connection_by_params(&remote_conninfo, false);
+
+	if (PQstatus(repl_conn) != CONNECTION_OK)
+	{
+		appendPQExpBuffer(&output, "BAD");
+		printf("%s\n", output.data);
+		termPQExpBuffer(&output);
+		return;
+	}
+
+	PQfinish(repl_conn);
+
+	appendPQExpBuffer(&output, "OK");
+	printf("%s\n", output.data);
+	termPQExpBuffer(&output);
+
+	return;
+}
+
 static CheckStatus
 do_node_check_archive_ready(PGconn *conn, OutputMode mode, CheckStatusList *list_output)
 {
@@ -1418,7 +1518,7 @@ do_node_service(void)
 
 	if (data_dir_required_for_action(action))
 	{
-		get_node_data_directory(data_dir);
+		get_node_config_directory(data_dir);
 
 		if (data_dir[0] == '\0')
 		{
@@ -1506,7 +1606,7 @@ _do_node_service_list_actions(t_server_action action)
 
 	if (data_dir_required == true)
 	{
-		get_node_data_directory(data_dir);
+		get_node_config_directory(data_dir);
 	}
 
 	/* show command for specific action only */
@@ -1590,6 +1690,7 @@ do_node_rejoin(void)
 
 	bool		success = true;
 	int			server_version_num = UNKNOWN_SERVER_VERSION_NUM;
+	int			follow_error_code = SUCCESS;
 
 	/* check node is not actually running */
 
@@ -1632,7 +1733,7 @@ do_node_rejoin(void)
 		{
 			log_error(_("database is not shut down cleanly"));
 
-			if (runtime_options.force_rewind == true)
+			if (runtime_options.force_rewind_used == true)
 			{
 				log_detail(_("pg_rewind will not be able to run"));
 			}
@@ -1662,7 +1763,17 @@ do_node_rejoin(void)
 	PQfinish(upstream_conn);
 
 	/* connect to registered primary and check it's not in recovery */
-	upstream_conn = establish_db_connection(primary_node_record.conninfo, true);
+	upstream_conn = establish_db_connection(primary_node_record.conninfo, false);
+
+	if (PQstatus(upstream_conn) != CONNECTION_OK)
+	{
+		log_error(_("unable to connect to current primary \"%s\" (node ID: %i)"),
+				  primary_node_record.node_name,
+				  primary_node_record.node_id);
+		log_detail(_("primay node conninfo is: \"%s\""),
+				   primary_node_record.conninfo);
+		exit(ERR_BAD_CONFIG);
+	}
 
 	upstream_recovery_type = get_recovery_type(upstream_conn);
 
@@ -1683,7 +1794,7 @@ do_node_rejoin(void)
 	 * archived
 	 */
 
-	if (runtime_options.force_rewind == true)
+	if (runtime_options.force_rewind_used == true)
 	{
 		PQExpBufferData reason;
 		PQExpBufferData msg;
@@ -1720,7 +1831,7 @@ do_node_rejoin(void)
 	 * Forcibly rewind node if requested (this is mainly for use when this
 	 * action is being executed by "repmgr standby switchover")
 	 */
-	if (runtime_options.force_rewind == true)
+	if (runtime_options.force_rewind_used == true && runtime_options.dry_run == false)
 	{
 		int			ret;
 		PQExpBufferData		filebuf;
@@ -1730,9 +1841,18 @@ do_node_rejoin(void)
 		/* execute pg_rewind */
 		initPQExpBuffer(&command);
 
-		appendPQExpBuffer(&command,
-						  "%s -D ",
-						  make_pg_path("pg_rewind"));
+		if (runtime_options.force_rewind_path[0] != '\0')
+		{
+			appendPQExpBuffer(&command,
+							  "%s -D ",
+							  runtime_options.force_rewind_path);
+		}
+		else
+		{
+			appendPQExpBuffer(&command,
+							  "%s -D ",
+							  make_pg_path("pg_rewind"));
+		}
 
 		appendShellString(&command,
 						  config_file_options.data_directory);
@@ -1798,7 +1918,16 @@ do_node_rejoin(void)
 		}
 		termPQExpBuffer(&filebuf);
 
-		/* delete any replication slots copied in by pg_rewind */
+		/*
+		 * Delete any replication slots copied in by pg_rewind.
+		 *
+		 * TODO:
+		 *  - from PostgreSQL 11, this will be handled by pg_rewind, so
+		 *    we can skip this step from that version; see commit
+		 *    266b6acb312fc440c1c1a2036aa9da94916beac6
+		 *  - possibly delete contents various other directories
+		 *    as per the above commit for pre-PostgreSQL 11
+		 */
 		{
 			PQExpBufferData slotdir_path;
 			DIR			  *slotdir;
@@ -1855,34 +1984,134 @@ do_node_rejoin(void)
 		}
 	}
 
+	if (runtime_options.dry_run == true)
+	{
+		log_info(_("prerequisites for executing NODE REJOIN are met"));
+		exit(SUCCESS);
+	}
+
 	initPQExpBuffer(&follow_output);
 
 	success = do_standby_follow_internal(upstream_conn,
 										 &primary_node_record,
-										 &follow_output);
-
-	create_event_notification(upstream_conn,
-							  &config_file_options,
-							  config_file_options.node_id,
-							  "node_rejoin",
-							  success,
-							  follow_output.data);
-
-	PQfinish(upstream_conn);
+										 &follow_output,
+										 &follow_error_code);
 
 	if (success == false)
 	{
 		log_notice(_("NODE REJOIN failed"));
 		log_detail("%s", follow_output.data);
 
+		create_event_notification(upstream_conn,
+								  &config_file_options,
+								  config_file_options.node_id,
+								  "node_rejoin",
+								  success,
+								  follow_output.data);
+
+		PQfinish(upstream_conn);
+
 		termPQExpBuffer(&follow_output);
-		exit(ERR_DB_QUERY);
+		exit(follow_error_code);
 	}
 
-	log_notice(_("NODE REJOIN successful"));
-	log_detail("%s", follow_output.data);
+	/*
+	 * Actively check that node actually started and connected to primary,
+	 * if not exit with ERR_REJOIN_FAIL.
+	 *
+	 * This check can be overridden with -W/--no-wait, in which case a one-time
+	 * check will be carried out.
+	 */
+	if (runtime_options.no_wait == false)
+	{
+		int i;
 
+		for (i = 0; i < config_file_options.standby_reconnect_timeout; i++)
+		{
+			if (is_server_available(config_file_options.conninfo))
+			{
+				log_verbose(LOG_INFO, _("demoted primary is pingable"));
+				break;
+			}
+
+			if (i % 5 == 0)
+			{
+				log_verbose(LOG_INFO, _("waiting for node %i to respond to pings; %i of max %i attempts"),
+							config_file_options.node_id,
+							i + 1, config_file_options.standby_reconnect_timeout);
+			}
+			else
+			{
+				log_debug("sleeping 1 second waiting for node %i to respond to pings; %i of max %i attempts",
+						  config_file_options.node_id,
+						  i + 1, config_file_options.standby_reconnect_timeout);
+			}
+
+			sleep(1);
+		}
+
+		for (;  i < config_file_options.standby_reconnect_timeout; i++)
+		{
+			success = is_downstream_node_attached(upstream_conn, config_file_options.node_name);
+
+			if (success == true)
+			{
+				log_verbose(LOG_INFO, _("node %i has attached to its upstream node"),
+							config_file_options.node_id);
+				break;
+			}
+
+			if (i % 5 == 0)
+			{
+				log_info(_("waiting for node %i to connect to new primary; %i of max %i attempts"),
+						 config_file_options.node_id,
+						 i + 1, config_file_options.standby_reconnect_timeout);
+			}
+			else
+			{
+				log_debug("sleeping 1 second waiting for node %i to connect to new primary; %i of max %i attempts",
+						  config_file_options.node_id,
+						  i + 1, config_file_options.standby_reconnect_timeout);
+			}
+
+			sleep(1);
+		}
+
+		create_event_notification(upstream_conn,
+								  &config_file_options,
+								  config_file_options.node_id,
+								  "node_rejoin",
+								  success,
+								  follow_output.data);
+
+		if (success == false)
+		{
+			termPQExpBuffer(&follow_output);
+			log_notice(_("NODE REJOIN failed"));
+			exit(ERR_REJOIN_FAIL);
+		}
+	}
+	else
+	{
+		success = is_downstream_node_attached(upstream_conn, config_file_options.node_name);
+	}
+
+
+	if (success == true)
+	{
+		log_notice(_("NODE REJOIN successful"));
+		log_detail("%s", follow_output.data);
+	}
+	else
+	{
+		/*
+		 * if we reach here, no record found in upstream node's pg_stat_replication */
+		log_notice(_("NODE REJOIN has completed but node is not yet reattached to upstream"));
+		log_hint(_("you will need to manually check the node's replication status"));
+	}
 	termPQExpBuffer(&follow_output);
+
+	return;
 }
 
 
@@ -2319,15 +2548,15 @@ do_node_help(void)
 	puts("");
 	printf(_("  Configuration file required, runs on local node only.\n"));
 	puts("");
-	printf(_("    --csv                 emit output as CSV\n"));
-	printf(_("    --nagios              emit output in Nagios format (individual status output only)\n"));
+	printf(_("    --csv                   emit output as CSV\n"));
+	printf(_("    --nagios                emit output in Nagios format (individual status output only)\n"));
 	puts("");
 	printf(_("  Following options check an individual status:\n"));
-	printf(_("    --archive-ready       number of WAL files ready for archiving\n"));
-	printf(_("    --downstream          whether all downstream nodes are connected\n"));
-	printf(_("    --replication-lag     replication lag in seconds (standbys only)\n"));
-	printf(_("    --role                check node has expected role\n"));
-	printf(_("    --slots               check for inactive replication slots\n"));
+	printf(_("    --archive-ready         number of WAL files ready for archiving\n"));
+	printf(_("    --downstream            whether all downstream nodes are connected\n"));
+	printf(_("    --replication-lag       replication lag in seconds (standbys only)\n"));
+	printf(_("    --role                  check node has expected role\n"));
+	printf(_("    --slots                 check for inactive replication slots\n"));
 
 	puts("");
 
@@ -2337,13 +2566,16 @@ do_node_help(void)
 	puts("");
 	printf(_("  Configuration file required, runs on local node only.\n"));
 	puts("");
-	printf(_("    --dry-run             check that the prerequisites are met for rejoining the node\n" \
-			 "                          (including usability of \"pg_rewind\" if requested)\n"));
-	printf(_("    --force-rewind        execute \"pg_rewind\" if necessary\n"));
-	printf(_("    --config-files        comma-separated list of configuration files to retain\n" \
-			 "                          after executing \"pg_rewind\"\n"));
-	printf(_("    --config-archive-dir  directory to temporarily store retained configuration files\n" \
-			 "                          (default: /tmp)\n"));
+	printf(_("    --dry-run               check that the prerequisites are met for rejoining the node\n" \
+			 "                              (including usability of \"pg_rewind\" if requested)\n"));
+	printf(_("    --force-rewind[=VALUE]  execute \"pg_rewind\" if necessary\n"));
+	printf(_("                              (9.3 and 9.4 - provide full \"pg_rewind\" path)\n"));
+
+	printf(_("    --config-files          comma-separated list of configuration files to retain\n" \
+			 "                            after executing \"pg_rewind\"\n"));
+	printf(_("    --config-archive-dir    directory to temporarily store retained configuration files\n" \
+			 "                              (default: /tmp)\n"));
+	printf(_("    -W/--no-wait            don't wait for the node to rejoin cluster\n"));
 	puts("");
 
 	printf(_("NODE SERVICE\n"));

repmgr-action-primary.c

@@ -548,7 +548,8 @@ do_primary_help(void)
 	printf(_("  \"primary unregister\" unregisters an inactive primary node.\n"));
 	puts("");
 	printf(_("  --dry-run                           check what would happen, but don't actually unregister the primary\n"));
-	printf(_("  -F, --force                         force removal of the record\n"));
+	printf(_("  --node-id                           ID of the inactive primary node to unregister.\n"));
+	printf(_("  -F, --force                         force removal of an active record\n"));
 
 	puts("");
 

repmgr-action-standby.h

@@ -28,7 +28,7 @@ extern void do_standby_switchover(void);
 
 extern void do_standby_help(void);
 
-extern bool do_standby_follow_internal(PGconn *primary_conn, t_node_info *primary_node_record, PQExpBufferData *output);
+extern bool do_standby_follow_internal(PGconn *primary_conn, t_node_info *primary_node_record, PQExpBufferData *output, int *error_code);
 
 
 

repmgr-action-witness.c

@@ -65,7 +65,7 @@ do_witness_register(void)
 	if (recovery_type == RECTYPE_STANDBY)
 	{
 		log_error(_("provided node is a standby"));
-		log_error(_("a witness node must run on an independent primary server"));
+		log_hint(_("a witness node must run on an independent primary server"));
 
 		PQfinish(witness_conn);
 
@@ -86,6 +86,7 @@ do_witness_register(void)
 
 	/* connect to primary with provided parameters */
 	log_info(_("connecting to primary node"));
+
 	/*
 	 * Extract the repmgr user and database names from the conninfo string
 	 * provided in repmgr.conf
@@ -110,12 +111,12 @@ do_witness_register(void)
 	}
 
 	/* check primary node's recovery type */
-	recovery_type = get_recovery_type(witness_conn);
+	recovery_type = get_recovery_type(primary_conn);
 
 	if (recovery_type == RECTYPE_STANDBY)
 	{
 		log_error(_("provided primary node is a standby"));
-		log_error(_("provide the connection details of the cluster's primary server"));
+		log_hint(_("provide the connection details of the cluster's primary server"));
 
 		PQfinish(witness_conn);
 		PQfinish(primary_conn);
@@ -135,8 +136,11 @@ do_witness_register(void)
 		exit(ERR_BAD_CONFIG);
 	}
 
-	/* XXX sanity check witness node is not part of main cluster */
-
+	/*
+	 * TODO:sanity check witness node is not part of main cluster; we could
+	 * add a random application_name to the respective connections,
+	 * and do a simple check of pg_stat_activity
+	 */
 
 	/* create repmgr extension, if does not exist */
 	if (runtime_options.dry_run == false &&  !create_repmgr_extension(witness_conn))
@@ -182,7 +186,6 @@ do_witness_register(void)
 			log_error(_("witness node is already registered"));
 			log_hint(_("use option -F/--force to reregister the node"));
 
-
 			PQfinish(witness_conn);
 			PQfinish(primary_conn);
 

repmgr-client-global.h

@@ -42,6 +42,7 @@ typedef struct
 	bool		force;
 	char		pg_bindir[MAXLEN];	/* overrides setting in repmgr.conf */
 	bool		wait;
+	bool		no_wait;
 
 	/* logging options */
 	char		log_level[MAXLEN];	/* overrides setting in repmgr.conf */
@@ -68,6 +69,7 @@ typedef struct
 	int			node_id;
 	char		node_name[MAXLEN];
 	char		data_dir[MAXPGPATH];
+	int			remote_node_id;
 
 	/* "standby clone" options */
 	bool		copy_external_config_files;
@@ -79,6 +81,7 @@ typedef struct
 	char		replication_user[MAXLEN];
 	char		upstream_conninfo[MAXLEN];
 	bool		without_barman;
+	bool		recovery_conf_only;
 
 	/* "standby clone"/"standby follow" options */
 	int			upstream_node_id;
@@ -90,7 +93,8 @@ typedef struct
 
 	/* "standby switchover" options */
 	bool		always_promote;
-	bool		force_rewind;
+	bool		force_rewind_used;
+	char		force_rewind_path[MAXPGPATH];
 	bool		siblings_follow;
 
 	/* "node status" options */
@@ -103,6 +107,7 @@ typedef struct
 	bool		role;
 	bool		slots;
 	bool		has_passfile;
+	bool		replication_connection;
 
 	/* "node join" options */
 	char		config_files[MAXLEN];
@@ -130,30 +135,30 @@ typedef struct
 		/* configuration metadata */ \
 		false, false, false, false,	\
 		/* general configuration options */	\
-		"", false, false, "", false,	\
+		"", false, false, "", false, false,	\
 		/* logging options */ \
 		"", false, false, false, \
 		/* output options */ \
 		false, false, false,  \
 		/* database connection options */ \
-		"", "", "",	"",				  \
+		"", "", "",	"", \
 		/* other connection options */ \
-		"",	"",  \
-		/* node options */ \
-		UNKNOWN_NODE_ID, "", "", \
+		"",	"", \
+		/* general node options */ \
+		UNKNOWN_NODE_ID, "", "", UNKNOWN_NODE_ID, \
 		/* "standby clone" options */ \
 		false, CONFIG_FILE_SAMEPATH, false, false, false, "", "", "", \
-		false,  \
+		false, false, \
 		/* "standby clone"/"standby follow" options */ \
 		NO_UPSTREAM_NODE, \
 		/* "standby register" options */ \
 		false, 0, DEFAULT_WAIT_START,   \
 		/* "standby switchover" options */ \
-		false, false, false, \
+		false, false, "", false,		   \
 		/* "node status" options */ \
 		false, \
 		/* "node check" options */ \
-		false, false, false, false, false, false, \
+		false, false, false, false, false, false, false, \
 		/* "node join" options */ \
 		"", \
 		/* "node service" options */ \
@@ -162,7 +167,7 @@ typedef struct
 		false, "", CLUSTER_EVENT_LIMIT,	\
 		/* "cluster cleanup" options */ \
 		0, \
-		/* Following options for internal use */ \
+		/* following options for internal use */ \
 		"/tmp", OM_TEXT	\
 }
 
@@ -179,6 +184,7 @@ typedef enum
 	ACTION_NONE,
 	ACTION_START,
 	ACTION_STOP,
+	ACTION_STOP_WAIT,
 	ACTION_RESTART,
 	ACTION_RELOAD,
 	ACTION_PROMOTE
@@ -204,6 +210,7 @@ extern void check_93_config(void);
 extern bool create_repmgr_extension(PGconn *conn);
 extern int	test_ssh_connection(char *host, char *remote_user);
 extern bool local_command(const char *command, PQExpBufferData *outputbuf);
+extern bool local_command_simple(const char *command, PQExpBufferData *outputbuf);
 
 extern standy_clone_mode get_standby_clone_mode(void);
 
@@ -224,7 +231,9 @@ extern void print_help_header(void);
 /* server control functions */
 extern void get_server_action(t_server_action action, char *script, char *data_dir);
 extern bool data_dir_required_for_action(t_server_action action);
+extern void get_node_config_directory(char *config_dir_buf);
 extern void get_node_data_directory(char *data_dir_buf);
 extern void init_node_record(t_node_info *node_record);
+extern bool can_use_pg_rewind(PGconn *conn, const char *data_directory, PQExpBufferData *reason);
 
 #endif							/* _REPMGR_CLIENT_GLOBAL_H_ */

repmgr-client.c

@@ -53,6 +53,7 @@
 
 #include "repmgr.h"
 #include "compat.h"
+#include "controldata.h"
 #include "repmgr-client.h"
 #include "repmgr-client-global.h"
 #include "repmgr-action-primary.h"
@@ -60,7 +61,6 @@
 #include "repmgr-action-witness.h"
 #include "repmgr-action-bdr.h"
 #include "repmgr-action-node.h"
-
 #include "repmgr-action-cluster.h"
 
 #include <storage/fd.h>			/* for PG_TEMP_FILE_PREFIX */
@@ -73,7 +73,7 @@ t_runtime_options runtime_options = T_RUNTIME_OPTIONS_INITIALIZER;
 t_configuration_options config_file_options = T_CONFIGURATION_OPTIONS_INITIALIZER;
 
 /* conninfo params for the node we're operating on */
-t_conninfo_param_list source_conninfo;
+t_conninfo_param_list source_conninfo = T_CONNINFO_PARAM_LIST_INITIALIZER;
 
 bool		config_file_required = true;
 char		pg_bindir[MAXLEN] = "";
@@ -91,11 +91,12 @@ t_node_info target_node_info = T_NODE_INFO_INITIALIZER;
 static ItemList cli_errors = {NULL, NULL};
 static ItemList cli_warnings = {NULL, NULL};
 
+static bool _local_command(const char *command, PQExpBufferData *outputbuf, bool simple);
 
 int
 main(int argc, char **argv)
 {
-	t_conninfo_param_list default_conninfo;
+	t_conninfo_param_list default_conninfo = T_CONNINFO_PARAM_LIST_INITIALIZER;
 
 	int			optindex;
 	int			c;
@@ -177,7 +178,7 @@ main(int argc, char **argv)
 		strncpy(runtime_options.username, pw->pw_name, MAXLEN);
 	}
 
-	while ((c = getopt_long(argc, argv, "?Vb:f:FWd:h:p:U:R:S:D:ckL:tvC:", long_options,
+	while ((c = getopt_long(argc, argv, "?Vb:f:FwWd:h:p:U:R:S:D:ck:L:tvC:", long_options,
 							&optindex)) != -1)
 	{
 		/*
@@ -242,11 +243,16 @@ main(int argc, char **argv)
 				strncpy(runtime_options.replication_user, optarg, MAXLEN);
 				break;
 
-				/* -W/--wait */
-			case 'W':
+				/* -w/--wait */
+			case 'w':
 				runtime_options.wait = true;
 				break;
 
+				/* -W/--no-wait */
+			case 'W':
+				runtime_options.no_wait = true;
+				break;
+
 				/*----------------------------
 				 * database connection options
 				 *----------------------------
@@ -329,6 +335,11 @@ main(int argc, char **argv)
 				strncpy(runtime_options.node_name, optarg, MAXLEN);
 				break;
 
+				/* --remote-node-id */
+			case OPT_REMOTE_NODE_ID:
+				runtime_options.remote_node_id = repmgr_atoi(optarg, "--remote-node-id", &cli_errors, false);
+				break;
+
 				/*
 				 * standby options * ---------------
 				 */
@@ -384,6 +395,11 @@ main(int argc, char **argv)
 				runtime_options.without_barman = true;
 				break;
 
+			case OPT_RECOVERY_CONF_ONLY:
+				runtime_options.recovery_conf_only = true;
+				break;
+
+
 				/*---------------------------
 				 * "standby register" options
 				 *---------------------------
@@ -411,7 +427,13 @@ main(int argc, char **argv)
 				break;
 
 			case OPT_FORCE_REWIND:
-				runtime_options.force_rewind = true;
+				runtime_options.force_rewind_used = true;
+
+				if (optarg != NULL)
+				{
+					strncpy(runtime_options.force_rewind_path, optarg, MAXPGPATH);
+				}
+
 				break;
 
 			case OPT_SIBLINGS_FOLLOW:
@@ -455,6 +477,10 @@ main(int argc, char **argv)
 				runtime_options.has_passfile = true;
 				break;
 
+			case OPT_REPL_CONN:
+				runtime_options.replication_connection = true;
+				break;
+
 				/*--------------------
 				 * "node rejoin" options
 				 *--------------------
@@ -737,7 +763,6 @@ main(int argc, char **argv)
 
 	if (repmgr_command != NULL)
 	{
-#ifndef BDR_ONLY
 		if (strcasecmp(repmgr_command, "PRIMARY") == 0 || strcasecmp(repmgr_command, "MASTER") == 0)
 		{
 			if (help_option == true)
@@ -794,9 +819,6 @@ main(int argc, char **argv)
 				action = WITNESS_UNREGISTER;
 		}
 		else if (strcasecmp(repmgr_command, "BDR") == 0)
-#else
-		if (strcasecmp(repmgr_command, "BDR") == 0)
-#endif
 		{
 			if (help_option == true)
 			{
@@ -989,31 +1011,10 @@ main(int argc, char **argv)
 	}
 
 
-
-	/* check for conflicts between runtime options and configuration file */
-	/* ================================================================== */
-
-	if (action == STANDBY_CLONE)
-	{
-		standy_clone_mode mode = get_standby_clone_mode();
-
-		if (mode == barman && runtime_options.without_barman == false
-			&& config_file_options.use_replication_slots == true)
-		{
-			log_error(_("STANDBY CLONE in Barman mode is incompatible with configuration option \"use_replication_slots\""));
-			log_hint(_("set \"use_replication_slots\" to \"no\" in repmgr.conf, or use --without-barman fo clone directly from the upstream server"));
-			exit(ERR_BAD_CONFIG);
-		}
-	}
-
-
 	/*
 	 * Check for configuration file items which can be overriden by runtime
 	 * options
-	 */
-
-	/*
-	 * ============================================================================
+	 * =====================================================================
 	 */
 
 	/*
@@ -1157,7 +1158,6 @@ main(int argc, char **argv)
 
 	switch (action)
 	{
-#ifndef BDR_ONLY
 			/* PRIMARY */
 		case PRIMARY_REGISTER:
 			do_primary_register();
@@ -1193,21 +1193,6 @@ main(int argc, char **argv)
 		case WITNESS_UNREGISTER:
 			do_witness_unregister();
 			break;
-#else
-			/* we won't ever reach here, but stop the compiler complaining */
-		case PRIMARY_REGISTER:
-		case PRIMARY_UNREGISTER:
-		case STANDBY_CLONE:
-		case STANDBY_REGISTER:
-		case STANDBY_UNREGISTER:
-		case STANDBY_PROMOTE:
-		case STANDBY_FOLLOW:
-		case STANDBY_SWITCHOVER:
-		case WITNESS_REGISTER:
-		case WITNESS_UNREGISTER:
-			break;
-
-#endif
 			/* BDR */
 		case BDR_REGISTER:
 			do_bdr_register();
@@ -1343,6 +1328,15 @@ check_cli_parameters(const int action)
 										 _("--no-upstream-connection only effective in Barman mode"));
 					}
 				}
+
+				if (strlen(config_file_options.config_directory))
+				{
+					if (runtime_options.copy_external_config_files == false)
+					{
+						item_list_append(&cli_warnings,
+										 _("\"config_directory\" set in repmgr.conf, but --copy-external-config-files not provided"));
+					}
+				}
 			}
 			break;
 
@@ -1507,6 +1501,39 @@ check_cli_parameters(const int action)
 		}
 	}
 
+	if (runtime_options.replication_user[0])
+	{
+		switch (action)
+		{
+			case PRIMARY_REGISTER:
+			case STANDBY_REGISTER:
+			case STANDBY_CLONE:
+				break;
+
+			case STANDBY_FOLLOW:
+				item_list_append_format(&cli_warnings,
+										_("--replication-user ignored when executing %s"),
+										action_name(action));
+			default:
+				item_list_append_format(&cli_warnings,
+										_("--replication-user not required when executing %s"),
+										action_name(action));
+		}
+	}
+
+	if (runtime_options.recovery_conf_only == true)
+	{
+		switch (action)
+		{
+			case STANDBY_CLONE:
+				break;
+			default:
+				item_list_append_format(&cli_warnings,
+										_("--create-recovery-conf will be ignored when executing %s"),
+										action_name(action));
+		}
+	}
+
 	if (runtime_options.event[0])
 	{
 		switch (action)
@@ -1520,25 +1547,6 @@ check_cli_parameters(const int action)
 		}
 	}
 
-	if (runtime_options.replication_user[0])
-	{
-		switch (action)
-		{
-			case PRIMARY_REGISTER:
-			case STANDBY_REGISTER:
-				break;
-			case STANDBY_CLONE:
-			case STANDBY_FOLLOW:
-				item_list_append_format(&cli_warnings,
-										_("--replication-user ignored when executing %s)"),
-										action_name(action));
-			default:
-				item_list_append_format(&cli_warnings,
-										_("--replication-user not required when executing %s"),
-										action_name(action));
-		}
-	}
-
 	if (runtime_options.limit_provided)
 	{
 		switch (action)
@@ -1577,6 +1585,41 @@ check_cli_parameters(const int action)
 		}
 	}
 
+	/* --wait/--no-wait */
+
+	if (runtime_options.wait == true && runtime_options.no_wait == true)
+	{
+		item_list_append_format(&cli_errors,
+								_("both --wait and --no-wait options provided"));
+	}
+	else
+	{
+		if (runtime_options.wait)
+		{
+			switch (action)
+			{
+				case STANDBY_FOLLOW:
+					break;
+				default:
+					item_list_append_format(&cli_warnings,
+											_("--wait will be ignored when executing %s"),
+											action_name(action));
+			}
+		}
+		else if (runtime_options.wait)
+		{
+			switch (action)
+			{
+				case NODE_REJOIN:
+					break;
+				default:
+					item_list_append_format(&cli_warnings,
+											_("--no-wait will be ignored when executing %s"),
+											action_name(action));
+			}
+		}
+	}
+
 	/* repmgr node service --action */
 	if (runtime_options.action[0] != '\0')
 	{
@@ -1599,8 +1642,7 @@ check_cli_parameters(const int action)
 			case NODE_STATUS:
 				break;
 			default:
-				item_list_append_format(
-										&cli_warnings,
+				item_list_append_format(&cli_warnings,
 										_("--is-shutdown-cleanly will be ignored when executing %s"),
 										action_name(action));
 		}
@@ -1613,14 +1655,13 @@ check_cli_parameters(const int action)
 			case STANDBY_SWITCHOVER:
 				break;
 			default:
-				item_list_append_format(
-										&cli_warnings,
+				item_list_append_format(&cli_warnings,
 										_("--always-promote will be ignored when executing %s"),
 										action_name(action));
 		}
 	}
 
-	if (runtime_options.force_rewind == true)
+	if (runtime_options.force_rewind_used == true)
 	{
 		switch (action)
 		{
@@ -1628,8 +1669,7 @@ check_cli_parameters(const int action)
 			case NODE_REJOIN:
 				break;
 			default:
-				item_list_append_format(
-										&cli_warnings,
+				item_list_append_format(&cli_warnings,
 										_("--force-rewind will be ignored when executing %s"),
 										action_name(action));
 		}
@@ -1643,8 +1683,7 @@ check_cli_parameters(const int action)
 			case NODE_REJOIN:
 				break;
 			default:
-				item_list_append_format(
-										&cli_warnings,
+				item_list_append_format(&cli_warnings,
 										_("--config-files will be ignored when executing %s"),
 										action_name(action));
 		}
@@ -1658,6 +1697,7 @@ check_cli_parameters(const int action)
 			case PRIMARY_UNREGISTER:
 			case STANDBY_CLONE:
 			case STANDBY_REGISTER:
+			case STANDBY_FOLLOW:
 			case STANDBY_SWITCHOVER:
 			case WITNESS_REGISTER:
 			case WITNESS_UNREGISTER:
@@ -1665,8 +1705,7 @@ check_cli_parameters(const int action)
 			case NODE_SERVICE:
 				break;
 			default:
-				item_list_append_format(
-										&cli_warnings,
+				item_list_append_format(&cli_warnings,
 										_("--dry-run is not effective when executing %s"),
 										action_name(action));
 		}
@@ -1688,8 +1727,7 @@ check_cli_parameters(const int action)
 		if (used_options > 1)
 		{
 			/* TODO: list which options were used */
-			item_list_append(
-							 &cli_errors,
+			item_list_append(&cli_errors,
 							 "only one of --csv, --nagios and --optformat can be used");
 		}
 	}
@@ -1793,13 +1831,12 @@ do_help(void)
 	print_help_header();
 
 	printf(_("Usage:\n"));
-#ifndef BDR_ONLY
 	printf(_("    %s [OPTIONS] primary {register|unregister}\n"), progname());
-	printf(_("    %s [OPTIONS] standby {register|unregister|clone|promote|follow}\n"), progname());
-#endif
+	printf(_("    %s [OPTIONS] standby {register|unregister|clone|promote|follow|switchover}\n"), progname());
 	printf(_("    %s [OPTIONS] bdr     {register|unregister}\n"), progname());
-	printf(_("    %s [OPTIONS] node    status\n"), progname());
+	printf(_("    %s [OPTIONS] node    {status|check|rejoin|service}\n"), progname());
 	printf(_("    %s [OPTIONS] cluster {show|event|matrix|crosscheck}\n"), progname());
+	printf(_("    %s [OPTIONS] witness {register|unregister}\n"), progname());
 
 	puts("");
 
@@ -2116,6 +2153,8 @@ test_ssh_connection(char *host, char *remote_user)
 }
 
 
+
+
 /*
  * Execute a command locally. "outputbuf" should either be an
  * initialised PQexpbuffer, or NULL
@@ -2123,9 +2162,26 @@ test_ssh_connection(char *host, char *remote_user)
 bool
 local_command(const char *command, PQExpBufferData *outputbuf)
 {
-	FILE	   *fp;
+	return _local_command(command, outputbuf, false);
+}
+
+
+bool
+local_command_simple(const char *command, PQExpBufferData *outputbuf)
+{
+	return _local_command(command, outputbuf, true);
+}
+
+
+static bool
+_local_command(const char *command, PQExpBufferData *outputbuf, bool simple)
+{
+	FILE	   *fp = NULL;
 	char		output[MAXLEN];
 	int			retval = 0;
+	bool		success;
+
+	log_verbose(LOG_DEBUG, "executing:\n  %s", command);
 
 	if (outputbuf == NULL)
 	{
@@ -2141,27 +2197,46 @@ local_command(const char *command, PQExpBufferData *outputbuf)
 		return false;
 	}
 
-	/* TODO: better error handling */
+
 	while (fgets(output, MAXLEN, fp) != NULL)
 	{
 		appendPQExpBuffer(outputbuf, "%s", output);
+
+		if (!feof(fp) && simple == false)
+		{
+			break;
+		}
 	}
 
-	pclose(fp);
+	retval = pclose(fp);
+
+	/*  */
+	success = (WEXITSTATUS(retval) == 0 || WEXITSTATUS(retval) == 141) ? true : false;
+
+	log_verbose(LOG_DEBUG, "result of command was %i (%i)", WEXITSTATUS(retval), retval);
 
 	if (outputbuf->data != NULL)
 		log_verbose(LOG_DEBUG, "local_command(): output returned was:\n%s", outputbuf->data);
 	else
 		log_verbose(LOG_DEBUG, "local_command(): no output returned");
 
-	return true;
+	return success;
 }
 
 
+/*
+ * get_superuser_connection()
+ *
+ * Check if provided connection "conn" is a superuser connection, if not attempt to
+ * make a superuser connection "superuser_conn" with the provided --superuser parameter.
+ *
+ * "privileged_conn" is set to whichever connection is the superuser connection.
+ */
 void
 get_superuser_connection(PGconn **conn, PGconn **superuser_conn, PGconn **privileged_conn)
 {
 	t_connection_user userinfo = T_CONNECTION_USER_INITIALIZER;
+	t_conninfo_param_list conninfo_params = T_CONNINFO_PARAM_LIST_INITIALIZER;
 	bool		is_superuser = false;
 
 	/* this should never happen */
@@ -2170,6 +2245,7 @@ get_superuser_connection(PGconn **conn, PGconn **superuser_conn, PGconn **privil
 		log_error(_("no database connection available"));
 		exit(ERR_INTERNAL);
 	}
+
 	is_superuser = is_superuser_connection(*conn, &userinfo);
 
 	if (is_superuser == true)
@@ -2187,9 +2263,11 @@ get_superuser_connection(PGconn **conn, PGconn **superuser_conn, PGconn **privil
 		exit(ERR_BAD_CONFIG);
 	}
 
-	*superuser_conn = establish_db_connection_as_user(config_file_options.conninfo,
-													  runtime_options.superuser,
-													  false);
+	initialize_conninfo_params(&conninfo_params, false);
+	conn_to_param_list(*conn, &conninfo_params);
+	param_set(&conninfo_params, "user", runtime_options.superuser);
+
+	*superuser_conn = establish_db_connection_by_params(&conninfo_params, false);
 
 	if (PQstatus(*superuser_conn) != CONNECTION_OK)
 	{
@@ -2209,6 +2287,8 @@ get_superuser_connection(PGconn **conn, PGconn **superuser_conn, PGconn **privil
 		exit(ERR_BAD_CONFIG);
 	}
 
+	log_debug("established superuser connection as \"%s\"", runtime_options.superuser);
+
 	*privileged_conn = *superuser_conn;
 	return;
 }
@@ -2350,9 +2430,6 @@ copy_remote_files(char *host, char *remote_user, char *remote_path,
 }
 
 
-
-
-
 /*
  * Execute a command via ssh on the remote host.
  *
@@ -2416,7 +2493,12 @@ remote_command(const char *host, const char *user, const char *command, PQExpBuf
 	pclose(fp);
 
 	if (outputbuf != NULL)
-		log_verbose(LOG_DEBUG, "remote_command(): output returned was:\n  %s", outputbuf->data);
+	{
+		if (strlen(outputbuf->data))
+			log_verbose(LOG_DEBUG, "remote_command(): output returned was:\n%s", outputbuf->data);
+		else
+			log_verbose(LOG_DEBUG, "remote_command(): no output returned");
+	}
 
 	return true;
 }
@@ -2462,18 +2544,15 @@ get_server_action(t_server_action action, char *script, char *data_dir)
 				{
 					initPQExpBuffer(&command);
 
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  "%s %s -w -D ",
 									  make_pg_path("pg_ctl"),
 									  config_file_options.pg_ctl_options);
 
-					appendShellString(
-									  &command,
+					appendShellString(&command,
 									  data_dir);
 
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  " start");
 
 					strncpy(script, command.data, MAXLEN);
@@ -2485,6 +2564,7 @@ get_server_action(t_server_action action, char *script, char *data_dir)
 			}
 
 		case ACTION_STOP:
+		case ACTION_STOP_WAIT:
 			{
 				if (config_file_options.service_stop_command[0] != '\0')
 				{
@@ -2494,19 +2574,23 @@ get_server_action(t_server_action action, char *script, char *data_dir)
 				else
 				{
 					initPQExpBuffer(&command);
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  "%s %s -D ",
 									  make_pg_path("pg_ctl"),
 									  config_file_options.pg_ctl_options);
 
-					appendShellString(
-									  &command,
+					appendShellString(&command,
 									  data_dir);
 
-					appendPQExpBuffer(
-									  &command,
-									  " -m fast -W stop");
+					if (action == ACTION_STOP_WAIT)
+						appendPQExpBuffer(&command,
+										  " -w");
+					else
+						appendPQExpBuffer(&command,
+										  " -W");
+
+					appendPQExpBuffer(&command,
+									  " -m fast stop");
 
 					strncpy(script, command.data, MAXLEN);
 
@@ -2525,18 +2609,15 @@ get_server_action(t_server_action action, char *script, char *data_dir)
 				else
 				{
 					initPQExpBuffer(&command);
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  "%s %s -w -D ",
 									  make_pg_path("pg_ctl"),
 									  config_file_options.pg_ctl_options);
 
-					appendShellString(
-									  &command,
+					appendShellString(&command,
 									  data_dir);
 
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  " restart");
 
 					strncpy(script, command.data, MAXLEN);
@@ -2556,18 +2637,15 @@ get_server_action(t_server_action action, char *script, char *data_dir)
 				else
 				{
 					initPQExpBuffer(&command);
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  "%s %s -w -D ",
 									  make_pg_path("pg_ctl"),
 									  config_file_options.pg_ctl_options);
 
-					appendShellString(
-									  &command,
+					appendShellString(&command,
 									  data_dir);
 
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  " reload");
 
 					strncpy(script, command.data, MAXLEN);
@@ -2588,18 +2666,15 @@ get_server_action(t_server_action action, char *script, char *data_dir)
 				else
 				{
 					initPQExpBuffer(&command);
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  "%s %s -w -D ",
 									  make_pg_path("pg_ctl"),
 									  config_file_options.pg_ctl_options);
 
-					appendShellString(
-									  &command,
+					appendShellString(&command,
 									  data_dir);
 
-					appendPQExpBuffer(
-									  &command,
+					appendPQExpBuffer(&command,
 									  " promote");
 
 					strncpy(script, command.data, MAXLEN);
@@ -2633,6 +2708,7 @@ data_dir_required_for_action(t_server_action action)
 			return true;
 
 		case ACTION_STOP:
+		case ACTION_STOP_WAIT:
 			if (config_file_options.service_stop_command[0] != '\0')
 			{
 				return false;
@@ -2668,6 +2744,33 @@ data_dir_required_for_action(t_server_action action)
 }
 
 
+/*
+ * Copy the location of the configuration file directory into the
+ * provided buffer; if "config_directory" provided, use that, otherwise
+ * default to the data directory.
+ *
+ * This is primarily intended for use with "pg_ctl" (which itself shouldn't
+ * be used outside of development environments).
+ */
+void
+get_node_config_directory(char *config_dir_buf)
+{
+	if (config_file_options.config_directory[0] != '\0')
+	{
+		strncpy(config_dir_buf, config_file_options.config_directory, MAXPGPATH);
+		return;
+	}
+
+	if (config_file_options.data_directory[0] != '\0')
+	{
+		strncpy(config_dir_buf, config_file_options.data_directory, MAXPGPATH);
+		return;
+	}
+
+	return;
+}
+
+
 void
 get_node_data_directory(char *data_dir_buf)
 {
@@ -2715,7 +2818,7 @@ init_node_record(t_node_info *node_record)
 
 	if (config_file_options.replication_user[0] != '\0')
 	{
-		/* replication user explicitly provided */
+		/* replication user explicitly provided in configuration file */
 		strncpy(node_record->repluser, config_file_options.replication_user, NAMEDATALEN);
 	}
 	else
@@ -2732,3 +2835,77 @@ init_node_record(t_node_info *node_record)
 		create_slot_name(node_record->slot_name, config_file_options.node_id);
 	}
 }
+
+
+bool
+can_use_pg_rewind(PGconn *conn, const char *data_directory, PQExpBufferData *reason)
+{
+	bool		can_use = true;
+	int			server_version_num = get_server_version(conn, NULL);
+
+	/* wal_log_hints not available in 9.3, so just determine if data checksums enabled */
+	if (server_version_num < 90400)
+	{
+		int			data_checksum_version = get_data_checksum_version(data_directory);
+
+		if (data_checksum_version < 0)
+		{
+			appendPQExpBuffer(reason,
+							  _("unable to determine data checksum version"));
+			can_use = false;
+		}
+		else if (data_checksum_version == 0)
+		{
+			appendPQExpBuffer(reason,
+							  _("this cluster was initialised without data checksums"));
+			can_use = false;
+		}
+
+		return can_use;
+	}
+
+	/* "full_page_writes" must be on in any case */
+	if (guc_set(conn, "full_page_writes", "=", "off"))
+	{
+		if (can_use == false)
+			appendPQExpBuffer(reason, "; ");
+
+		appendPQExpBuffer(reason,
+						  _("\"full_page_writes\" must be set to \"on\""));
+
+		can_use = false;
+	}
+
+	/*
+	 * "wal_log_hints" off - are data checksums available? Note: we're
+	 * checking the local pg_control file here as the value will be the same
+	 * throughout the cluster and saves a round-trip to the demotion
+	 * candidate.
+	 */
+	if (guc_set(conn, "wal_log_hints", "=", "on") == false)
+	{
+		int			data_checksum_version = get_data_checksum_version(data_directory);
+
+		if (data_checksum_version < 0)
+		{
+			if (can_use == false)
+				appendPQExpBuffer(reason, "; ");
+
+			appendPQExpBuffer(reason,
+							  _("\"wal_log_hints\" is set to \"off\" but unable to determine data checksum version"));
+			can_use = false;
+		}
+		else if (data_checksum_version == 0)
+		{
+			if (can_use == false)
+				appendPQExpBuffer(reason, "; ");
+
+			appendPQExpBuffer(reason,
+							  _("\"wal_log_hints\" is set to \"off\" and data checksums are disabled"));
+
+			can_use = false;
+		}
+	}
+
+	return can_use;
+}

repmgr-client.h

@@ -83,6 +83,10 @@
 #define OPT_CONFIG_ARCHIVE_DIR			   1034
 #define OPT_HAS_PASSFILE                   1035
 #define OPT_WAIT_START                     1036
+#define OPT_REPL_CONN                      1037
+#define OPT_REMOTE_NODE_ID                 1038
+#define OPT_RECOVERY_CONF_ONLY             1039
+#define OPT_NO_WAIT                        1040
 
 /* deprecated since 3.3 */
 #define OPT_DATA_DIR						999
@@ -101,7 +105,8 @@ static struct option long_options[] =
 	{"dry-run", no_argument, NULL, OPT_DRY_RUN},
 	{"force", no_argument, NULL, 'F'},
 	{"pg_bindir", required_argument, NULL, 'b'},
-	{"wait", no_argument, NULL, 'W'},
+	{"wait", no_argument, NULL, 'w'},
+	{"no-wait", no_argument, NULL, 'W'},
 
 /* connection options */
 	{"dbname", required_argument, NULL, 'd'},
@@ -115,6 +120,7 @@ static struct option long_options[] =
 	{"pgdata", required_argument, NULL, 'D'},
 	{"node-id", required_argument, NULL, OPT_NODE_ID},
 	{"node-name", required_argument, NULL, OPT_NODE_NAME},
+	{"remote-node-id", required_argument, NULL, OPT_REMOTE_NODE_ID},
 
 /* logging options */
 	{"log-level", required_argument, NULL, 'L'},
@@ -136,6 +142,7 @@ static struct option long_options[] =
 	{"upstream-conninfo", required_argument, NULL, OPT_UPSTREAM_CONNINFO},
 	{"upstream-node-id", required_argument, NULL, OPT_UPSTREAM_NODE_ID},
 	{"without-barman", no_argument, NULL, OPT_WITHOUT_BARMAN},
+	{"recovery-conf-only", no_argument, NULL, OPT_RECOVERY_CONF_ONLY},
 
 /* "standby register" options */
 	{"wait-start", required_argument, NULL, OPT_WAIT_START},
@@ -158,11 +165,12 @@ static struct option long_options[] =
 	{"role", no_argument, NULL, OPT_ROLE},
 	{"slots", no_argument, NULL, OPT_SLOTS},
 	{"has-passfile", no_argument, NULL, OPT_HAS_PASSFILE},
+	{"replication-connection", no_argument, NULL, OPT_REPL_CONN},
 
 /* "node rejoin" options */
 	{"config-files", required_argument, NULL, OPT_CONFIG_FILES},
     {"config-archive-dir", required_argument, NULL, OPT_CONFIG_ARCHIVE_DIR},
-	{"force-rewind", no_argument, NULL, OPT_FORCE_REWIND},
+	{"force-rewind", optional_argument, NULL, OPT_FORCE_REWIND},
 
 /* "node service" options */
 	{"action", required_argument, NULL, OPT_ACTION},

repmgr.c

@@ -288,7 +288,6 @@ standby_get_last_updated(PG_FUNCTION_ARGS)
 Datum
 notify_follow_primary(PG_FUNCTION_ARGS)
 {
-#ifndef BDR_ONLY
 	int			primary_node_id = UNKNOWN_NODE_ID;
 
 	if (!shared_state)
@@ -316,7 +315,7 @@ notify_follow_primary(PG_FUNCTION_ARGS)
 	}
 
 	LWLockRelease(shared_state->lock);
-#endif
+
 	PG_RETURN_VOID();
 }
 
@@ -329,14 +328,12 @@ get_new_primary(PG_FUNCTION_ARGS)
 	if (!shared_state)
 		PG_RETURN_NULL();
 
-#ifndef BDR_ONLY
 	LWLockAcquire(shared_state->lock, LW_SHARED);
 
 	if (shared_state->follow_new_primary == true)
 		new_primary_node_id = shared_state->candidate_node_id;
 
 	LWLockRelease(shared_state->lock);
-#endif
 
 	if (new_primary_node_id == UNKNOWN_NODE_ID)
 		PG_RETURN_NULL();
@@ -348,7 +345,6 @@ get_new_primary(PG_FUNCTION_ARGS)
 Datum
 reset_voting_status(PG_FUNCTION_ARGS)
 {
-#ifndef BDR_ONLY
 	if (!shared_state)
 		PG_RETURN_NULL();
 
@@ -366,7 +362,7 @@ reset_voting_status(PG_FUNCTION_ARGS)
 	}
 
 	LWLockRelease(shared_state->lock);
-#endif
+
 	PG_RETURN_VOID();
 }
 

repmgr.conf.sample

@@ -40,18 +40,28 @@
 				 # is not running and there's no other way of determining
 				 # the data directory.
 
-#replication_user='repmgr'	 # User to make replication connections with, if not set defaults
-				 # to the user defined in "conninfo".
 
 # =============================================================================
 
 # Optional configuration items
 # =============================================================================
 
+
+#------------------------------------------------------------------------------
+# Server settings
+#------------------------------------------------------------------------------
+
+#config_directory=''		 # If configuration files are located outside the data
+				 # directory, specify the directory where the main
+				 # postgresql.conf file is located.
+
 #------------------------------------------------------------------------------
 # Replication settings
 #------------------------------------------------------------------------------
 
+#replication_user='repmgr'	 # User to make replication connections with, if not set defaults
+				 # to the user defined in "conninfo".
+
 #replication_type=physical	 # Must be one of 'physical' or 'bdr'.
 
 #location=default		 # arbitrary string defining the location of the node; this
@@ -65,9 +75,6 @@
 				 # at least the number of standbys which will connect
 				 # to the primary.
 
-#recovery_min_apply_delay=	 # If provided, "recovery_min_apply_delay" in recovery.conf
-				 # will be set to this value.
-
 #------------------------------------------------------------------------------
 # Witness server settings
 #------------------------------------------------------------------------------
@@ -161,7 +168,7 @@ ssh_options='-q -o ConnectTimeout=10'	# Options to append to "ssh"
 
 
 #------------------------------------------------------------------------------
-# Standby clone settings
+# "standby clone" settings
 #------------------------------------------------------------------------------
 #
 # These settings apply when cloning a standby ("repmgr standby clone").
@@ -175,8 +182,29 @@ ssh_options='-q -o ConnectTimeout=10'	# Options to append to "ssh"
 					# file system location to another. This
 					# parameter can be provided multiple times.
 
-#restore_command=''			# This will be placed in the recovery.conf
-					# file generated by repmgr
+#restore_command=''			# This will be placed in the recovery.conf file generated
+                                        # by repmgr.
+
+#archive_cleanup_command=''		# This will be placed in the recovery.conf file generated
+                                        # by repmgr. Note we recommend using Barman for managing
+                                        # WAL archives (see: https://www.pgbarman.org )
+
+#recovery_min_apply_delay=		# If provided, "recovery_min_apply_delay" in recovery.conf
+					# will be set to this value (PostgreSQL 9.4 and later).
+
+
+#------------------------------------------------------------------------------
+# "standby promote" settings
+#------------------------------------------------------------------------------
+
+# These settings apply when instructing a standby to promote itself to the
+# new primary ("repmgr standby promote").
+
+#promote_check_timeout=60		# The length of time (in seconds) to wait
+					# for the new primary to finish promoting
+#promote_check_interval=1		# The interval (in seconds) to check whether
+					# the new primary has finished promoting
+
 
 #------------------------------------------------------------------------------
 # Standby follow settings
@@ -235,8 +263,11 @@ ssh_options='-q -o ConnectTimeout=10'	# Options to append to "ssh"
 #primary_notification_timeout=60	# Interval (in seconds) which repmgrd on a standby
 					# will wait for a notification from the new primary,
 					# before falling back to degraded monitoring
-#monitoring_history=no
+#standby_reconnect_timeout=60	# Interval (in seconds) which repmgrd on a standby will wait
+					# to reconnect to the local node after executing "follow_command"
 
+#monitoring_history=no                  # Whether to write monitoring data to the "montoring_history" table
+#monitor_interval_secs=2                # Interval (in seconds) at which to write monitoring data
 #degraded_monitoring_timeout=-1		# Interval (in seconds) after which repmgrd will terminate if the
 					# server being monitored is no longer available. -1 (default)
 					# disables the timeout completely.
@@ -269,6 +300,9 @@ ssh_options='-q -o ConnectTimeout=10'	# Options to append to "ssh"
 #       /usr/bin/systemctl start postgresql-9.6, \
 #       /usr/bin/systemctl restart postgresql-9.6
 #
+# Debian/Ubuntu users: use "sudo pg_ctlcluster" to execute service control commands.
+#
+# For more details, see: https://repmgr.org/docs/4.0/configuration-service-commands.html
 
 #service_start_command = ''
 #service_stop_command = ''

repmgr.h

@@ -77,6 +77,9 @@
 #define DEFAULT_REPLICATION_LAG_CRITICAL     600 /* seconds */
 #define DEFAULT_WITNESS_SYNC_INTERVAL        15  /* seconds */
 #define DEFAULT_WAIT_START                   30  /* seconds */
+#define DEFAULT_PROMOTE_CHECK_TIMEOUT        60  /* seconds */
+#define DEFAULT_PROMOTE_CHECK_INTERVAL       1   /* seconds */
+#define DEFAULT_STANDBY_RECONNECT_TIMEOUT    60  /* seconds */
 
 #ifndef RECOVERY_COMMAND_FILE
 #define RECOVERY_COMMAND_FILE "recovery.conf"

repmgr_version.h.in

@@ -1,3 +1,3 @@
 #define REPMGR_VERSION_DATE ""
-#define REPMGR_VERSION "4.0.2"
+#define REPMGR_VERSION "4.0.5"
 

repmgrd-bdr.c

@@ -35,6 +35,29 @@ do_bdr_node_check(void)
 	/* nothing to do at the moment */
 }
 
+void
+handle_sigint_bdr(SIGNAL_ARGS)
+{
+	PQExpBufferData event_details;
+
+	initPQExpBuffer(&event_details);
+
+	appendPQExpBuffer(&event_details,
+					  "%s signal received",
+					  postgres_signal_arg == SIGTERM
+					  ? "TERM" : "INT");
+
+	create_event_notification(local_conn,
+							  &config_file_options,
+							  config_file_options.node_id,
+							  "repmgrd_shutdown",
+							  true,
+							  event_details.data);
+	termPQExpBuffer(&event_details);
+
+	terminate(SUCCESS);
+}
+
 
 void
 monitor_bdr(void)
@@ -98,23 +121,6 @@ monitor_bdr(void)
 		exit(ERR_BAD_CONFIG);
 	}
 
-	/* Retrieve record for this node from the local database */
-	record_status = get_node_record(local_conn, config_file_options.node_id, &local_node_info);
-
-	/*
-	 * Terminate if we can't find the local node record. This is a
-	 * "fix-the-config" situation, not a lot else we can do.
-	 */
-	if (record_status != RECORD_FOUND)
-	{
-		log_error(_("unable to retrieve record for local node (ID: %i), terminating"),
-				  local_node_info.node_id);
-		log_hint(_("check that \"repmgr bdr register\" was executed for this node"));
-		PQfinish(local_conn);
-		exit(ERR_BAD_CONFIG);
-	}
-
-
 	if (local_node_info.active == false)
 	{
 		log_error(_("local node (ID: %i) is marked as inactive in repmgr"),
@@ -152,15 +158,16 @@ monitor_bdr(void)
 		cell->node_info->node_status = NODE_STATUS_UP;
 	}
 
-	log_debug("main_loop_bdr() monitoring local node %i", config_file_options.node_id);
+	log_info(_("starting continuous BDR node monitoring on node %i"),
+			 config_file_options.node_id);
 
-	log_info(_("starting continuous BDR node monitoring"));
+	INSTR_TIME_SET_CURRENT(log_status_interval_start);
 
 	while (true)
 	{
 
 		/* monitoring loop */
-		log_verbose(LOG_DEBUG, "BDR check loop...");
+		log_verbose(LOG_DEBUG, "BDR check loop - checking %i nodes", nodes.node_count);
 
 		for (cell = nodes.head; cell; cell = cell->next)
 		{
@@ -262,7 +269,6 @@ loop:
 		if (config_file_options.log_status_interval > 0)
 		{
 			int			log_status_interval_elapsed = calculate_elapsed(log_status_interval_start);
-
 			if (log_status_interval_elapsed >= config_file_options.log_status_interval)
 			{
 				log_info(_("monitoring BDR replication status on node \"%s\" (ID: %i)"),
@@ -273,8 +279,7 @@ loop:
 				{
 					if (cell->node_info->monitoring_state == MS_DEGRADED)
 					{
-						log_detail(
-								   _("monitoring node \"%s\" (ID: %i) in degraded mode"),
+						log_detail(_("monitoring node \"%s\" (ID: %i) in degraded mode"),
 								   cell->node_info->node_name,
 								   cell->node_info->node_id);
 					}

repmgrd-bdr.h

@@ -22,4 +22,5 @@
 extern void do_bdr_node_check(void);
 extern void monitor_bdr(void);
 
+extern void	handle_sigint_bdr(SIGNAL_ARGS);
 #endif							/* _REPMGRD_BDR_H_ */

repmgrd-physical.c

@@ -54,7 +54,6 @@ typedef enum
 static PGconn *upstream_conn = NULL;
 static PGconn *primary_conn = NULL;
 
-#ifndef BDR_ONLY
 static FailoverState failover_state = FAILOVER_STATE_UNKNOWN;
 
 static int	primary_node_id = UNKNOWN_NODE_ID;
@@ -75,7 +74,6 @@ static FailoverState follow_new_primary(int new_primary_id);
 static FailoverState witness_follow_new_primary(int new_primary_id);
 
 static void reset_node_voting_status(void);
-void		close_connections_physical();
 
 static bool do_primary_failover(void);
 static bool do_upstream_standby_failover(void);
@@ -85,15 +83,42 @@ static void update_monitoring_history(void);
 
 static const char * format_failover_state(FailoverState failover_state);
 
-#endif
 
+void
+handle_sigint_physical(SIGNAL_ARGS)
+{
+	PGconn *writeable_conn;
+	PQExpBufferData event_details;
+
+	initPQExpBuffer(&event_details);
+
+	appendPQExpBuffer(&event_details,
+					  "%s signal received",
+					  postgres_signal_arg == SIGTERM
+					  ? "TERM" : "INT");
+
+	if (local_node_info.type == PRIMARY)
+		writeable_conn = local_conn;
+	else
+		writeable_conn = primary_conn;
+
+	create_event_notification(writeable_conn,
+							  &config_file_options,
+							  config_file_options.node_id,
+							  "repmgrd_shutdown",
+							  true,
+							  event_details.data);
+
+	termPQExpBuffer(&event_details);
+
+	terminate(SUCCESS);
+}
 
 /* perform some sanity checks on the node's configuration */
 
 void
 do_physical_node_check(void)
 {
-#ifndef BDR_ONLY
 	/*
 	 * Check if node record is active - if not, and `failover=automatic`, the
 	 * node won't be considered as a promotion candidate; this often happens
@@ -116,7 +141,15 @@ do_physical_node_check(void)
 			case FAILOVER_AUTOMATIC:
 				log_error(_("this node is marked as inactive and cannot be used as a failover target"));
 				log_hint(_("%s"), hint);
-				PQfinish(local_conn);
+				close_connection(&local_conn);
+
+				create_event_notification(NULL,
+										  &config_file_options,
+										  config_file_options.node_id,
+										  "repmgrd_shutdown",
+										  false,
+										  "node is inactive and cannot be used as a failover target");
+
 				terminate(ERR_BAD_CONFIG);
 
 			case FAILOVER_MANUAL:
@@ -159,11 +192,10 @@ do_physical_node_check(void)
 		if (required_param_missing == true)
 		{
 			log_hint(_("add the missing configuration parameter(s) and start repmgrd again"));
-			PQfinish(local_conn);
+			close_connection(&local_conn);
 			exit(ERR_BAD_CONFIG);
 		}
 	}
-#endif
 }
 
 
@@ -174,7 +206,6 @@ do_physical_node_check(void)
 void
 monitor_streaming_primary(void)
 {
-#ifndef BDR_ONLY
 	instr_time	log_status_interval_start;
 	PQExpBufferData event_details;
 
@@ -243,7 +274,7 @@ monitor_streaming_primary(void)
 
 				local_node_info.node_status = NODE_STATUS_UNKNOWN;
 
-				PQfinish(local_conn);
+				close_connection(&local_conn);
 
 				/*
 				 * as we're monitoring the primary, no point in trying to
@@ -286,6 +317,7 @@ monitor_streaming_primary(void)
 
 				monitoring_state = MS_DEGRADED;
 				INSTR_TIME_SET_CURRENT(degraded_monitoring_start);
+				log_notice(_("unable to connect to local node, falling back to degraded monitoring"));
 			}
 
 		}
@@ -309,7 +341,7 @@ monitor_streaming_primary(void)
 				create_event_notification(NULL,
 										  &config_file_options,
 										  config_file_options.node_id,
-										  "repmgrd_terminate",
+										  "repmgrd_shutdown",
 										  true,
 										  event_details.data);
 
@@ -326,87 +358,134 @@ monitor_streaming_primary(void)
 				if (PQstatus(local_conn) != CONNECTION_OK)
 				{
 					log_warning(_("node appears to be up but no connection could be made"));
-					PQfinish(local_conn);
+					close_connection(&local_conn);
 				}
 				else
 				{
 					local_node_info.node_status = NODE_STATUS_UP;
-					monitoring_state = MS_NORMAL;
-
-					initPQExpBuffer(&event_details);
 
 					/* check to see if the node has been restored as a standby */
 					if (get_recovery_type(local_conn) == RECTYPE_STANDBY)
 					{
 						PGconn *new_primary_conn;
 
+						initPQExpBuffer(&event_details);
+
 						appendPQExpBuffer(&event_details,
 										  _("reconnected to node after %i seconds, node is now a standby, switching to standby monitoring"),
 										  degraded_monitoring_elapsed);
 						log_notice("%s", event_details.data);
 						termPQExpBuffer(&event_details);
 
-
 						primary_node_id = UNKNOWN_NODE_ID;
 
 						new_primary_conn = get_primary_connection_quiet(local_conn, &primary_node_id, NULL);
 
 						if (PQstatus(new_primary_conn) != CONNECTION_OK)
 						{
-							PQfinish(new_primary_conn);
+							close_connection(&new_primary_conn);
 							log_warning(_("unable to connect to new primary node %i"), primary_node_id);
 						}
 						else
 						{
 							RecordStatus record_status;
-							int i = 0;
 
 							log_debug("primary node id is now %i", primary_node_id);
 
-							/*
-							 * poll for a while until record type is returned as "STANDBY" - it's possible
-							 * that there's a gap between the server being restarted and the record
-							 * being updated
-							 */
-							for (i = 0; i < 30; i++)
-							{
-								/*
-								 * try and refresh the local node record from the primary, as the updated
-								 * local node record may not have been replicated yet
-								 */
-
-								record_status = get_node_record(new_primary_conn, config_file_options.node_id, &local_node_info);
-
-								if (record_status == RECORD_FOUND)
-								{
-									log_debug("type = %s", get_node_type_string(local_node_info.type));
-
-									if (local_node_info.type == STANDBY)
-									{
-										PQfinish(new_primary_conn);
-
-										/* XXX add event notification */
-										return;
-									}
-								}
-								sleep(1);
-							}
-
-							PQfinish(new_primary_conn);
+							record_status = get_node_record(new_primary_conn, config_file_options.node_id, &local_node_info);
 
 							if (record_status == RECORD_FOUND)
 							{
-								log_warning(_("repmgr node record is still %s"), get_node_type_string(local_node_info.type));
+								bool resume_monitoring = true;
+
+								log_debug("node %i is registered with type = %s",
+										  config_file_options.node_id,
+										  get_node_type_string(local_node_info.type));
+
+								/*
+								 * node has recovered but metadata not updated - we can do that ourselves,
+								 */
+								if (local_node_info.type == PRIMARY)
+								{
+									log_notice(_("node \"%s\" (ID: %i) still registered as primary, setting to standby"),
+											   config_file_options.node_name,
+											   config_file_options.node_id);
+
+									if (update_node_record_set_active_standby(new_primary_conn, config_file_options.node_id) == false)
+									{
+										resume_monitoring = false;
+									}
+									else
+									{
+										record_status = get_node_record(new_primary_conn, config_file_options.node_id, &local_node_info);
+
+										if (record_status != RECORD_FOUND)
+										{
+											resume_monitoring = false;
+										}
+									}
+								}
+
+								if (resume_monitoring == true)
+								{
+									monitoring_state = MS_NORMAL;
+									log_notice(_("former primary has been restored as standby after %i seconds, updating node record and resuming monitoring"),
+											   degraded_monitoring_elapsed);
+
+									initPQExpBuffer(&event_details);
+
+									appendPQExpBuffer(&event_details,
+													  _("node restored as standby after %i seconds, monitoring connection to upstream node %i"),
+													  degraded_monitoring_elapsed,
+													  local_node_info.upstream_node_id);
+
+									create_event_notification(new_primary_conn,
+															  &config_file_options,
+															  config_file_options.node_id,
+															  "repmgrd_standby_reconnect",
+															  true,
+															  event_details.data);
+
+
+									termPQExpBuffer(&event_details);
+
+									close_connection(&new_primary_conn);
+
+									/* restart monitoring as standby */
+									return;
+								}
 							}
-							else
+							else if (record_status == RECORD_NOT_FOUND)
 							{
-								log_error(_("no metadata record found for this node"));
+								PQExpBufferData event_details;
+								initPQExpBuffer(&event_details);
+
+								appendPQExpBuffer(&event_details,
+												  _("no metadata record found for this node on current primary %i"),
+												  primary_node_id);
+
+								log_error("%s", event_details.data);
 								log_hint(_("check that 'repmgr (primary|standby) register' was executed for this node"));
+
+								close_connection(&new_primary_conn);
+
+								create_event_notification(NULL,
+														  &config_file_options,
+														  config_file_options.node_id,
+														  "repmgrd_shutdown",
+														  false,
+														  event_details.data);
+								termPQExpBuffer(&event_details);
+
+								terminate(ERR_BAD_CONFIG);
 							}
 						}
 					}
 					else
 					{
+						monitoring_state = MS_NORMAL;
+
+						initPQExpBuffer(&event_details);
 						appendPQExpBuffer(&event_details,
 										  _("reconnected to primary node after %i seconds, resuming monitoring"),
 										  degraded_monitoring_elapsed);
@@ -447,7 +526,7 @@ loop:
 
 				if (monitoring_state == MS_DEGRADED)
 				{
-					log_detail(_("waiting for primary to reappear"));
+					log_detail(_("waiting for the node to become available"));
 				}
 
 				INSTR_TIME_SET_CURRENT(log_status_interval_start);
@@ -460,7 +539,7 @@ loop:
 
 			if (reload_config(&config_file_options))
 			{
-				PQfinish(local_conn);
+				close_connection(&local_conn);
 				local_conn = establish_db_connection(config_file_options.conninfo, true);
 
 				if (*config_file_options.log_file)
@@ -478,21 +557,17 @@ loop:
 			got_SIGHUP = false;
 		}
 
-
-
 		log_verbose(LOG_DEBUG, "sleeping %i seconds (parameter \"monitor_interval_secs\")",
 					config_file_options.monitor_interval_secs);
 
 		sleep(config_file_options.monitor_interval_secs);
 	}
-#endif
 }
 
 
 void
 monitor_streaming_standby(void)
 {
-#ifndef BDR_ONLY
 	RecordStatus record_status;
 	instr_time	log_status_interval_start;
 	PQExpBufferData event_details;
@@ -519,7 +594,7 @@ monitor_streaming_standby(void)
 		if (local_node_info.upstream_node_id == NODE_NOT_FOUND)
 		{
 			log_error(_("unable to determine an active primary for this cluster, terminating"));
-			PQfinish(local_conn);
+			close_connection(&local_conn);
 			exit(ERR_BAD_CONFIG);
 		}
 	}
@@ -536,14 +611,14 @@ monitor_streaming_standby(void)
 		log_error(_("no record found for upstream node (ID: %i), terminating"),
 				  local_node_info.upstream_node_id);
 		log_hint(_("ensure the upstream node is registered correctly"));
-		PQfinish(local_conn);
+		close_connection(&local_conn);
 		exit(ERR_DB_CONN);
 	}
 	else if (record_status == RECORD_ERROR)
 	{
 		log_error(_("unable to retrieve record for upstream node (ID: %i), terminating"),
 				  local_node_info.upstream_node_id);
-		PQfinish(local_conn);
+		close_connection(&local_conn);
 		exit(ERR_DB_CONN);
 	}
 
@@ -563,7 +638,7 @@ monitor_streaming_standby(void)
 				  local_node_info.upstream_node_id);
 		log_hint(_("upstream node must be running before repmgrd can start"));
 
-		PQfinish(local_conn);
+		close_connection(&local_conn);
 		exit(ERR_DB_CONN);
 	}
 
@@ -673,7 +748,18 @@ monitor_streaming_standby(void)
 				log_warning("%s", event_details.data);
 				termPQExpBuffer(&event_details);
 
-				PQfinish(upstream_conn);
+				close_connection(&upstream_conn);
+
+				/*
+				 * if local node is unreachable, make a last-minute attempt to reconnect
+				 * before continuing with the failover process
+				 */
+
+				if (PQstatus(local_conn) != CONNECTION_OK)
+				{
+					check_connection(&local_node_info, &local_conn);
+				}
+
 				upstream_conn = try_reconnect(&upstream_node_info);
 
 				/* Node has recovered - log and continue */
@@ -796,7 +882,49 @@ monitor_streaming_standby(void)
 				/* local node has been promoted */
 				if (get_recovery_type(local_conn) == RECTYPE_PRIMARY)
 				{
-					log_notice(_("local node is primary, checking local node record"));
+					log_notice(_("local node is primary, checking local node state"));
+
+					/*
+					 * It's possible the promote command timed out, but the promotion itself
+					 * succeeded. In this case failover state will be FAILOVER_STATE_PROMOTION_FAILED;
+					 * we can update the node record ourselves and resume primary monitoring.
+					 */
+					if (failover_state == FAILOVER_STATE_PROMOTION_FAILED)
+					{
+						int			degraded_monitoring_elapsed;
+						int			former_upstream_node_id = local_node_info.upstream_node_id;
+
+						update_node_record_set_primary(local_conn,  local_node_info.node_id);
+						record_status = get_node_record(local_conn, local_node_info.node_id, &local_node_info);
+
+						degraded_monitoring_elapsed = calculate_elapsed(degraded_monitoring_start);
+
+						log_notice(_("resuming monitoring as primary node after %i seconds"),
+								   degraded_monitoring_elapsed);
+
+						initPQExpBuffer(&event_details);
+						appendPQExpBuffer(&event_details,
+										  "promotion command failed but promotion completed successfully");
+						create_event_notification(local_conn,
+												  &config_file_options,
+												  local_node_info.node_id,
+												  "repmgrd_failover_promote",
+												  true,
+												  event_details.data);
+
+						termPQExpBuffer(&event_details);
+
+						/* notify former siblings that they should now follow this node */
+						get_active_sibling_node_records(local_conn,
+														local_node_info.node_id,
+														former_upstream_node_id,
+														&standby_nodes);
+						notify_followers(&standby_nodes, local_node_info.node_id);
+
+						/* this will restart monitoring in primary mode */
+						monitoring_state = MS_NORMAL;
+						return;
+					}
 
 					/*
 					 * There may be a delay between the node being promoted
@@ -854,12 +982,10 @@ monitor_streaming_standby(void)
 							if (get_recovery_type(cell->node_info->conn) == RECTYPE_PRIMARY)
 							{
 								follow_node_id = cell->node_info->node_id;
-								PQfinish(cell->node_info->conn);
-								cell->node_info->conn = NULL;
+								close_connection(&cell->node_info->conn);
 								break;
 							}
-							PQfinish(cell->node_info->conn);
-							cell->node_info->conn = NULL;
+							close_connection(&cell->node_info->conn);
 						}
 
 						if (follow_node_id != UNKNOWN_NODE_ID)
@@ -911,6 +1037,15 @@ loop:
 			}
 		}
 
+		if (PQstatus(primary_conn) == CONNECTION_OK && config_file_options.monitoring_history == true)
+		{
+			update_monitoring_history();
+		}
+		else
+		{
+			connection_ping(local_conn);
+		}
+
 		/*
 		 * handle local node failure
 		 *
@@ -925,33 +1060,38 @@ loop:
 		{
 			if (local_node_info.active == true)
 			{
+				bool success = true;
+				PQExpBufferData event_details;
+
+				initPQExpBuffer(&event_details);
+
+				local_node_info.active = false;
+
+				appendPQExpBuffer(&event_details,
+								  _("unable to connect to local node \"%s\" (ID: %i), marking inactive"),
+								  local_node_info.node_name,
+								  local_node_info.node_id);
+				log_notice("%s", event_details.data);
+
 				if (PQstatus(primary_conn) == CONNECTION_OK)
 				{
-					if (update_node_record_set_active(primary_conn, local_node_info.node_id, false) == true)
+					if (update_node_record_set_active(primary_conn, local_node_info.node_id, false) == false)
 					{
-						PQExpBufferData event_details;
-
-						initPQExpBuffer(&event_details);
-
-						local_node_info.active = false;
-
-						appendPQExpBuffer(&event_details,
-										  _("unable to connect to local node \"%s\" (ID: %i), marking inactive"),
-										  local_node_info.node_name,
-										  local_node_info.node_id);
-
-						log_warning("%s", event_details.data);
-
-						create_event_notification(primary_conn,
-												  &config_file_options,
-												  local_node_info.node_id,
-												  "standby_failure",
-												  false,
-												  event_details.data);
-
-						termPQExpBuffer(&event_details);
+						success = false;
+						log_warning(_("unable to mark node \"%s\" (ID: %i) as inactive"),
+									  local_node_info.node_name,
+									  local_node_info.node_id);
 					}
 				}
+
+				create_event_notification(primary_conn,
+										  &config_file_options,
+										  local_node_info.node_id,
+										  "standby_failure",
+										  success,
+										  event_details.data);
+
+				termPQExpBuffer(&event_details);
 			}
 		}
 		else
@@ -990,16 +1130,13 @@ loop:
 		}
 
 
-		if (PQstatus(primary_conn) == CONNECTION_OK && config_file_options.monitoring_history == true)
-			update_monitoring_history();
-
 		if (got_SIGHUP)
 		{
 			log_debug("SIGHUP received");
 
 			if (reload_config(&config_file_options))
 			{
-				PQfinish(local_conn);
+				close_connection(&local_conn);
 				local_conn = establish_db_connection(config_file_options.conninfo, true);
 
 				if (*config_file_options.log_file)
@@ -1017,16 +1154,17 @@ loop:
 			got_SIGHUP = false;
 		}
 
+		log_verbose(LOG_DEBUG, "sleeping %i seconds (parameter \"monitor_interval_secs\")",
+					config_file_options.monitor_interval_secs);
+
 		sleep(config_file_options.monitor_interval_secs);
 	}
-#endif
 }
 
 
 void
 monitor_streaming_witness(void)
 {
-#ifndef BDR_ONLY
 	instr_time	log_status_interval_start;
 	instr_time	witness_sync_interval_start;
 
@@ -1039,9 +1177,26 @@ monitor_streaming_witness(void)
 
 	if (get_primary_node_record(local_conn, &upstream_node_info) == false)
 	{
-		log_error(_("unable to retrieve record for primary node"));
+		PQExpBufferData event_details;
+
+		initPQExpBuffer(&event_details);
+
+		appendPQExpBuffer(&event_details,
+						  _("unable to retrieve record for primary node"));
+
+		log_error("%s", event_details.data);
 		log_hint(_("execute \"repmgr witness register --force\" to update the witness node "));
-		PQfinish(local_conn);
+		close_connection(&local_conn);
+
+		create_event_notification(NULL,
+								  &config_file_options,
+								  config_file_options.node_id,
+								  "repmgrd_shutdown",
+								  false,
+								  event_details.data);
+
+		termPQExpBuffer(&event_details);
+
 		terminate(ERR_BAD_CONFIG);
 	}
 
@@ -1059,7 +1214,7 @@ monitor_streaming_witness(void)
 				  upstream_node_info.node_id);
 		log_hint(_("primary node must be running before repmgrd can start"));
 
-		PQfinish(local_conn);
+		close_connection(&local_conn);
 		exit(ERR_DB_CONN);
 	}
 
@@ -1142,7 +1297,7 @@ monitor_streaming_witness(void)
 									true,
 									event_details.data);
 
-				PQfinish(primary_conn);
+				close_connection(&primary_conn);
 				primary_conn = try_reconnect(&upstream_node_info);
 
 				/* Node has recovered - log and continue */
@@ -1264,12 +1419,10 @@ monitor_streaming_witness(void)
 						if (get_recovery_type(cell->node_info->conn) == RECTYPE_PRIMARY)
 						{
 							follow_node_id = cell->node_info->node_id;
-							PQfinish(cell->node_info->conn);
-							cell->node_info->conn = NULL;
+							close_connection(&cell->node_info->conn);
 							break;
 						}
-						PQfinish(cell->node_info->conn);
-						cell->node_info->conn = NULL;
+						close_connection(&cell->node_info->conn);
 					}
 
 					if (follow_node_id != UNKNOWN_NODE_ID)
@@ -1331,7 +1484,7 @@ loop:
 
 			if (reload_config(&config_file_options))
 			{
-				PQfinish(local_conn);
+				close_connection(&local_conn);
 				local_conn = establish_db_connection(config_file_options.conninfo, true);
 
 				if (*config_file_options.log_file)
@@ -1349,15 +1502,17 @@ loop:
 			got_SIGHUP = false;
 		}
 
+		log_verbose(LOG_DEBUG, "sleeping %i seconds (parameter \"monitor_interval_secs\")",
+					config_file_options.monitor_interval_secs);
+
 		sleep(config_file_options.monitor_interval_secs);
 	}
-#endif
+
 	return;
 
 }
 
 
-#ifndef BDR_ONLY
 static bool
 do_primary_failover(void)
 {
@@ -1387,7 +1542,7 @@ do_primary_failover(void)
 
 		failover_state = promote_self();
 	}
-	else if (election_result == ELECTION_LOST)
+	else if (election_result == ELECTION_LOST || election_result == ELECTION_NOT_CANDIDATE)
 	{
 		log_info(_("follower node awaiting notification from the candidate node"));
 		failover_state = FAILOVER_STATE_WAITING_NEW_PRIMARY;
@@ -1403,7 +1558,7 @@ do_primary_failover(void)
 
 		/* TODO: rerun election if new primary doesn't appear after timeout */
 
-		/* either follow or time out; either way resume monitoring */
+		/* either follow, self-promote or time out; either way resume monitoring */
 		if (wait_primary_notification(&new_primary_id) == true)
 		{
 			/* if primary has reappeared, no action needed */
@@ -1454,14 +1609,12 @@ do_primary_failover(void)
 											  &config_file_options,
 											  local_node_info.node_id,
 											  "standby_disconnect_manual",
-
-					/*
-					 * here "true" indicates the action has occurred as
-					 * expected
-					 */
+											  /*
+											   * here "true" indicates the action has occurred as expected
+											   */
 											  true,
 											  event_details.data);
-					PQfinish(new_primary_conn);
+					close_connection(&new_primary_conn);
 					termPQExpBuffer(&event_details);
 
 				}
@@ -1677,11 +1830,10 @@ do_upstream_standby_failover(void)
 	t_node_info primary_node_info = T_NODE_INFO_INITIALIZER;
 	RecordStatus record_status = RECORD_NOT_FOUND;
 	RecoveryType primary_type = RECTYPE_UNKNOWN;
-	int			r;
+	int			i, r;
 	char		parsed_follow_command[MAXPGPATH] = "";
 
-	PQfinish(upstream_conn);
-	upstream_conn = NULL;
+	close_connection(&upstream_conn);
 
 	if (get_primary_node_record(local_conn, &primary_node_info) == false)
 	{
@@ -1702,7 +1854,7 @@ do_upstream_standby_failover(void)
 				  primary_node_info.node_name,
 				  primary_node_info.node_id);
 
-		PQfinish(primary_conn);
+		close_connection(&primary_conn);
 		monitoring_state = MS_DEGRADED;
 		INSTR_TIME_SET_CURRENT(degraded_monitoring_start);
 		return false;
@@ -1716,15 +1868,14 @@ do_upstream_standby_failover(void)
 				  primary_node_info.node_name,
 				  primary_node_info.node_id);
 
-		PQfinish(primary_conn);
+		close_connection(&primary_conn);
 		monitoring_state = MS_DEGRADED;
 		INSTR_TIME_SET_CURRENT(degraded_monitoring_start);
 		return false;
 	}
 
 	/* Close the connection to this server */
-	PQfinish(local_conn);
-	local_conn = NULL;
+	close_connection(&local_conn);
 
 	initPQExpBuffer(&event_details);
 
@@ -1762,8 +1913,30 @@ do_upstream_standby_failover(void)
 		termPQExpBuffer(&event_details);
 	}
 
-	/* reconnect to local node */
-	local_conn = establish_db_connection(config_file_options.conninfo, false);
+	/*
+	 * It's possible that the standby is still starting up after the "follow_command"
+	 * completes, so poll for a while until we get a connection.
+	 */
+
+	for (i = 0; i < config_file_options.standby_reconnect_timeout; i++)
+	{
+		local_conn = establish_db_connection(local_node_info.conninfo, false);
+
+		if (PQstatus(local_conn) == CONNECTION_OK)
+			break;
+
+		log_debug("sleeping 1 second; %i of %i attempts to reconnect to local node",
+				  i + 1,
+				  config_file_options.standby_reconnect_timeout);
+		sleep(1);
+	}
+
+	if (PQstatus(local_conn) != CONNECTION_OK)
+	{
+		log_error(_("unable to reconnect to local node %i"),
+				  local_node_info.node_id);
+		return FAILOVER_STATE_FOLLOW_FAIL;
+	}
 
 	/* refresh shared memory settings which will have been zapped by the restart */
 	repmgrd_set_local_node_id(local_conn, config_file_options.node_id);
@@ -2021,7 +2194,7 @@ wait_primary_notification(int *new_primary_id)
 			return true;
 		}
 
-		log_verbose(LOG_DEBUG, "waiting for new primary notification, %i of max %i seconds",
+		log_verbose(LOG_DEBUG, "waiting for new primary notification, %i of max %i seconds (\"primary_notification_timeout\")",
 					i, config_file_options.primary_notification_timeout);
 
 		sleep(1);
@@ -2043,7 +2216,7 @@ follow_new_primary(int new_primary_id)
 	char		parsed_follow_command[MAXPGPATH] = "";
 
 	PQExpBufferData event_details;
-	int			r;
+	int			i, r;
 
 	/* Store details of the failed node here */
 	t_node_info failed_primary = T_NODE_INFO_INITIALIZER;
@@ -2090,7 +2263,7 @@ follow_new_primary(int new_primary_id)
 		{
 			new_primary_ok = false;
 			log_warning(_("new primary is not in recovery"));
-			PQfinish(upstream_conn);
+			close_connection(&upstream_conn);
 		}
 	}
 
@@ -2104,8 +2277,7 @@ follow_new_primary(int new_primary_id)
 	 * restart
 	 */
 
-	PQfinish(local_conn);
-	local_conn = NULL;
+	close_connection(&local_conn);
 
 	/*
 	 * replace %n in "config_file_options.follow_command" with ID of primary
@@ -2124,39 +2296,51 @@ follow_new_primary(int new_primary_id)
 		PGconn	   *old_primary_conn;
 
 		/*
-		 * The follow action could still fail due to the original primary
+		 * The "standby follow" command could still fail due to the original primary
 		 * reappearing before the candidate could promote itself ("repmgr
 		 * standby follow" will refuse to promote another node if the primary
-		 * is available). However the new primary will only instruct use to
-		 * follow it after it's successfully promoted itself, so that very
-		 * likely won't be the reason for the failure.
-		 *
-		 *
-		 * TODO: check the new primary too - we could have a split-brain
-		 * situation where the old primary reappeared just after the new one
-		 * promoted itself.
+		 * is available). However the new primary will only instruct the other
+		 * nodes to follow it after it's successfully promoted itself, so this
+		 * case is highly unlikely. A slightly more likely scenario would
+		 * be the new primary becoming unavailable just after it's sent notifications
+		 * to its follower nodes, and the old primary becoming available again.
 		 */
 		old_primary_conn = establish_db_connection(failed_primary.conninfo, false);
 
 		if (PQstatus(old_primary_conn) == CONNECTION_OK)
 		{
-			/* XXX add event notifications */
 			RecoveryType upstream_recovery_type = get_recovery_type(old_primary_conn);
 
-			PQfinish(old_primary_conn);
-
 			if (upstream_recovery_type == RECTYPE_PRIMARY)
 			{
-				log_notice(_("original primary reappeared - no action taken"));
+				initPQExpBuffer(&event_details);
+				appendPQExpBuffer(&event_details,
+								  _("original primary reappeared - no action taken"));
+
+				log_notice("%s", event_details.data);
+
+				create_event_notification(old_primary_conn,
+										  &config_file_options,
+										  local_node_info.node_id,
+										  "repmgrd_failover_aborted",
+										  true,
+										  event_details.data);
+
+				termPQExpBuffer(&event_details);
+
+				close_connection(&old_primary_conn);
+
 				return FAILOVER_STATE_PRIMARY_REAPPEARED;
 			}
+
+			log_notice(_("original primary reappeared as standby"));
+
+			close_connection(&old_primary_conn);
 		}
 
 		return FAILOVER_STATE_FOLLOW_FAIL;
 	}
 
-
-
 	/*
 	 * refresh local copy of local and primary node records - we get these
 	 * directly from the primary to ensure they're the current version
@@ -2179,7 +2363,30 @@ follow_new_primary(int new_primary_id)
 		return FAILOVER_STATE_FOLLOW_FAIL;
 	}
 
-	local_conn = establish_db_connection(local_node_info.conninfo, false);
+	/*
+	 * It's possible that the standby is still starting up after the "follow_command"
+	 * completes, so poll for a while until we get a connection.
+	 */
+
+	for (i = 0; i < config_file_options.standby_reconnect_timeout; i++)
+	{
+		local_conn = establish_db_connection(local_node_info.conninfo, false);
+
+		if (PQstatus(local_conn) == CONNECTION_OK)
+			break;
+
+		log_debug("sleeping 1 second; %i of %i attempts to reconnect to local node",
+				  i + 1,
+				  config_file_options.standby_reconnect_timeout);
+		sleep(1);
+	}
+
+	if (PQstatus(local_conn) != CONNECTION_OK)
+	{
+		log_error(_("unable to reconnect to local node %i"),
+				  local_node_info.node_id);
+		return FAILOVER_STATE_FOLLOW_FAIL;
+	}
 
 	/* refresh shared memory settings which will have been zapped by the restart */
 	repmgrd_set_local_node_id(local_conn, config_file_options.node_id);
@@ -2192,8 +2399,7 @@ follow_new_primary(int new_primary_id)
 
 	log_notice("%s", event_details.data);
 
-	create_event_notification(
-							  upstream_conn,
+	create_event_notification(upstream_conn,
 							  &config_file_options,
 							  local_node_info.node_id,
 							  "repmgrd_failover_follow",
@@ -2245,7 +2451,7 @@ witness_follow_new_primary(int new_primary_id)
 		{
 			new_primary_ok = false;
 			log_warning(_("new primary is not in recovery"));
-			PQfinish(upstream_conn);
+			close_connection(&upstream_conn);
 		}
 	}
 
@@ -2367,18 +2573,20 @@ do_election(void)
 
 	if (config_file_options.failover == FAILOVER_MANUAL)
 	{
-		log_notice(_("this node is not configured for automatic failover so will not be considered as promotion candidate"));
+		log_notice(_("this node is not configured for automatic failover so will not be considered as promotion candidate, and will not follow the new primary"));
+		log_detail(_("\"failover\" is set to \"manual\" in repmgr.conf"));
+		log_hint(_("manually execute \"repmgr standby follow\" to have this node follow the new primary"));
 
-		return ELECTION_LOST;
+		return ELECTION_NOT_CANDIDATE;
 	}
 
-	/* node priority is set to zero - don't ever become a candidate */
+	/* node priority is set to zero - don't become a candidate, and lose by default */
 	if (local_node_info.priority <= 0)
 	{
 		log_notice(_("this node's priority is %i so will not be considered as an automatic promotion candidate"),
 				   local_node_info.priority);
 
-		return ELECTION_NOT_CANDIDATE;
+		return ELECTION_LOST;
 	}
 
 	/* get all active nodes attached to upstream, excluding self */
@@ -2418,6 +2626,14 @@ do_election(void)
 			return ELECTION_NOT_CANDIDATE;
 		}
 	}
+	else
+	{
+		/* standby nodes found - check if we're in the primary location befor checking theirs */
+		if (strncmp(upstream_node_info.location, local_node_info.location, MAXLEN) == 0)
+		{
+			primary_location_seen = true;
+		}
+	}
 
 	/* get our lsn */
 	local_node_info.last_wal_receive_lsn = get_last_wal_receive_location(local_conn);
@@ -2715,31 +2931,11 @@ format_failover_state(FailoverState failover_state)
 		case FAILOVER_STATE_FOLLOW_FAIL:
 			return "FOLLOW_FAIL";
 		case FAILOVER_STATE_NODE_NOTIFICATION_ERROR:
-			return "ODE_NOTIFICATION_ERROR";
+			return "NODE_NOTIFICATION_ERROR";
 	}
 
 	/* should never reach here */
 	return "UNKNOWN_FAILOVER_STATE";
 }
 
-#endif							/* #ifndef BDR_ONLY */
 
-void
-close_connections_physical()
-{
-	if (PQstatus(primary_conn) == CONNECTION_OK)
-	{
-		/* cancel any pending queries to the primary */
-		if (PQisBusy(primary_conn) == 1)
-			cancel_query(primary_conn, config_file_options.async_query_timeout);
-		PQfinish(primary_conn);
-		primary_conn = NULL;
-	}
-
-	if (upstream_conn != NULL && PQstatus(upstream_conn) == CONNECTION_OK)
-	{
-		PQfinish(upstream_conn);
-		upstream_conn = NULL;
-	}
-
-}

repmgrd-physical.h

@@ -24,6 +24,7 @@ void		do_physical_node_check(void);
 void		monitor_streaming_primary(void);
 void		monitor_streaming_standby(void);
 void		monitor_streaming_witness(void);
-void		close_connections_physical(void);
+
+void		handle_sigint_physical(SIGNAL_ARGS);
 
 #endif							/* _REPMGRD_PHYSICAL_H_ */

repmgrd.c

@@ -53,9 +53,6 @@ bool		startup_event_logged = false;
 MonitoringState monitoring_state = MS_NORMAL;
 instr_time	degraded_monitoring_start;
 
-static void close_connections(void);
-void		(*_close_connections) (void) = NULL;
-
 /*
  * Record receipt of SIGHUP; will cause configuration file to be reread
  * at the appropriate point in the main loop.
@@ -73,7 +70,6 @@ static void start_monitoring(void);
 #ifndef WIN32
 static void setup_event_handlers(void);
 static void handle_sighup(SIGNAL_ARGS);
-static void handle_sigint(SIGNAL_ARGS);
 #endif
 
 int			calculate_elapsed(instr_time start_time);
@@ -89,6 +85,7 @@ main(int argc, char **argv)
 	bool		cli_monitoring_history = false;
 
 	RecordStatus record_status;
+	ExtensionStatus extension_status = REPMGR_UNKNOWN;
 
 	FILE	   *fd;
 
@@ -254,6 +251,8 @@ main(int argc, char **argv)
 		strncpy(config_file_options.log_level, cli_log_level, MAXLEN);
 	}
 
+	log_notice(_("repmgrd (repmgr %s) starting up"), REPMGR_VERSION);
+
 	/*
 	 * -m/--monitoring-history, if provided, will override repmgr.conf's
 	 * monitoring_history; this is for backwards compatibility as it's
@@ -318,15 +317,60 @@ main(int argc, char **argv)
 	 * repmgr has not been properly configured.
 	 */
 
+	/* Check "repmgr" the extension is installed */
+	extension_status = get_repmgr_extension_status(local_conn);
+
+	if (extension_status != REPMGR_INSTALLED)
+	{
+		/* this is unlikely to happen */
+		if (extension_status == REPMGR_UNKNOWN)
+		{
+			log_error(_("unable to determine status of \"repmgr\" extension"));
+			log_detail("%s", PQerrorMessage(local_conn));
+			close_connection(&local_conn);
+			exit(ERR_DB_QUERY);
+		}
+
+		log_error(_("repmgr extension not found on this node"));
+
+		if (extension_status == REPMGR_AVAILABLE)
+		{
+			log_detail(_("repmgr extension is available but not installed in database \"%s\""),
+					   PQdb(local_conn));
+		}
+		else if (extension_status == REPMGR_UNAVAILABLE)
+		{
+			log_detail(_("repmgr extension is not available on this node"));
+		}
+
+		log_hint(_("check that this node is part of a repmgr cluster"));
+		close_connection(&local_conn);
+		exit(ERR_BAD_CONFIG);
+	}
+
 	/* Retrieve record for this node from the local database */
 	record_status = get_node_record(local_conn, config_file_options.node_id, &local_node_info);
 
+	/*
+	 * Terminate if we can't find the local node record. This is a
+	 * "fix-the-config" situation, not a lot else we can do.
+	 */
+
 	if (record_status != RECORD_FOUND)
 	{
 		log_error(_("no metadata record found for this node - terminating"));
-		log_hint(_("check that 'repmgr (primary|standby) register' was executed for this node"));
 
-		PQfinish(local_conn);
+		switch (config_file_options.replication_type)
+		{
+			case REPLICATION_TYPE_PHYSICAL:
+				log_hint(_("check that 'repmgr (primary|standby) register' was executed for this node"));
+				break;
+			case REPLICATION_TYPE_BDR:
+				log_hint(_("check that 'repmgr bdr register' was executed for this node"));
+				break;
+		}
+
+		close_connection(&local_conn);
 		terminate(ERR_BAD_CONFIG);
 	}
 
@@ -345,7 +389,7 @@ main(int argc, char **argv)
 		{
 			log_error(_("unable to write to shared memory"));
 			log_hint(_("ensure \"shared_preload_libraries\" includes \"repmgr\""));
-			PQfinish(local_conn);
+			close_connection(&local_conn);
 			terminate(ERR_BAD_CONFIG);
 		}
 	}
@@ -357,7 +401,6 @@ main(int argc, char **argv)
 	}
 	else
 	{
-		_close_connections = close_connections_physical;
 		log_debug("node id is %i, upstream node id is %i",
 				  local_node_info.node_id,
 				  local_node_info.upstream_node_id);
@@ -400,7 +443,6 @@ start_monitoring(void)
 	{
 		switch (local_node_info.type)
 		{
-#ifndef BDR_ONLY
 			case PRIMARY:
 				monitor_streaming_primary();
 				break;
@@ -410,11 +452,6 @@ start_monitoring(void)
 			case WITNESS:
 				monitor_streaming_witness();
 				break;
-#else
-			case PRIMARY:
-			case STANDBY:
-				return;
-#endif
 			case BDR:
 				monitor_bdr();
 				return;
@@ -587,11 +624,6 @@ check_and_create_pid_file(const char *pid_file)
 
 
 #ifndef WIN32
-static void
-handle_sigint(SIGNAL_ARGS)
-{
-	terminate(SUCCESS);
-}
 
 /* SIGHUP: set flag to re-read config file at next convenient time */
 static void
@@ -604,8 +636,23 @@ static void
 setup_event_handlers(void)
 {
 	pqsignal(SIGHUP, handle_sighup);
-	pqsignal(SIGINT, handle_sigint);
-	pqsignal(SIGTERM, handle_sigint);
+
+	/*
+	 * we want to be able to write a "repmgrd_shutdown" event, so delegate
+	 * signal handling to the respective replication type handler, as it
+	 * will know best which database connection to use
+	 */
+	switch (config_file_options.replication_type)
+	{
+		case REPLICATION_TYPE_BDR:
+			pqsignal(SIGINT, handle_sigint_bdr);
+			pqsignal(SIGTERM, handle_sigint_bdr);
+			break;
+		case REPLICATION_TYPE_PHYSICAL:
+			pqsignal(SIGINT, handle_sigint_physical);
+			pqsignal(SIGTERM, handle_sigint_physical);
+			break;
+	}
 }
 #endif
 
@@ -654,17 +701,29 @@ PGconn *
 try_reconnect(t_node_info *node_info)
 {
 	PGconn	   *conn;
+	t_conninfo_param_list conninfo_params = T_CONNINFO_PARAM_LIST_INITIALIZER;
 
 	int			i;
 
 	int			max_attempts = config_file_options.reconnect_attempts;
 
+	initialize_conninfo_params(&conninfo_params, false);
+
+
+	/* we assume by now the conninfo string is parseable */
+	(void) parse_conninfo_string(node_info->conninfo, &conninfo_params, NULL, false);
+
+	/* set some default values if not explicitly provided */
+	param_set_ine(&conninfo_params, "connect_timeout", "2");
+	param_set_ine(&conninfo_params, "fallback_application_name", "repmgr");
+
 	for (i = 0; i < max_attempts; i++)
 	{
 		log_info(_("checking state of node %i, %i of %i attempts"),
 				 node_info->node_id, i + 1, max_attempts);
-		if (is_server_available(node_info->conninfo) == true)
+		if (is_server_available_params(&conninfo_params) == true)
 		{
+
 			log_notice(_("node has recovered, reconnecting"));
 
 			/*
@@ -672,14 +731,18 @@ try_reconnect(t_node_info *node_info)
 			 * connection denied due to connection exhaustion - fall back to
 			 * degraded monitoring? - make that configurable
 			 */
-			conn = establish_db_connection(node_info->conninfo, false);
+
+			conn = establish_db_connection_by_params(&conninfo_params, false);
+
 			if (PQstatus(conn) == CONNECTION_OK)
 			{
+				free_conninfo_params(&conninfo_params);
+
 				node_info->node_status = NODE_STATUS_UP;
 				return conn;
 			}
 
-			PQfinish(conn);
+			close_connection(&conn);
 			log_notice(_("unable to reconnect to node"));
 		}
 
@@ -691,13 +754,14 @@ try_reconnect(t_node_info *node_info)
 		}
 	}
 
-
 	log_warning(_("unable to reconnect to node %i after %i attempts"),
 				node_info->node_id,
 				max_attempts);
 
 	node_info->node_status = NODE_STATUS_DOWN;
 
+	free_conninfo_params(&conninfo_params);
+
 	return NULL;
 }
 
@@ -733,24 +797,9 @@ print_monitoring_state(MonitoringState monitoring_state)
 }
 
 
-static void
-close_connections()
-{
-	if (_close_connections != NULL)
-		_close_connections();
-
-	if (local_conn != NULL && PQstatus(local_conn) == CONNECTION_OK)
-	{
-		PQfinish(local_conn);
-		local_conn = NULL;
-	}
-
-}
-
 void
 terminate(int retval)
 {
-	close_connections();
 	logger_shutdown();
 
 	if (pid_file)