full_page_writes

Definition PG 18 manual

When this parameter is on, the PostgreSQL server writes the entire content of each disk page to WAL during the first modification of that page after a checkpoint. This is needed because a page write that is in process during an operating system crash might be only partially completed, leading to an on-disk page that contains a mix of old and new data. The row-level change data normally stored in WAL will not be enough to completely restore such a page during post-crash recovery. Storing the full page image guarantees that the page can be correctly restored, but at the price of increasing the amount of data that must be written to WAL. (Because WAL replay always starts from a checkpoint, it is sufficient to do this during the first change of each page after a checkpoint. Therefore, one way to reduce the cost of full-page writes is to increase the checkpoint interval parameters.)

Turning this parameter off speeds normal operation, but might lead to either unrecoverable data corruption, or silent data corruption, after a system failure. The risks are similar to turning off fsync, though smaller, and it should be turned off only based on the same circumstances recommended for that parameter.

Turning off this parameter does not affect use of WAL archiving for point-in-time recovery (PITR) (see Section 25.3).

This parameter can only be set in the postgresql.conf file or on the server command line. The default is on.

How it works

Writes full pages to WAL when first modified after a checkpoint. A configuration reload applies a new value; existing work already in flight is not retroactively changed.

After each checkpoint, the first change to a data page logs a complete page image, preventing torn-page recovery from combining old and new sectors. The extra WAL is concentrated after checkpoints and is affected by wal_compression; disabling it is unsafe unless the storage stack provides an equivalent atomic-page guarantee.

Monitor and change full_page_writes together with data_sync_retry, restart_after_crash, recovery_init_sync_method. Validate on the relevant server role and real workload, then use its sighup context to choose session change, reload, or restart; a historical boot default is not the current effective value.

Operational considerations

Disabling it without an end-to-end atomic-page guarantee.

Confusing its WAL-volume cost with logging every page on every change.

Ignoring the post-checkpoint full-page-image burst.

Assuming a reload retroactively protects WAL records that were generated while full_page_writes was off.

Benchmarking with it disabled without an end-to-end crash, recovery, and torn-page test.

Workload guidance

OLAP: Bulk loads still need recoverability. Use explicitly rebuildable UNLOGGED/temporary staging to narrow the durability scope rather than disabling protection cluster-wide.

OLTP: Keep full_page_writes=on for persistent production data. Address storage latency, checkpoints, WAL compression, and batching instead of exchanging crash safety for throughput.

SMALL: Keep it on for persistent small instances too. Only a clearly isolated, disposable cluster may make an exception after explicitly accepting rebuild risk.