ignore_invalid_pages

Definition PG 18 manual

If set to off (the default), detection of WAL records having references to invalid pages during recovery causes PostgreSQL to raise a PANIC-level error, aborting the recovery. Setting ignore_invalid_pages to on causes the system to ignore invalid page references in WAL records (but still report a warning), and continue the recovery. This behavior may cause crashes, data loss, propagate or hide corruption, or other serious problems. However, it may allow you to get past the PANIC-level error, to finish the recovery, and to cause the server to start up. The parameter can only be set at server start. It only has effect during recovery or in standby mode.

How it works

During recovery, WAL references to invalid pages normally cause PANIC and stop recovery. ignore_invalid_pages logs a warning and continues past those references.

The startup-only setting has effect only in recovery or standby mode. Skipping redo can lose data, propagate corruption, and leave structures internally inconsistent even if the server reaches a running state.

It is an emergency salvage mechanism after preserving evidence and exhausting correct restore paths. A server that starts under it must not be considered healthy or promoted into normal service. Its postmaster context fixes the value at server start; changing it requires a restart.

Operational considerations

Leaving ignore_invalid_pages enabled after the bounded diagnostic or recovery task.

Running the experiment on the only copy of production data.

Underestimating log, core-file, temporary-file, WAL, CPU, or connection-slot amplification.

Treating a server that merely starts or completes a query as proof that data and behavior are correct.

Workload guidance

OLAP: Read-only analytics does not make ignore_invalid_pages safe: corrupted pages can still poison results or structures. Use only on a disposable salvage copy with explicit acceptance of lost data.

OLTP: Never use ignore_invalid_pages as tuning or a steady-state availability setting. Stop writes, preserve immutable copies, exhaust backup/storage repair, document expected data loss, salvage narrowly, rebuild, and validate before any return to service.

SMALL: Do not enable ignore_invalid_pages merely because no replica exists. Preserve the original first and seek a clean backup; this switch can convert visible corruption into silent loss.