synchronous_commit

Definition PG 18 manual

Specifies how much WAL processing must complete before the database server returns a “success” indication to the client. Valid values are remote_apply, on (the default), remote_write, local, and off.

If synchronous_standby_names is empty, the only meaningful settings are on and off; remote_apply, remote_write and local all provide the same local synchronization level as on. The local behavior of all non-off modes is to wait for local flush of WAL to disk. In off mode, there is no waiting, so there can be a delay between when success is reported to the client and when the transaction is later guaranteed to be safe against a server crash. (The maximum delay is three times wal_writer_delay.) Unlike fsync, setting this parameter to off does not create any risk of database inconsistency: an operating system or database crash might result in some recent allegedly-committed transactions being lost, but the database state will be just the same as if those transactions had been aborted cleanly. So, turning synchronous_commit off can be a useful alternative when performance is more important than exact certainty about the durability of a transaction. For more discussion see Section 28.4.

If synchronous_standby_names is non-empty, synchronous_commit also controls whether transaction commits will wait for their WAL records to be processed on the standby server(s).

When set to remote_apply, commits will wait until replies from the current synchronous standby(s) indicate they have received the commit record of the transaction and applied it, so that it has become visible to queries on the standby(s), and also written to durable storage on the standbys. This will cause much larger commit delays than previous settings since it waits for WAL replay. When set to on, commits wait until replies from the current synchronous standby(s) indicate they have received the commit record of the transaction and flushed it to durable storage. This ensures the transaction will not be lost unless both the primary and all synchronous standbys suffer corruption of their database storage. When set to remote_write, commits will wait until replies from the current synchronous standby(s) indicate they have received the commit record of the transaction and written it to their file systems. This setting ensures data preservation if a standby instance of PostgreSQL crashes, but not if the standby suffers an operating-system-level crash because the data has not necessarily reached durable storage on the standby. The setting local causes commits to wait for local flush to disk, but not for replication. This is usually not desirable when synchronous replication is in use, but is provided for completeness.

This parameter can be changed at any time; the behavior for any one transaction is determined by the setting in effect when it commits. It is therefore possible, and useful, to have some transactions commit synchronously and others asynchronously. For example, to make a single multistatement transaction commit asynchronously when the default is the opposite, issue SET LOCAL synchronous_commit TO OFF within the transaction.

Table 19.1 summarizes the capabilities of the synchronous_commit settings.

How it works

All modes except off wait for the transaction's WAL to be flushed locally. With off, success can be returned before local durable flush; a crash can lose recent acknowledged transactions, but recovery remains transactionally consistent and does not introduce the corruption risk associated with fsync = off.

When synchronous_standby_names selects synchronous standbys, remote_write waits for receipt and an operating-system write on a standby, on waits for a durable standby flush, and remote_apply waits for replay and query visibility. local waits only for local durable flush. Without a selected synchronous standby, the remote modes add no remote guarantee.

The effective mode is the value in force when a transaction commits. Applications can use SET LOCAL for one transaction, allowing critical and replaceable work to use different durability policies on the same server.

Operational considerations

Equating synchronous_commit = off with fsync = off; the former risks recent data loss, not structural corruption.

Expecting remote_write, on, or remote_apply to wait remotely when no synchronous standby is selected.

Using remote_write while assuming the standby is durable across an operating-system crash.

Allowing an unavailable synchronous standby to stall commits without an HA response plan.

Leaking a session-level SET through a connection pool instead of using SET LOCAL or reset discipline.

Workload guidance

OLAP: For a reproducible bulk load, transaction-local off can improve throughput if losing the final unflushed portion is acceptable and the load can be rerun. Keep catalog changes, handoff markers, and externally visible completion records synchronous.

OLTP: Keep on as the general default. Use off only for explicitly replaceable transactions, and use remote_apply only when post-commit reads on a synchronous standby require causal visibility; include network round-trip and standby health in the latency budget.

SMALL: Retain on. Small systems rarely gain enough from a global durability downgrade to justify the operational ambiguity; tune individual noncritical jobs instead.