vacuum_failsafe_age

Definition PG 18 manual

Specifies the maximum age (in transactions) that a table's pg_class.relfrozenxid field can attain before VACUUM takes extraordinary measures to avoid system-wide transaction ID wraparound failure. This is VACUUM's strategy of last resort. The failsafe typically triggers when an autovacuum to prevent transaction ID wraparound has already been running for some time, though it's possible for the failsafe to trigger during any VACUUM.

When the failsafe is triggered, any cost-based delay that is in effect will no longer be applied, further non-essential maintenance tasks (such as index vacuuming) are bypassed, and any Buffer Access Strategy in use will be disabled resulting in VACUUM being free to make use of all of shared buffers.

The default is 1.6 billion transactions. Although users can set this value anywhere from zero to 2.1 billion, VACUUM will silently adjust the effective value to no less than 105% of autovacuum_freeze_max_age.

How it works

Age at which VACUUM should trigger failsafe to avoid a wraparound outage. It can be changed at session scope, so different sessions may observe different behavior.

At the failsafe age, a running VACUUM prioritizes advancing the freeze horizon quickly: cost delays stop and optional work such as index cleanup and tail truncation is skipped. This is a last defense against wraparound outage, not a routine performance mode.

Monitor and change vacuum_failsafe_age together with autovacuum_freeze_max_age, vacuum_freeze_min_age, vacuum_freeze_table_age. Validate on the relevant server role and real workload, then use its user context to choose session change, reload, or restart; a historical boot default is not the current effective value.

Operational considerations

Treating failsafe as a normal high-throughput VACUUM mode.

Ignoring skipped index cleanup after the emergency has passed.

Raising the age to suppress evidence of a maintenance failure.

Changing the global value while a table storage parameter overrides it.

Treating reltuples and cumulative change statistics as exact real-time counts.

Workload guidance

OLAP: Proactively VACUUM (FREEZE) newly loaded or static partitions in batch windows and reserve I/O time for full scans. Convert age budgets using peak transaction rate, not a wall-clock guess.

OLTP: Calibrate vacuum_failsafe_age against the oldest XID/MXID age in every database and measured vacuum completion rate. Remove long transactions, stale slots, and blocked workers; never raise ages merely to hide a backlog.

SMALL: Upstream defaults are usually safest. A small system still needs anti-wraparound maintenance; monitor every database, not only the application database.