Increase threshold for multixact member emergency autovac to 50%.

Analysis by Noah Misch shows that the 25% threshold set by commit
53bb309d2d5a9432d2602c93ed18e58bd2924e15 is lower than any other,
similar autovac threshold.  While we don't know exactly what value
will be optimal for all users, it is better to err a little on the
high side than on the low side.  A higher value increases the risk
that users might exhaust the available space and start seeing errors
before autovacuum can clean things up sufficiently, but a user who
hits that problem can compensate for it by reducing
autovacuum_multixact_freeze_max_age to a value dependent on their
average multixact size.  On the flip side, if the emergency cap
imposed by that patch kicks in too early, the user will experience
excessive wraparound scanning and will be unable to mitigate that
problem by configuration.  The new value will hopefully reduce the
risk of such bad experiences while still providing enough headroom
to avoid multixact member exhaustion for most users.

Along the way, adjust the documentation to reflect the effects of
commit 04e6d3b877e060d8445eb653b7ea26b1ee5cec6b, which taught
autovacuum to run for multixact wraparound even when autovacuum
is configured off.

diff --git a/doc/src/sgml/maintenance.sgml b/doc/src/sgml/maintenance.sgml
index 8b2161da29117226d03d86355b7d5773e9264369..4383862981c5d16b1abff22dc3626a61d6caf291 100644 (file)
--- a/doc/src/sgml/maintenance.sgml
+++ b/doc/src/sgml/maintenance.sgml
@@ -655,11 +655,12 @@ HINT:  Stop the postmaster and use a standalone backend to VACUUM in "mydb".
     
      As a safety device, a whole-table vacuum scan will occur for any table
      whose multixact-age is greater than
-     .
-     This will occur even if autovacuum is nominally disabled.  Whole-table
+     .  Whole-table
      vacuum scans will also occur progressively for all tables, starting with
      those that have the oldest multixact-age, if the amount of used member
-     storage space exceeds the amount 25% of the addressible storage space.
+     storage space exceeds the amount 50% of the addressible storage space.
+     Both of these kinds of whole-table scans will occur even if autovacuum is
+     nominally disabled.
     
    
   

diff --git a/src/backend/access/transam/multixact.c b/src/backend/access/transam/multixact.c
index f26f47e96b5cdcd5b178aa68fabcf009ff5d644f..699497c4c3f5783e9cffb6ad4de3d712b00b3b22 100644 (file)
--- a/src/backend/access/transam/multixact.c
+++ b/src/backend/access/transam/multixact.c
@@ -167,7 +167,7 @@
     ((xid) % MULTIXACT_MEMBERS_PER_MEMBERGROUP) * sizeof(TransactionId))
 
 /* Multixact members wraparound thresholds. */
-#define MULTIXACT_MEMBER_SAFE_THRESHOLD        (MaxMultiXactOffset / 4)
+#define MULTIXACT_MEMBER_SAFE_THRESHOLD        (MaxMultiXactOffset / 2)
 #define MULTIXACT_MEMBER_DANGER_THRESHOLD  \
    (MaxMultiXactOffset - MaxMultiXactOffset / 4)